You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When a DC has LdapServerIntegrity=2 but no TLS certificate, LDAPS is unavailable and all auth fails. This fixes Kerberos auth over plain LDAP in that scenario.
Two changes:
Set GSS_C_CONF_FLAG | GSS_C_INTEG_FLAG in the AP_REQ authenticator checksum. The DC rejects binds that don't advertise integrity support (same flags impacket's own LDAP client uses).
After a successful bind, wrap the ldap3 socket with GSSAPISocketWrapper, which applies GSS_Wrap_LDAP/GSS_Unwrap_LDAP to every PDU. Required because the DC sends GSSAPI-framed responses once a signing-capable session is established.
Hi @Pebl3, I've built a follow-up that adds NTLM session signing for the same LDAP-signing-enforced-without-LDAPS scenario your PR #250 fixes for Kerberos. The approach mirrors your GSSAPISocketWrapper pattern. Rather than open a second PR that depends on yours, would you be OK with me opening a combined PR that supersedes #250? Your Kerberos commit would be cherry-picked unchanged with you as author, and my NTLM commit would land on top. Goal is to make it easier for @dirkjanm to review and ship both fixes together. Happy to do it either way, just want your call before I move.
Hi @Pebl3, I've built a follow-up that adds NTLM session signing for the same LDAP-signing-enforced-without-LDAPS scenario your PR #250 fixes for Kerberos. The approach mirrors your GSSAPISocketWrapper pattern. Rather than open a second PR that depends on yours, would you be OK with me opening a combined PR that supersedes #250? Your Kerberos commit would be cherry-picked unchanged with you as author, and my NTLM commit would land on top. Goal is to make it easier for @dirkjanm to review and ship both fixes together. Happy to do it either way, just want your call before I move.
Opened #254 which supersedes this PR — your commit is included unchanged as the first commit, with NTLM signing/sealing added on top.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a DC has LdapServerIntegrity=2 but no TLS certificate, LDAPS is unavailable and all auth fails. This fixes Kerberos auth over plain LDAP in that scenario.
Two changes: