This article applies to:
- Trustwave SEG
- Trustwave SPE Connector Agent
Question:
- What is the required configuration to connect to a Microsoft LDAP server that has the March 10, 2020 security enhancement enabled?
Background:
As of March 10,2020, Microsoft provided the option to require Secure LDAP (LDAPS) for connections to LDAP servers.
Further information is available in the following Microsoft article: 2020 LDAP channel binding and LDAP signing requirement for Windows
- This was not an enforced change (as had been previously suggested)
Symptoms:
When connecting to an updated Microsoft LDAP server (on default port 389):
- Tests of unauthenticated LDAP connections will return "server down".
- Tests of authenticated connections will return "Could not authenticate LDAP connection. Strong Authentication Required"
Attempts to update group membership through the connector will fail.
Procedure:
To continue using LDAP connectors to Microsoft LDAP servers that have had the strong policy applied:
- Ensure that the LDAP server has a valid certificate in place. The certificate common name must match the FQDN or resolvable network name of the LDAPS server (for example LDAPSERVER.doc103.example.test)
- You can use the Microsoft LDP utility to check SSL support.
- If the certificate is self-signed, import it to the Windows Certificate Store (Trusted People folder) on the SEG Array Manager or the workstation where Connector Agent is installed.
- If the certificate is signed by a CA, ensure that the CA root certificate and any intermediate certificates are properly installed to the Windows Certificate Store on the Array Manager or Connector Agent workstation.
- Use the Configurator or Connector Agent interface to create or edit a connector.
- For the Server Name, specify the exact name given in the certificate (for example LDAPSERVER.doc103.example.test).
- Specify Connect using SSL and set the port as required (default: port 636)
- Provide logon details.
Notes:
- The March 2020 changes do not enforce policy by default. This is a change from the pre-announcement made by Microsoft.
- The March 2020 changes do not affect native AD connections. If you have installed the SEG Array Manager or the Connector Agent on a domain-joined server, the Microsoft Active Directory connector can be used with no additional configuration. Depending on the access permissions in AD, you may need to provide a user account to retrieve information.