LDAPS instead of LDAP

Question

Hello,

when running netstat on our addaxes server I can see several connections from the local server to our domain controllers using LDAP / port 389. Our company policy is to use LDAPS / port 636 when communicating with active directory.

How can I configure adaxes to only use LDAPS?

Thank you for your help!
HarryNew

Answer 1

Hello Harry,

There is no possibility to configure Adaxes to use only LDAPS. However, it is possible to enable Kerberos encryption between Adaxes and your domain controllers (DCs). To do so:

1. Navigate to the folder where Adaxes service is installed. By default, the folder is C:\Program Files\Softerra\Adaxes 3\Service\.

2. Open the Softerra.Adaxes.Service.exe.Config file with a text editor.

3. Locate the XML element configuration\softerra.adaxes\ldap\encryptTraffic.

4. Change the value in the element to true.

    <configuration>
        ...
        <softerra.adaxes>
            ...
            <!-- LDAP section -->
            <ldap …>
                <encryptTraffic>true</encryptTraffic>
                ...

5. Save the file.

6. Restart Softerra Adaxes Service.

Comments

Hello,

thank you very much for your answer!

Could you please give me some more information about how this encryption works? We have configured the encryption setting in our test system but I still only see ldap-connections in netstat (....remote address <DC-Name>:ldap). Is there a way (aside from wireshark) to prove that encryption is in place? What type of encryption is used and between which systems? And is ALL ldap-traffic encrypted, when this setting is in use? We will need to report the functionality to IT-security.

Thank you for your help!

HarryNew

---

Hello Harry,

We have configured the encryption setting in our test system but I still only see ldap-connections in netstat (....remote address <DC-Name>:ldap).

As it was mentioned in our previous post, the option does not enable using LDAPS (port 636), Adaxes will keep using LDAP (port 389), but the requests will be encrypted.

Is there a way (aside from wireshark) to prove that encryption is in place?

You can try using Windows Network Monitor. When the option is disabled, you will be able see and read the requests. When the option is enabled, you will see encrypted requests that are not human readable.

What type of encryption is used and between which systems?

The option enables Kerberos encryption between Adaxes and your domain controllers (DCs).

And is ALL ldap-traffic encrypted, when this setting is in use?

All requests made by users with the help of Adaxes client applications (Adaxes Administration Console and Web Interface) will be encrypted. However, some requests will not be encrypted (e.g. modifying service connection points).