We are working on a web project where we need to be able to bind to an active directory domain and then pass the user's credentials to the domain to make sure the user has successfully authenticated before we allow them access to one of our web applications. We have HTTPS working fine for the front end to accept the credentials. The problem we are running into is for the connection between our server and the active directory server. The active directory server is maintained by a different section of our IT department and we do not have access to it. This active directory server is using a self-signed certificate and does not have a fully qualified domain name (i.e. people.local).
I have read many places that talk about setting the TLS_REQCERT variable to never; however, I am worried about man-in-the-middle attacks and do not feel comfortable leaving the setting set this way. I have also read some articles that talk about being able to query the active directory server from a Linux command line, view the self-signed certificate, save the self-signed certificate to the local Linux server, and then use this certificate for the trust so that you do not have to set TLS_REQCERT to never. I am not sure how I can go about viewing and saving the self-signed certificate from the Linux command line. I have some CentOS servers that we are running that we need to make this operational on.
Any help that you can provide would be greatly appreciated. Thanks in advance.