redirect ldap to ldaps

Question

Is there a way to redirect a ldap client to an LDAPS service? Like with http where you can inform a client that requests http:\\something to request https:\\something by sending a 301/302 response.

I've already found ldap referrals but I'm not sure if they are what we're looking for. We want to redirect the client to the LDAPS service before the client tries to authenticate. We could shutdown the LDAP service and wait for users complaining but rather like to log the requests, redirect them and then fix\reconfigure clients as needed some time in the future.

Btw: This is not for LDAPv3 and starttls but for LDAPv2.

Answer 1

In theory an LDAP referral can do what you want, however a number of LDAP client implementations can't / won't "chase" referrals and you'll end up causing outages. You're going to have the best luck by logging the clients using the non-secure LDAP and asking them to stop (and, eventually, just turning off the non-secure LDAP). It's not pretty, but it's your best bet to keep things working w/o causing service outages.