[DIRSERVER-2352] LdapNetworkConnection fails bind(SaslGssApiRequest)

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 1.0.2
• Component/s: ldap, sasl
• Environment: Fedora 33 5.12.12-200, AdoptOpenJDK 11.0.12.0.7 , Tomcat 9.0.45
• Assignee: Unassigned
• Reporter: Aaron S Dills
• Created: 02/Sep/21 13:43
• Updated: 21/Aug/22 05:20

Description

Microsoft introduced a new requirement on AD domain controllers found here:

https://support.microsoft.com/en-us/topic/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows-ef185fb8-00f7-167d-744c-f299a66fc00a

 

This has broken binding SaslGssApiRequest with an LdapNetworkConnection that has startTls. On our DC if I toggle the RegistryEntry "LdapEnforceChannelBinding" the bind(SaslGssApiRequest) works again.

There is a new JNDI environment property that can be set to use channel binding: 

https://bugs.openjdk.java.net/browse/JDK-8245527 

We need to be able to set this.