Microsoft has made an announcement related to a March patch that will change the default settings for LDAP configurations on all Windows versions. This link contains more details related to the change: Link
Impact to OnBase (All Releases)
OnBase has support for LDAP communication to a LDAP directory service using native Windows LDAP services. OnBase utilizes these methods when Directory Service Authentication is configured for the LDAP directory service authentication method. The changes addressed in the above link do not affect systems configured with the Active Directory - Basic or Active Directory - Enhanced authentication methods.
We have proactively tested these components and validated compatibility with the changes that Microsoft is making. All scenarios tested support LDAP simple bind, with the option to enable SSL/TLS.
Testing confirmed that when the LDAP Signing Requirement settings are implemented as addressed in the above link, SSL/TLS must be configured on port 636 and the Use SSL setting must be enabled/checked in order to satisfy the new LDAP Client/Server Signing Requirements.
Policies can be changed to relax the LDAP Signing Requirements and not require signing which will allow unencrypted LDAP connections on port 389 (with the Use SSL setting disabled/unchecked). However, doing so is not recommended and is deemed insecure as passwords are transmitted in plain text over the wire. Therefore, we strongly recommend that all LDAP configurations utilize SSL/TLS on port 636 prior to March 2020. This will ensure that applications will continue to function when the security updates are applied. Test outcomes were based solely on LDAP Signing Requirements.
Additionally, we recommend that System Administrators test their OnBase solutions by applying the new LDAP Signing Requirements in a test environment prior to March 2020. This will help ensure that all LDAP configurations have been identified and are updated accordingly.
Instructions related to configuring LDAP with SSL/TLS are located in the Legacy Authentication Module Reference Guide.
For any assistance needed related to configuration please contact your first line of support.
4 Comments
