Citrix ADC/Gateway LDAP Authentication Change After Microsoft ADV190023 Security Update

Citrix ADC/Gateway LDAP Authentication Change After Microsoft ADV190023 Security Update

book

Article ID: CTX269461

calendar_today

Updated On:

Description

Microsoft is releasing a security update (ADV190023) with below changes to Active Directory Domain Controllers.
Important! The March 10, 2020 and Microsoft updates in the foreseeable future will not make changes to LDAP signing or LDAP channel binding policies or their registry equivalent on new or existing domain controllers.

  1. Enable LDAP channel binding
  2. Enable LDAP signing 

For more details on the Microsoft update please refer to below link:

The following are the results after validating the changes manually on the Active Directory for LDAP authentication behavior with Citrix ADC/Gateway:
  • LDAP Channel Binding: There is no behaviour difference in ADC/Gateway due to this change.
  • LDAP Server Signing: ADC works fine over SSL/636 and TLS/389. However, ADC/Gateway authentication is getting rejected over plaintext/389
Below is the snapshot of ADC log when on plaintext/389: 
 “Dec 16 10:00:54 <local1.info> ns [1277]: (1-414) ns_show_ldap_err_string: LDAP error string: <<00002028: LdapErr: DSID-0C090257, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v2580>>                                                      Dec 16 10:00:54 <local1.info> ns [1277]: (1-414) ns_ldap_check_result: LDAP action failed (error 8): Strong(er) authentication required”

 

    Resolution

    On ADC, change the LDAP Server “Security Type” to SSL or TLS from plaintext/389.

    If Plaintext/389 is being used in ldapaction or ldapprofile on Citrix ADC/Gatewayit needs to be changed to SSL/636 or TLS/389 as follows:-
    • CLI Command O/P for LdapProfile on Citrix ADC/Gateway:
      • set  authentication ldapAction ldapssl -serverIP 10.102.229.87 -serverPort 636 -secType SSL 
        • Or
      • set authentication ldapAction ldapssl -serverIP 10.102.229.87 -serverPort 389 -secType TLS 
    • GUI Command O/P for LdapProfile on Citrix ADC/Gateway
    For LDAP service configured as TCP/389 on ADC, we need to make these changes:
    1. Create a new LDAP service with SSL_TCP/636 and bind it the LB Vserver and remove the old service.
      • add service ldapssl 10.106.168.252 SSL_TCP 636 
      • (LDAPs should be enabled on AD and port 636 should be allowed)
    2. No changes required on the LB vserver
      • add lb vserver lbldap SSL_TCP 10.102.229.85 636 -persistenceType NONE -cltTimeout 9000
    3. Bind the newly created service to the LB Vserver
      • bind lb vserver lbldap ldapssl
        Powered by Wolken Software