Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8259707

LDAP channel binding does not work with StartTLS extension

    XMLWordPrintable

Details

    Backports

      Description

        The fix for https://bugs.openjdk.java.net/browse/JDK-8245527 enables LDAP channel binding support for GSS/Kerberos authentication over LDAPS.

        However this does not work if the LDAP StartTLS extension is used. Code may connect to Active Directory anonymously to read the rootDSE and then switch to TLS before authenticating.

        The server certificate used available in the SSLSession returned from StartTlsResponse.negotiate() can be used to determine the channel binding data.

        Attachments

          Issue Links

            backported by

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8262302 LDAP channel binding does not work with StartTLS extension

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8262736 LDAP channel binding does not work with StartTLS extension

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8268754 LDAP channel binding does not work with StartTLS extension

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-8290168 LDAP channel binding does not work with StartTLS extension

            • P4 - Minor loss of function, or other problem where easy workaround is present.
            • Resolved
            relates to

            Bug - A problem which impairs or prevents the functions of the product. JDK-8245527 LDAP Channel Binding support for Java GSS/Kerberos

            • P3 - Major loss of function.
            • Resolved
            links to

            Commit Commit openjdk/jdk13u-dev/a71cc1db

            Commit Commit openjdk/jdk15u-dev/3d8ec309

            Commit Commit openjdk/jdk/874aef4a

            Review Review openjdk/jdk13u-dev/131

            Review Review openjdk/jdk15u-dev/229

            Review Review openjdk/jdk/2085

            Activity

              People

                abakhtin Alexey Bakhtin
                revans Richard Evans
                Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: