page title decoration image

LDAPs as Default – Encrypted Authentication in Rillsoft Integration Server

LDAPs as default in Rillsoft Integration Server 9

LDAPs support in Rillsoft Integration Server 9

With Rillsoft Integration Server 9, LDAPs is active as the default setting. LDAP signature hardening and LDAP channel binding are enforced – authentication traffic to the Windows domain is encrypted by default via SSL/TLS.

The prerequisite is that every system using the LDAP protocol is prepared for LDAPs. If the certificates on domain controllers and clients are not properly rolled out, authentication against the Windows domain will fail.

LDAP vs. LDAPs – what is the difference?

PropertyLDAPLDAPs
Encryptionclear textSSL/TLS
Server authentication–certificate
Man-in-the-middlevulnerablehardened
Recommended for productionnoyes

Your benefits with LDAPs

Security – LDAPs encrypts traffic via SSL/TLS and protects bind operations, search queries and responses from being intercepted.

Data protection – Directory services hold sensitive identity data. LDAPs makes sure this information does not travel through the network in clear text.

Compliance – Requirements such as GDPR demand appropriate technical measures. LDAPs is an established protection layer for identity-related data and supports compliance goals.

Network security – Authentication and authorization run via digital certificates. The risk of man-in-the-middle attacks and replay attacks is significantly reduced.

Future orientation – Unencrypted LDAP is being phased out in Microsoft recommendations as well. Anyone running LDAPs is ready for current and upcoming security requirements.

Check before switching

  • Certificate chain valid and trusted on the domain controllers
  • Clients and applications accept LDAPs connections
  • Firewall rules open for port 636 (LDAPs) and 3269 (Global Catalog LDAPs)
  • Directory-integrated third-party systems tested before LDAPs becomes mandatory

Frequently asked questions(FAQ)

Rillsoft Integration Server 9 sets LDAPs (LDAP over SSL/TLS) as the default. LDAP signature hardening and LDAP channel binding are enabled, traffic to the Windows domain is encrypted – unencrypted LDAP is no longer the default.

LDAP transmits bind data and directory queries in clear text and is vulnerable to interception and man-in-the-middle attacks. LDAPs uses SSL/TLS, encrypts the entire traffic and enables server authentication via certificates.

All systems that authenticate against the Windows domain must be prepared for LDAPs – valid SSL/TLS certificates on the domain controllers and clients that accept the certificate chain. Otherwise authentication will fail.

LDAPs protects sensitive identity and directory data from unauthorized access, reduces the risk of man-in-the-middle attacks and supports compliance requirements such as GDPR. Authentication and authorization run via digital certificates.

Such clients can no longer authenticate against the domain. Before LDAPs is enforced as the default, every connected system – directory services and applications – should be tested for LDAPs readiness and certificates should be rolled out.