Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to redirect a ldap client to an LDAPS service? Like with http where you can inform a client that requests http:\\something to request https:\\something by sending a 301/302 response.

I've already found ldap referrals but I'm not sure if they are what we're looking for. We want to redirect the client to the LDAPS service before the client tries to authenticate. We could shutdown the LDAP service and wait for users complaining but rather like to log the requests, redirect them and then fix\reconfigure clients as needed some time in the future.

Btw: This is not for LDAPv3 and starttls but for LDAPv2.

share|improve this question

In theory an LDAP referral can do what you want, however a number of LDAP client implementations can't / won't "chase" referrals and you'll end up causing outages. You're going to have the best luck by logging the clients using the non-secure LDAP and asking them to stop (and, eventually, just turning off the non-secure LDAP). It's not pretty, but it's your best bet to keep things working w/o causing service outages.

share|improve this answer
I second this method. We had to use it when we moved off of insecure LDAP at my old job. The last users were some weeny web-apps in distant departments no one remembered. – sysadmin1138 Nov 22 '11 at 18:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.