Grails 3 and Spring Security LDAP Unencrypted Traffic

Question

I am running a Grails 3 application on Tomcat 8. The application I have developed is going through HTTPS, and uses the grails spring security LDAP plugin for authentication. (Default login page provided by the plugin, and nothing custom) Tomcat is enabled to use only HTTPS and HTTP is disabled.

My application.groovy file also contains the following code for spring security:

grails.plugin.springsecurity.ldap.context.server = 'ldap://192.168.3.4:389/DC=MY_DOMAIN,DC=Net'
grails.plugin.springsecurity.password.algorithm = 'SHA-256'

(The other details are just configuration parameters for what to query, etc)

Here is my test scenario:

I have a Windows machine hitting the application, hosted on an Ubuntu machine. The ubuntu machine makes an LDAP request to the AD (Active Directory) machine. For reference, here are the IP's:

Windows Machine: 192.168.1.1
Tomcat Ubuntu Machine: 192.168.1.10
AD Machine: 192.168.3.4

After monitoring the TCP traffic coming from the .1 (windows machine) everything is garbled, and it cannot be read. When sniffing the packets from .10 to .4 (Tomcat to AD), the LDAP packets are in clear text. Surely, I do not think that this is supposed to be like this. Is there some additional step I need to do in tomcat to ensure ldap traffic is being encrypted?

angryip angryip · Accepted Answer · 2016-04-05T18:58:12

I have been reading this post, and it turns our that we can run LDAP itself over ssl. So our connection string would go from:

'ldap://192.168.3.4:389/DC=MY_DOMAIN,DC=Net'

to

'ldaps://192.168.3.4:636/DC=MY_DOMAIN,DC=Net'

Note, in addition to this, you also need to ensure that the root certificates are added to the trust list in Java. For me, the following command seemed to do the trick:

keytool -import -noprompt -trustcacerts -alias myAdCert -file /location_of_cert/adcert.cer -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit

Grails 3 and Spring Security LDAP Unencrypted Traffic

2 Answers