python: binding via kerberos to the ldaps port

Question

I can connect to an Active Directory server using the ldap port and SASL (using gssapi to do kerberos) as follows:

import ldap, ldap.sasl, sys

server    = 'ldap://server.domain.tld'
sasl_auth = ldap.sasl.sasl({} ,'GSSAPI')
conn      = ldap.initialize(server, trace_level=0)

conn.set_option(ldap.OPT_REFERRALS,0)  # for AD servers, don't chase referrals via anonymous bind
conn.protocol_version = ldap.VERSION3  # Set protocol version to LDAPv3 to enable SASL bind!

conn.sasl_interactive_bind_s("", sasl_auth)

All of that works as desired. (Error checking left out for brevity.) But if I want to instead connect to the SSL port by changing the server string to:

server    = 'ldaps://server.domain.tld'

the bind succeeds but my connection is reported as closed when I tried to do the next thing such as:

print('Result of Who Am I? ext. op:',repr(conn.whoami_s()))

I get:

ldap.SERVER_DOWN: {'desc': "Can't contact LDAP server", 'errno': 5, 'info': 'Input/output error'}

even though the bind didn't raise any exceptions. "ldap://" works. "ldaps://" doesn't.

Does this only work via regular port + TLS, or am I missing some part of the incantation that is necessary for the ldaps port when doing kerberos?

Thanks.

Adam Benjamin Adam Benjamin · Accepted Answer · 2020-05-02T13:14:36

I think I found the answer to my own question.

If you check out this link: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/989e0748-0953-455d-9d37-d08dfbf3998b

You find the following text:

While Active Directory permits SASL binds to be performed on an SSL/TLS-protected connection, it does not permit the use of SASL-layer encryption/integrity verification mechanisms on such a connection.

So I think the answer to my question is that because the python-ldap module does encryption/integrity verification, and not JUST authentication, you can't do SASL and SSL/TLS at the same time. So you can't also do a start-tls on the "ldap" port, and you can't connect to the "ldaps" (SSL) port and use SASL at all.

python: binding via kerberos to the ldaps port

1 Answers