LDAP connection failures when channel binding is enforced by the Windows LDAP server

[pal]

Change 1:Use the LdapEnforceChannelBinding registry entry to make LDAP authentication over SSL/TLS more secure  

• This option affects LDAP over TLS or LDAPS connections. The proposed Windows update for this setting should have no impact on ONTAP authentication.  
  • More information on LDAP over TLS concepts and Does ONTAP support port 636 for LDAPS (LDAP over SSL)
• Currently ONTAP does not support LDAP Channel Binding, this feature is being tracked here:  
  • 1136213 Implement channel binding tokens for LDAP with StartTLS  

Are there any progress on BUG 1136213 ?

[TMACMD]

Well, per the bug if you really want to turn that feature on instead of setting to 2:

Set "LdapEnforceChannelBinding" on the LDAP server to "1" which indicates "Enabled,
 when supported". 

[paul_stejskal]

If you need this fixed, I would recommending talking to your account team. They can help prioritize this if needed if this is going to break things for you.

[ttran · Accepted solution]

Hi Pal,

Our Engineering Team is working closely with Microsoft and has provided an update last week that the fix for RFE 1136213: Implement channel binding tokens for LDAP with StartTLS is tentatively scheduled for ONTAP 9.10. As paul_stejskal mentioned, please work with your Account Team if you need this fixed earlier.

Regards,

Team NetApp