Switching to LDAP over SSL for Active Directory

Question

On our active directory server, I would like to enable LDAP over SSL as per this: http://support.microsoft.com/kb/321051. I am wondering, once this is set up, will LDAP still be listening on the standard port, 389 once this is implemented as well as the secure port? Or will the secure port completely replace the standard port as an option to connect to?

Also, will there need to be any other configurations besides the steps in the article for doing this? In other words, will domain users still be able to authenticate like normal, or is there additional setup that would need to occur?

Answer 1

Active Directory will continue to listen on port 389. When an appropriate certificate is found during startup it will begin to listen for LDAPS but the non-secure LDAP behavior remains intact.

I'm having a problem finding documentation that indicates what the Active Directory client built-in to Windows clients will be. Its unclear to me whether the client will automatically attempt to perform LDAPS operations in place of LDAP operations. I'd be interested to see if somebody else can find a documentation link that explains the client behavior.

In lieu of documentation from Microsoft confirming the client behavior, I'd recommend using something like Wireshark to monitor the "before and after" network traffic.

Answer 2

Domain users will logon like normal.

You may find the folloing links helpful:

Logon and Authentication Technologies

http://technet.microsoft.com/en-us/library/cc780455%28WS.10%29.aspx

How to enable LDAP over SSL with a third-party certification authority

http://support.microsoft.com/kb/321051

I tried to find a clear authentication diagram. Adding LDAPs in Active Directory is typically done so that authentication for 3rd party services or products such as other directory servers, php web apps, two-factor authentication systems or unix/linux machines.

I had used ldaps in the past so that passwords were not passed in clear over the network between a SAP Enterprise Portal web environment and Active Directory.