How common is it to enable LDAPS in Active Directory?

Question

We have an application that uses unencrypted LDAP to read user and group information from Active Directory. As Microsoft is going to require LDAP Channel Binding and LDAP Signing (according to ADV190023 Security Advisory), we intent to adapt the application to support LDAPS.

In order that our customers can continue to use the application, they obviously have to activate LDAPS in their Active Directory. I'm concerned that this could prove to be an obstacle, because clients might not want the additional overhead with AD Certification Services and SSL certificate handling.

How common is it to enable LDAPS in Active Directory?

Answer 1

For Windows clients, you don't need LDAPS to solve the problem of channel binding, but for literally any other non-Windows LDAP client - including LDAP clients that are embedded in Windows applications and not using the OS stack - you will need LDAPS to get around it.

Also, any environment that has the slightest concern about security has been trying to get it enforced or has actually mandated it for years.

So, it's not as common as it should be, but it is common, and certainly I've been implementing it for the last decade or more. In a modern AD, certificate services is just part and parcel.

By the way, you don't actually need AD certificate services, it just makes life easier. You can do LDAPS with any certificate provider that issues certs with the proper features. In fact, you can do LDAPS without any CA at all - you just need to trust every DC's (that you'll connect to) self-signed cert on the calling LDAP client (rather than simply the issuing CA's root cert).

For vendors, I actually think it's fair enough with Microsoft making their direction very clear to make LDAPS a prerequisite for their product support. Although I personally think vendors that integrate with AD these days should get to grips with Kerberos and SSO auth providers like SAML/OAuth as well.