TLSv1.1 enforcement for Azure Domain Service LDAP

1
votes

I created a domain service and configured LDAP following this doc: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-configure-ldaps.

I created WebLogic AD provider to connect to AAD following this doc: https://docs.oracle.com/en/middleware/fusion-middleware/weblogic-server/12.2.1.4/secmg/ldap_atn.html#GUID-C1478BFB-A1FF-46F0-8931-627A00B7945A

Then I got a WebLogic Server 12 instance with Azure AD integration, WebLogic Server 12 successfully accesses Azure AD users.

Now, I am trying to create AD provider in WebLogic 14, and connect to the same AAD, with the same LDAP server. But I got this error:

Caused by: javax.net.ssl.SSLHandshakeException: Server chose TLSv1.1, but that protocol version is not enabled or not supported by the client

Root cause is that, WebLogic Server 14 accessed Azure DS LADP server with TLS 1.1, and the ssl version in Azure DS LADP server is unavailable.

I would like to enforce TLSv1.1 in Azure Domain Service LDAP server, I am not quite sure if it supports TLSv1.1 and how to set TLSversion.

1
azureazure-active-directory
I have workaround to set -Dweblogic.security.SSL.minimumProtocolVersion=TLSv0 in WebLogic Server 14, but it's not a secure way in production domain. I would like to set TLS 1.1 in Azure DS LDAP server. – Galia Cheng

1 Answers

0
votes

In azure ad ds, You can't directly set the tls version. However, you can disable weak TLSv1 by the following. https://docs.microsoft.com/en-us/azure/active-directory-domain-services/secure-your-domain if you do, minimum will be tls 1.1 or 1.2. the documentation doesn't explicitly say this for LDAP, but since LDAP is part of the AAD DS services, it should be affected as well.