LDAP Access of AD DS to Applications

hello all.........several applications use ad ds ldap provider, have following questions regarding them:

1.  need special configuration/account connect application adds using ldap?

2.  can applications make both ldap , secure ldap connection default or account, configuration or certificate required?

3.  secure ldap (ssl), need special configuration respect certificates? certificate trusted both ad ds , application involving ca?

4.  when making secure ldap connection, several applications show certificate expiry date well.  certificate that?  self-signed certificate?  how renewed?  itself?  if not, how 1 renews it, default cert 1 year long?

5.  type of ssl , tls connections supported secure ldap? ssl 1, 2 or 3/tsl 1.0, 1.1 or 1.3?  or supported?  recommended connection method use apps?  if all are supported, does not make system vulnerable?  possible turn off of them specific method supported?

thanks in advance. 

hi technet junkie,

1. if application requires dedicated account , assuming leave default "domain users" membership, default can read meaningful in domain.
   
2. any "mode" work: enterprise, standard, publicly issued. if you're looking use certificates across few different areas internally might want invest in effort of setting active directory certificate services save both money , ongoing administrative effort (via autoenrollment).
   
   providing valid certificate domain controller enables service ldaps requests, however, doesn't not mean applications automatically switch using ldaps. need assess , potentially configure each application this.
   
   again, whether application trusts certificate issue application, not active directory. example, web browsers maintain own certificate stores , not use windows crypto suite, meaning won't matter whether set internal pki infrastructure or obtain certificate public authority not found in application's store: end result same doesn't trust it.
   
   perhaps generalise (now i've got caveat out of way , pointed out it's not server-side issue), many applications use windows crypto functions meaning typically trust domain controller certificate long supporting root , intermediate authority certificates have been obtained. happens automatically enterprise mode ca's while standalone ca's, you'll have push root , intermediate certificates out there - ideally using group policy settings designed this.
   
   
3. i wouldn't phrase way, think know you're trying say, in case simple answer's more or less, "yes".
   
   
4. yes, understanding correct. respect notification, warning events logged in application event log indicating when certificate's or has expired. avoid having check every server individually, you'd either need @ making use of monitoring solution such system center operations manager or event subscriptions (a poor man's solution, it's functional).
   
   
5. not available default. discussed, ssl 2 disabled default. , don't need available governed applications there's not can offer here except generic advice determine applications require , disable vulnerable suites not used.
   
6. an enterprise pki automate ongoing administration, still need invest time setting initial configuration. still need manage templates , configure relevant group policies related autoenrollment, more or less save time on once you've done both of these things, don't have visit every host , manually enrol certificate. , yes, it's quite how domain controllers have obtained certificate. can check inspecting certificate, shows authority issued it.

cheers,
lain

Windows Server  >  Directory Services