LDAP Bind -  Major Security Issue?

Posted on 2011-03-18
Last Modified: 2012-05-11
We have a server that is hosted outside of our state university network.  Currently we use SQL authentication to validate our patron's user accounts (thousands of accounts).  To more easily manage accounts we would like to tie into the campus LDAP server.  This requires that an LDAP bind be allowed from the server hosted outside our network.

Our campus IT department says this is a security issue and it is not allowed.   The organization that hosts the server is OCLC, a worldwide library cooperative that works with thousands of libraries all over the globe.  They are world renown, reputable and respected.

I want to fight for this bind to be allowed.  So my question is....Is this a security concern if the connection is properly configured and managed?
Question by:ULadmin
  • 4
  • 2
LVL 75

Expert Comment

by:käµfm³d 👽
ID: 35169517
Not that I'm a security guru, but I was of the impression that "world renown, reputable and respected" is all the more reason for a company to be a target--general users would be more likely to trust information coming from that source. That said, if OCLC were to become compromised, how would you guarantee that your network wouldn't become compromised given your intended setup?
LVL 15

Expert Comment

ID: 35171321
Looks like you need my advice. If you like giving plain-text passwords to the public then use LDAP binding. Consequently this is exactly what you would be doing along with having to allowing directory listing to be enabled.

Considering that there is LDAP SALS(Simple Authentification & Security Layer) for hashing your credentials using Digest-MD5,GSS-SPNEGO, or any other digest hash algorythem. Attempts to secure your credentials in this fashion is by far not a secure method and if your attempting to use LDAP bind in a multi-millionaire arena, be prepared to lose millions if some lucky skiddy gets ahold of that hash and loads his botnet with a distributed 6gig rainbow library. He will have it in no time flat.

If you don't believe me you can ask any other qualified System Penetration specialist or IT Security specialist's for there opinion. Best suggestion is to avoid using any operation that exposes your credentials in a plain text/weak encryption. If you can't find a pluggin that encrypts/decrypts in a more secure state like rijndael 586 then I would just give up on this fight.

LVL 15

Expert Comment

ID: 35173145
Sometimes it takes a visual of this as well as a test application to demonstrate security. As stated above this would be a very bad idea to implement this in a business/confidential environment as I / Others could just sniff your traffic for User Credentials either on your network or remotely. If It was me It would be in a controlled environment showing you results of possible damage's resulting from such insecurity's in a report as compared to a real attacker who wouldn't be nearly as forgiving and understanding of your circumstances.

using System;
using System.Collections;
using System.Collections.Generic;
using System.DirectoryServices.Protocols;
using System.Diagnostics;
using System.Security.Cryptography.X509Certificates;
using System.Windows.Forms;
using System.Net;

namespace LDAPBind
    public partial class Form1 : Form
        public Form1()

        private string[] BindedConnect()

            int i = 0;
            int intSearchScope = 0;
            string[] vals = null;
            string key = null;
            string strToDisplay = null;
            string strSearchBase = null;
            string strFilter = null;
            string strmsg = null;

            LdapConnection con = new LdapConnection(new LdapDirectoryIdentifier("", true, false));
            con.SessionOptions.SecureSocketLayer = true;
            // Just for testing purposes
            //string CertificateAddress = "Certificate.cer";
            //X509Certificate cert = new X509Certificate(CertificateAddress);
            con.SessionOptions.VerifyServerCertificate = new VerifyServerCertificateCallback(ServerCallback); 
            con.SessionOptions.QueryClientCertificate = new QueryClientCertificateCallback(ClientCallback);
            con.Credential = new NetworkCredential("cn=User,ou=partoftree,o=RootOfTree", "userspassword");
            // Reference: LDAP Signing
            con.AuthType = AuthType.Negotiate; // <--- this is Not clear-text compared to "Basic", but is still suseptible to forged attacks and bruteforce hash attacks.
            con.SessionOptions.SecureSocketLayer = true; // We are using Secure connections though this example.
            con.AuthType = AuthType.Anonymous;

