0 Replies Latest reply on Sep 12, 2019 8:23 AM by Philippe Marschall

    Active Directory site aware LDAPS

    Philippe Marschall Master

      We are currently using Elytron LDAPS support to authenticate against Active Directory.

      Unfortunately there currently seems to be no way to do site aware LDAPS because of two reasons

      • Active Directory only adds SRV records for LDAP, but not for LDAPS
      • the Java LDAP support includes support for SRV records but not for site awareness

      For Java 12+ we have a custom LdapDnsProvider that looks up the servers of an Active Directory site and maps LDAP ports to LDAPS ports. As Elytron currently doesn't support StartTLS and we're not sure the Java StartTLS support works in the presence of LDAP referrals we went for mapping the ports rather than using StartTLS. see GitHub - marschall/site-aware-ldaps-provider

      We are wondering whether this would be of general interest and if so how it could be contributed. As this is an extension for JDK classes the JAR would have to be on the module path.