<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div dir="ltr" data-ogsc="" style="">
<div dir="ltr">
<div dir="ltr" data-ogsc="" style="">
<div dir="ltr">
<div dir="ltr" data-ogsc="" style="">
<div dir="ltr">
<div dir="ltr" data-ogsc="" style="">
<div dir="ltr">
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
<meta content="text/html; charset=us-ascii" data-ogsc="" style="">
</div>
<div data-ogsc="" style="">
<div dir="ltr">
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
Hello,</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
As I understand it, it is about the Extended Protection for Integrated Windows Authentication (probably only GSSAPI/Kerberos and GSS-SPNEGO/SSPCred which is not a OpenJDK mechanism).</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
In this case it includes Channel binding tokens into the subject information. CBT are not per-se TLS specific, however for traffic in TLS channels they do bind to the TLS session or to the endpoint.
<a href="https://tools.ietf.org/html/rfc5056#section-3.2">https://tools.ietf.org/html/rfc5056#section-3.2</a></div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
Some projects have implemented channel binding for IIS or WinRm already, for example here is a good discussion: https://github.com/requests/requests-kerberos/pull/92</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
<br>
</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
Gruss</div>
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;">
Bernd</div>
<div id="ms-outlook-mobile-signature">
<div style="direction:ltr">-- </div>
<div style="direction:ltr">http://bernd.eckenfels.net</div>
</div>
</div>
<div> </div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><b>Von:</b> Michael Osipov <1983-01-06@gmx.net><br>
<b>Gesendet:</b> Mittwoch, Dezember 18, 2019 6:37 PM<br>
<b>An:</b> Bernd Eckenfels; security-dev@openjdk.java.net<br>
<b>Betreff:</b> Re: Microsoft LDAP Channel Binding
<div> </div>
</font></div>
Am 2019-12-18 um 04:29 schrieb Bernd Eckenfels: <br>
> Hello, <br>
> <br>
> Microsoft just released an Security Advisory, announcing that upcoming Windows Server Versions will turn on mandatory TLS Channel Binding (and turn off simple binds with mandatory SASL signing) on LDAP Servers.<br>
<br>
Another question here, typically Microsoft: What makes you think that <br>
this is TLS channel binding? All I see is LDAP channel binding for which <br>
I fail to find any technical documentation. <br>
<br>
Michael <br>
</div>
<!--{"start":[1,0,2,0,260],"end":[1,0,2,0,260]}--></div>
<!--{"start":[1],"end":[1]}--></div>
<!--{"start":[0,0,1,0,2,0,371],"end":[0,0,1,0,2,0,371]}--></div>
<!--{"start":[0],"end":[0]}--></div>
<!--{"start":[0,0,0,0,1,0,4,0,112],"end":[0,0,0,0,1,0,4,0,112]}--></div>
<!--{"start":[0],"end":[0]}--></div>
<!--{"start":[0,0,0,0,0,0,1,0,6,0,112],"end":[0,0,0,0,0,0,1,0,6,0,112]}--></div>
<!--{"start":[0],"end":[0]}--></div>
</div>
</body>
</html>