                SearchRequest sr = new SearchRequest();
                SearchResultAttributeCollection srattcol = null;
                DirectoryAttribute srattrib = null;

                strSearchBase = ("ou=partoftree,o=RootOfTree");
                strFilter = ("cn=someuser*");
                sr.DistinguishedName = strSearchBase;
                sr.Filter = strFilter;
                sr.Scope = SearchScope.Subtree;
                SearchResponse srp = (SearchResponse)con.SendRequest(sr);
                SearchResultEntryCollection srecol = srp.Entries;
                foreach (SearchResultEntry srpe in srecol)
                    srattcol = srpe.Attributes;
                    foreach (DictionaryEntry DE in srattcol)
                        key = DE.Key.ToString();
                        vals = (string[])(srpe.Attributes[key].GetValues(typeof(string)));
                        strToDisplay = strToDisplay + key + "," + vals[0] + "\r" + "\n";

                this.TextBox1.Text = strToDisplay;
            catch (Exception ex)
                this.TextBox1.Text = ex.Message;

        private static SortedDictionary<DateTime, string> CertServer = new SortedDictionary<DateTime, string>();
        public static bool ServerCallback(LdapConnection connection,  X509Certificate certificate)

            X509Certificate2 newCert = new X509Certificate2(certificate);
            LdapDirectoryIdentifier id = (LdapDirectoryIdentifier)connection.Directory;
            lock (CertServer)
                // Sorted as [Certicate DateTime, Server]  
                CertServer.Add(newCert.NotAfter, id.Servers[0]);
            Debug.WriteLine("Got server " + id.Servers[0]);
            return true;

        public static X509Certificate ClientCallback(LdapConnection connection, byte[][] trustedCAs)
            // Parse Client Certificate response
            LdapDirectoryIdentifier id = (LdapDirectoryIdentifier)connection.Directory;
            Debug.WriteLine("This Server CalledBack [{0}] with:", id.Servers[0]);
            return null;


Open in new window

Hopefully this will help change your opinion on LDAP Bind Security.
Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.


Author Comment

ID: 35182384
Yes, Russell, I do need advice.  THAT IS WHY PEOPLE USE THIS SERVICE, OBVIOUSLY.   If I knew all the ins and outs of this I wouldn't need to ask the question, would I?

Sorry, you're response comes off a bit condescending to me.  Not uncommon, though.
LVL 15

Accepted Solution

Russell_Venable earned 500 total points
ID: 35182987
No, not at all. What I am trying to explain is the security situation that you will be opening up for attackers using this method and that is why they are oppose this method. If it comes off as condescending to you I apologize as it was not intended in anyway to sound like that. I know you want this badly, but this will bring a gapping hole to the network and I know you don't want to be the cause of a incident.

Neither would I. It's really important not to use binding outside of your network without some kind of strong encryption layer. Best options are using a socks proxy that supports SSL and RSA encryption for its connection to and from that LDAP server using the bind method or make a custom transport layer using RSA X506 certificates for authentication using a certificate verify message where the client has the master secret key and sends that message back to the server to verify authenticity. All of these methods act a wrapper protecting the connection internally and externally. So if you can find a solution using either of those methods you can utilize the ldap bind.


Author Comment

ID: 35183416
Thank you Russell.  Maybe I am just having a bad day?  I will see if they can use the RSA X506 certs.  If not, I guess I'm out of luck....
LVL 15

Expert Comment

ID: 35183979
Make sure you emphasize on encryption over a remote tunnel. They should understand this without a problem. Good luck!

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Each year, investment in cloud platforms grows more than 20% ( as an increasing number of companies begin to…
February 24, 2017 — On February 23, Travis Ormandy, a vulnerability researcher at Google, reported on Twitter ( that massive stores of data have been leaked by CloudFlare, a company that provide…
Sending a Secure fax is easy with eFax Corporate ( First, just open a new email message. In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question