Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


LDAP Bind -  Major Security Issue?

Posted on 2011-03-18
Medium Priority
Last Modified: 2012-05-11
We have a server that is hosted outside of our state university network.  Currently we use SQL authentication to validate our patron's user accounts (thousands of accounts).  To more easily manage accounts we would like to tie into the campus LDAP server.  This requires that an LDAP bind be allowed from the server hosted outside our network.

Our campus IT department says this is a security issue and it is not allowed.   The organization that hosts the server is OCLC, a worldwide library cooperative that works with thousands of libraries all over the globe.  They are world renown, reputable and respected.

I want to fight for this bind to be allowed.  So my question is....Is this a security concern if the connection is properly configured and managed?
Question by:ULadmin
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
LVL 75

Expert Comment

by:käµfm³d 👽
ID: 35169517
Not that I'm a security guru, but I was of the impression that "world renown, reputable and respected" is all the more reason for a company to be a target--general users would be more likely to trust information coming from that source. That said, if OCLC were to become compromised, how would you guarantee that your network wouldn't become compromised given your intended setup?
LVL 15

Expert Comment

ID: 35171321
Looks like you need my advice. If you like giving plain-text passwords to the public then use LDAP binding. Consequently this is exactly what you would be doing along with having to allowing directory listing to be enabled.

Considering that there is LDAP SALS(Simple Authentification & Security Layer) for hashing your credentials using Digest-MD5,GSS-SPNEGO, or any other digest hash algorythem. Attempts to secure your credentials in this fashion is by far not a secure method and if your attempting to use LDAP bind in a multi-millionaire arena, be prepared to lose millions if some lucky skiddy gets ahold of that hash and loads his botnet with a distributed 6gig rainbow library. He will have it in no time flat.

If you don't believe me you can ask any other qualified System Penetration specialist or IT Security specialist's for there opinion. Best suggestion is to avoid using any operation that exposes your credentials in a plain text/weak encryption. If you can't find a pluggin that encrypts/decrypts in a more secure state like rijndael 586 then I would just give up on this fight.

LVL 15

Expert Comment

ID: 35173145
Sometimes it takes a visual of this as well as a test application to demonstrate security. As stated above this would be a very bad idea to implement this in a business/confidential environment as I / Others could just sniff your traffic for User Credentials either on your network or remotely. If It was me It would be in a controlled environment showing you results of possible damage's resulting from such insecurity's in a report as compared to a real attacker who wouldn't be nearly as forgiving and understanding of your circumstances.

using System;
using System.Collections;
using System.Collections.Generic;
using System.DirectoryServices.Protocols;
using System.Diagnostics;
using System.Security.Cryptography.X509Certificates;
using System.Windows.Forms;
using System.Net;

namespace LDAPBind
    public partial class Form1 : Form
        public Form1()

        private string[] BindedConnect()

            int i = 0;
            int intSearchScope = 0;
            string[] vals = null;
            string key = null;
            string strToDisplay = null;
            string strSearchBase = null;
            string strFilter = null;
            string strmsg = null;

            LdapConnection con = new LdapConnection(new LdapDirectoryIdentifier("", true, false));
            con.SessionOptions.SecureSocketLayer = true;
            // Just for testing purposes
            //string CertificateAddress = "Certificate.cer";
            //X509Certificate cert = new X509Certificate(CertificateAddress);
            con.SessionOptions.VerifyServerCertificate = new VerifyServerCertificateCallback(ServerCallback); 
            con.SessionOptions.QueryClientCertificate = new QueryClientCertificateCallback(ClientCallback);
            con.Credential = new NetworkCredential("cn=User,ou=partoftree,o=RootOfTree", "userspassword");
            // Reference: LDAP Signing
            con.AuthType = AuthType.Negotiate; // <--- this is Not clear-text compared to "Basic", but is still suseptible to forged attacks and bruteforce hash attacks.
            con.SessionOptions.SecureSocketLayer = true; // We are using Secure connections though this example.
            con.AuthType = AuthType.Anonymous;

