topic Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server in ONTAP Discussions

LDAP connection failures when channel binding is enforced by the Windows LDAP server

pal — Wed, 04 Jun 2025 10:45:30 GMT

Change 1:Use the LdapEnforceChannelBinding registry entry to make LDAP authentication over SSL/TLS more secure 

This option affects LDAP over TLS or LDAPS connections. The proposed Windows update for this setting should have no impact on ONTAP authentication. 
- More information on LDAP over TLS concepts and Does ONTAP support port 636 for LDAPS (LDAP over SSL)
Currently ONTAP does not support LDAP Channel Binding, this feature is being tracked here: 
- 1136213 Implement channel binding tokens for LDAP with StartTLS

Are there any progress on BUG 1136213 ?

Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server

TMACMD — Mon, 16 Nov 2020 12:26:19 GMT

Well, per the bug if you really want to turn that feature on instead of setting to 2:

Set "LdapEnforceChannelBinding" on the LDAP server to "1" which indicates "Enabled,
 when supported".

Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server

paul_stejskal — Mon, 16 Nov 2020 22:03:17 GMT

If you need this fixed, I would recommending talking to your account team. They can help prioritize this if needed if this is going to break things for you.

Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server

ttran — Tue, 24 Nov 2020 05:50:54 GMT

Hi Pal,

Our Engineering Team is working closely with Microsoft and has provided an update last week that the fix for RFE 1136213: Implement channel binding tokens for LDAP with StartTLS is tentatively scheduled for ONTAP 9.10. As paul_stejskal mentioned, please work with your Account Team if you need this fixed earlier.

Regards,

Team NetApp

topic Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server in ONTAP Discussions

LDAP connection failures when channel binding is enforced by the Windows LDAP server

Change 1:Use the LdapEnforceChannelBinding registry entry to make LDAP authentication over SSL/TLS more secure

Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server

Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server

Re: LDAP connection failures when channel binding is enforced by the Windows LDAP server

Change 1:Use the LdapEnforceChannelBinding registry entry to make LDAP authentication over SSL/TLS more secure 