Is there a way to redirect a ldap client to an LDAPS service? Like with http where you can inform a client that requests http:\\something to request https:\\something by sending a 301/302 response.

I've already found ldap referrals but I'm not sure if they are what we're looking for. We want to redirect the client to the LDAPS service before the client tries to authenticate. We could shutdown the LDAP service and wait for users complaining but rather like to log the requests, redirect them and then fix\reconfigure clients as needed some time in the future.

Btw: This is not for LDAPv3 and starttls but for LDAPv2.


In theory an LDAP referral can do what you want, however a number of LDAP client implementations can't / won't "chase" referrals and you'll end up causing outages. You're going to have the best luck by logging the clients using the non-secure LDAP and asking them to stop (and, eventually, just turning off the non-secure LDAP). It's not pretty, but it's your best bet to keep things working w/o causing service outages.

| improve this answer | |
  • 1
    I second this method. We had to use it when we moved off of insecure LDAP at my old job. The last users were some weeny web-apps in distant departments no one remembered. – sysadmin1138 Nov 22 '11 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.