<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="ltr">
<div id="id-8cbb2be6-f271-4d9a-a1fa-1a6df6237481" class="ms-outlook-mobile-reference-message">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-size: 1rem;">Hello,</span></div>
<div>
<div>
<div><br>
</div>
<div style="direction: ltr;">Some updates:</div>
<div><br>
</div>
<div style="direction: ltr;">Microsoft moved their automatic update of the LDAP policies in Windows Server updates to March 2020 (but still recommend to activate it earlier).</div>
<div><br>
</div>
<div style="direction: ltr;">And I did some tests: when you turn on the mandatory LDAP Signing, then simple binds or Digest-md5 binds over LDAP are rejected by NTDS. Both work over ldaps: (Implicite TLS, did not check STARTTLS). DIGEST-MD5 without TLS is also
possible, but you have to request qop=auth-int. (Sidenode AD will reject digest-md5 with Auth-int over TLS). I did not Test GSSAPI or SPNEGO yet.</div>
<div><br>
</div>
<div style="direction: ltr;">The mandatory LDAP channel binding does not seem to make a problem/change. I suspect it only applies to Kerberos or NTLM which I still need to test.</div>
<div><br>
</div>
<div style="direction: ltr;">Gruss</div>
<div style="direction: ltr;">Bernd</div>
<div><br>
</div>
<div style="direction: ltr;">PS: testcode https://gist.github.com/ecki/cdd7a14575b7dca10da8d362974731a0</div>
</div>
<div><br>
</div>
<div class="ms-outlook-ios-signature">
<div><br>
</div>
<div style="direction: ltr;">-- </div>
<div style="direction: ltr;">http://bernd.eckenfels.net</div>
</div>
</div>
<br>
<br>
<br>
<div class="gmail_quote">On Wed, Dec 18, 2019 at 4:17 AM +0100, <span dir="ltr"><<a href="mailto:bernd-2019@eckenfels.net">bernd-2019@eckenfels.net</a>></span> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="3D"ltr"">
<div dir="ltr">
<div dir="ltr" style="">
<div dir="ltr">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
Hello,</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
Microsoft just released an Security Advisory, announcing that upcoming Windows Server Versions will turn on mandatory TLS Channel Binding (or signing) on LDAP Servers. They also remind Administrators to install the KB patch and turn it on.</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
Do you have experiences with this, will Java (8) work with the setting of "mandatory is supported" (1) and/or "mandatory" (2) for this key, and if not what is the plan here?</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
https://support.microsoft.com/en-us/help/4034879/how-to-add-the-ldapenforcechannelbinding-registry-entry</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
<br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
Gruss</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); text-align: left;" dir="ltr">
Bernd</div>
<div id="ms-outlook-mobile-signature">
<div style="direction: ltr;">-- </div>
<div style="direction: ltr;">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>