Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On our active directory server, I would like to enable LDAP over SSL as per this: http://support.microsoft.com/kb/321051. I am wondering, once this is set up, will LDAP still be listening on the standard port, 389 once this is implemented as well as the secure port? Or will the secure port completely replace the standard port as an option to connect to?

Also, will there need to be any other configurations besides the steps in the article for doing this? In other words, will domain users still be able to authenticate like normal, or is there additional setup that would need to occur?

share|improve this question
    
I can tell you LDAP over SSL operates on port 636 –  ITGuy24 Feb 12 '10 at 19:51

2 Answers 2

Active Directory will continue to listen on port 389. When an appropriate certificate is found during startup it will begin to listen for LDAPS but the non-secure LDAP behavior remains intact.

I'm having a problem finding documentation that indicates what the Active Directory client built-in to Windows clients will be. Its unclear to me whether the client will automatically attempt to perform LDAPS operations in place of LDAP operations. I'd be interested to see if somebody else can find a documentation link that explains the client behavior.

In lieu of documentation from Microsoft confirming the client behavior, I'd recommend using something like Wireshark to monitor the "before and after" network traffic.

share|improve this answer

Domain users will logon like normal.

You may find the folloing links helpful:

Logon and Authentication Technologies

http://technet.microsoft.com/en-us/library/cc780455%28WS.10%29.aspx

How to enable LDAP over SSL with a third-party certification authority

http://support.microsoft.com/kb/321051

I tried to find a clear authentication diagram. Adding LDAPs in Active Directory is typically done so that authentication for 3rd party services or products such as other directory servers, php web apps, two-factor authentication systems or unix/linux machines.

I had used ldaps in the past so that passwords were not passed in clear over the network between a SAP Enterprise Portal web environment and Active Directory.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.