                SearchRequest sr = new SearchRequest();
                SearchResultAttributeCollection srattcol = null;
                DirectoryAttribute srattrib = null;

                strSearchBase = ("ou=partoftree,o=RootOfTree");
                strFilter = ("cn=someuser*");
                sr.DistinguishedName = strSearchBase;
                sr.Filter = strFilter;
                sr.Scope = SearchScope.Subtree;
                SearchResponse srp = (SearchResponse)con.SendRequest(sr);
                SearchResultEntryCollection srecol = srp.Entries;
                foreach (SearchResultEntry srpe in srecol)
                    srattcol = srpe.Attributes;
                    foreach (DictionaryEntry DE in srattcol)
                        key = DE.Key.ToString();
                        vals = (string[])(srpe.Attributes[key].GetValues(typeof(string)));
                        strToDisplay = strToDisplay + key + "," + vals[0] + "\r" + "\n";

                this.TextBox1.Text = strToDisplay;
            catch (Exception ex)
                this.TextBox1.Text = ex.Message;

        private static SortedDictionary<DateTime, string> CertServer = new SortedDictionary<DateTime, string>();
        public static bool ServerCallback(LdapConnection connection,  X509Certificate certificate)

            X509Certificate2 newCert = new X509Certificate2(certificate);
            LdapDirectoryIdentifier id = (LdapDirectoryIdentifier)connection.Directory;
            lock (CertServer)
                // Sorted as [Certicate DateTime, Server]  
                CertServer.Add(newCert.NotAfter, id.Servers[0]);
            Debug.WriteLine("Got server " + id.Servers[0]);
            return true;

        public static X509Certificate ClientCallback(LdapConnection connection, byte[][] trustedCAs)
            // Parse Client Certificate response
            LdapDirectoryIdentifier id = (LdapDirectoryIdentifier)connection.Directory;
            Debug.WriteLine("This Server CalledBack [{0}] with:", id.Servers[0]);
            return null;


Open in new window

Hopefully this will help change your opinion on LDAP Bind Security.
Introducing the WatchGuard 420 Access Point

WatchGuard's newest access point includes an 802.11ac Wave 2 chipset, providing the fastest speeds for VoIP, video and music streaming, and large data file transfers. Additionally, enjoy the benefits of strong security as the 3rd radio delivers dedicated WIPS protection!


Author Comment

ID: 35182384
Yes, Russell, I do need advice.  THAT IS WHY PEOPLE USE THIS SERVICE, OBVIOUSLY.   If I knew all the ins and outs of this I wouldn't need to ask the question, would I?

Sorry, you're response comes off a bit condescending to me.  Not uncommon, though.
LVL 15

Accepted Solution

Russell_Venable earned 2000 total points
ID: 35182987
No, not at all. What I am trying to explain is the security situation that you will be opening up for attackers using this method and that is why they are oppose this method. If it comes off as condescending to you I apologize as it was not intended in anyway to sound like that. I know you want this badly, but this will bring a gapping hole to the network and I know you don't want to be the cause of a incident.

Neither would I. It's really important not to use binding outside of your network without some kind of strong encryption layer. Best options are using a socks proxy that supports SSL and RSA encryption for its connection to and from that LDAP server using the bind method or make a custom transport layer using RSA X506 certificates for authentication using a certificate verify message where the client has the master secret key and sends that message back to the server to verify authenticity. All of these methods act a wrapper protecting the connection internally and externally. So if you can find a solution using either of those methods you can utilize the ldap bind.


Author Comment

ID: 35183416
Thank you Russell.  Maybe I am just having a bad day?  I will see if they can use the RSA X506 certs.  If not, I guess I'm out of luck....
LVL 15

Expert Comment

ID: 35183979
Make sure you emphasize on encryption over a remote tunnel. They should understand this without a problem. Good luck!

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
In this article, WatchGuard's Director of Security Strategy and Research Teri Radichel, takes a look at insider threats, the risk they can pose to your organization, and the best ways to defend against them.
Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question