Add --start-tls and --no-tls-verify LDAP options#249
Open
bandrel wants to merge 1 commit into
Open
Conversation
Adds support for upgrading a plain LDAP connection to TLS via the StartTLS extended operation before binding, and a companion --no-tls-verify flag that disables certificate validation for both ldaps:// and StartTLS connections. Behavior: - --start-tls: opens the socket, performs StartTLS, then binds. Works for NTLM and Kerberos (SASL/GSSAPI) auth paths. - --no-tls-verify: attaches a Tls(validate=CERT_NONE) object to the Server so it applies to both ldaps and the StartTLS upgrade. - When the DC rejects an NTLM bind with SEC_E_BAD_BINDINGS (data 80090346), auto-retry with LDAP channel binding on the same protocol (so StartTLS+EPA works without manual flag combos). - --start-tls is rejected alongside --use-ldaps; combining with --ldap-channel-binding is supported. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Author
|
I ran into a weird use case where 636 was not open, but 389 required start-tls. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--start-tlsto upgrade a plain LDAP connection to TLS via the StartTLS extended operation (RFC 2830) before binding. Works for both NTLM and Kerberos (SASL/GSSAPI) auth paths.--no-tls-verifyto disable TLS certificate verification. Applies to both--use-ldapsand the StartTLS-upgraded connection via aTls(validate=CERT_NONE)object on theServer.SEC_E_BAD_BINDINGS(data 80090346), so StartTLS works against DCs that enforce EPA without the operator needing to manually combine flags. Mirrors the existingRESULT_STRONGER_AUTH_REQUIREDretry path.--start-tlsis rejected alongside--use-ldaps. Combining--start-tlswith--ldap-channel-bindingis supported.Closes #248.
Implementation notes
ADAuthentication._maybe_start_tls(conn)opens the socket (if not already open) and runsconn.start_tls()before bind.ldap_kerberos()now guards itsconnection.open()with aclosedcheck so it doesn't reopen a socket that StartTLS already opened._build_tls()returnsTls(validate=CERT_NONE)when--no-tls-verifyis set, attached to all non-channel-bindingServerconstructors (CB paths already setCERT_NONEexplicitly).Test plan
--start-tls; auto-retry with channel binding succeeds and collection runs through.--start-tls+--ldap-channel-bindingworks with the patchedldap3(ldap3-bleeding-edge/ly4k/ldap3).--start-tls+--use-ldapsis rejected at argparse-time.-k) auth over StartTLS — light-tested locally; reviewer with a Kerberos lab welcome to confirm.