I have an AD environment and in ldapsearch, I am able to use SRV records in DNS to resolve the LDAP servers in the domain and in a site.
This works great on the usual ldap port on 389, with basic auth and STARTTLS.
However, some horrible clients won't do STARTTLS, or the vendor is unable to provide a method to configure it. So we need to provide an option for LDAPS on 636.
In principle, I belive that creating ldaps SRV records and using the
ldaps:/// URI should work. I've created 2 ldaps SRV records in the domain zone (there are 3 ldap hosts), but when I do
ldapsearch and specify
ldaps:///, all it's discovering are the ldap hosts.
ldapsearch command - here it's returning three DCs with _ldap SRVs on port 389
$ ldapsearch -v -H "ldaps:///dc%3Devl%2Cdc%3Dexample%2Cdc%3Dcom" -D "user" -W -b "DC=evl,DC=example,DC=com" -b "" -s base "(objectclass=*)" -d 1 ldap_url_parse_ext(ldaps:///dc%3Devl%2Cdc%3Dexample%2Cdc%3Dcom) ldap_initialize( ldaps://EVLADC002vs.evl.example.com:389 ldaps://EVLADC001vs.evl.example.com:389 ldaps://EVLADC006vs.evl.example.com:389 ) ldap_create ldap_url_parse_ext(ldaps://EVLADC006vs.evl.example.com:389) ldap_url_parse_ext(ldaps://EVLADC001vs.evl.example.com:389) ldap_url_parse_ext(ldaps://EVLADC002vs.evl.example.com:389)
However, the client machine can resolve the two SRVs for _ldaps, with port 636
$ dig -t SRV _ldaps._tcp.evl.example.com +short 0 100 636 EVLADC002vs.evl.example.com. 0 100 636 EVLADC001vs.evl.example.com.
Here's the LDAP SRV for comparision
$ dig -t SRV _ldap._tcp.evl.example.com +short 0 100 389 EVLADC001vs.evl.example.com. 0 100 389 EVLADC006vs.evl.example.com. 0 100 389 EVLADC002vs.evl.example.com.
If I query a specific server on ldaps, everything is fine
$ ldapsearch -H ldaps://evladc001vs.evl.example.com -D "user" -W -b "" -s base "(objectclass=*)" # extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # dn: currentTime: 20200213045340.0Z subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=evl,DC=example,DC=com dsServiceName: CN=NTDS Settings,CN=EVLADC001VS,CN=Servers,CN=Server,CN=Sites,CN=Configuration,DC=evl,DC=example,DC=com ...
I'd appreciate any advice on whether I'm missing some option or something else obvious re this issue.
: Please don't start with lectures about using different products. Large enterprises have integration issues no matter what - try telling hospital systems to purchase different multimillion dollar software for their specific requirements