Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security
obsoleted by
- rfc-4510 — Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map
- rfc-4511 — Lightweight Directory Access Protocol (LDAP): The Protocol
- rfc-4513 — Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms
updated by
- rfc-3377 — Lightweight Directory Access Protocol (v3): Technical Specification
Extracted elements (29)
The client must use the original connection hostname (not canonical DNS) for server identity verification to prevent a class of MITM attack where DNS canonicalization could redirect to a different server with a legitimately matching certificate.
The Start TLS operation itself provides no additional security on its own; all security is derived from TLS. This is why implementors must not conflate the success of the Start TLS exchange with the security level of the resulting TLS connection.
TLS version negotiation (TLS vs. SSL version selection) is handled entirely by the TLS Handshake Protocol as documented in RFC 2246 and is not addressed by the Start TLS LDAP operation.
A SASL EXTERNAL Bind MUST fail with inappropriateAuthentication if no TLS session has been established and there is no other external authentication source, or if the server did not request client credentials during TLS.
After receiving a success response to Start TLS, the client MUST either begin a TLS negotiation or close the connection; it will send TLS Record Protocol PDUs directly over the underlying TCP connection.
After TLS is established, both parties MUST individually decide whether to continue based on the privacy level achieved; if insufficient, they SHOULD gracefully close the TLS connection immediately.
Before closing a TLS connection, the client MUST either wait for any outstanding LDAP operations to complete or explicitly abandon them.
Closure of the TLS connection MUST cause the LDAP association to move to an anonymous authentication and authorization state, regardless of prior TLS or pre-TLS state.
For either form of SASL EXTERNAL assertion, the server MUST verify that the client's TLS authentication identity is permitted to map to the asserted authorization identity, and MUST reject the Bind with invalidCredentials if not.
If the server does not support TLS, it MUST set resultCode to protocolError or referral; if it returns referral, it MUST include an actual referral value in the result.
If the server requires TLS before a particular operation and the client has not established TLS, the server MUST reject that operation with confidentialityRequired or strongAuthRequired.
The client MUST check its understanding of the server's hostname against the server's identity as presented in the server's Certificate message to prevent man-in-the-middle attacks.
The client MUST NOT send a Start TLS request if TLS is currently established on the connection, during a multi-stage SASL negotiation, or if there are any outstanding LDAP operations.
The client MUST NOT send any PDUs on the connection after transmitting a Start TLS extended request until it receives the Start TLS extended response.
The client MUST refresh any cached server capabilities information (e.g. root DSE) upon TLS session establishment to protect against active-intermediary attacks that may have altered pre-TLS capability data.
The client MUST use the server hostname it used to open the LDAP connection for certificate identity comparison and MUST NOT use the server's canonical DNS name or any other derived form of name.
The server MUST return operationsError if the client violates any of the Start TLS sequencing requirements (TLS already active, during SASL negotiation, or outstanding operations exist).
Upon TLS connection establishment, any previously established authentication and authorization identities MUST remain in force, including anonymous state, even if the server requests client authentication via TLS.
When a Start TLS extended request is made, the server MUST return an LDAP PDU containing a Start TLS extended response, and that response MUST contain a responseName set to the same OID as in the request.
A Start TLS failure resultCode is one of: operationsError (sequencing violation, e.g. TLS already established), protocolError (TLS not supported or bad PDU), referral (try another server), or unavailable (TLS error or server shutting down).
Certificate identity matching rules: if a subjectAltName dNSName extension is present it SHOULD be used; matching is case-insensitive; the '*' wildcard applies only to the left-most name component (e.g. *.bar.com matches a.bar.com but not bar.com).
Explicit authorization identity assertion: after TLS establishment, a client invokes SASL EXTERNAL Bind WITH the credentials octet string constructed as documented in RFC 2829 section 9.
Implicit authorization identity assertion: after TLS establishment, a client invokes SASL EXTERNAL Bind WITHOUT the optional credentials octet string; the server derives authorization identity from TLS credentials per local policy.
The Start TLS operation is identified by OID 1.3.6.1.4.1.1466.20037, transmitted as an LDAP ExtendedRequest with requestName set to that OID and no requestValue.
An active-intermediary attacker can remove the Start TLS extended operation from the supportedExtension attribute of the root DSE, so both parties SHOULD independently ascertain the security level achieved after TLS establishment and before use, since negotiation may have been downgraded to plaintext.
TLS does not provide confidentiality of data stored on the directory server, nor does it protect data from server administrators; it only protects operations and data in transit over the LDAP association.
Graceful TLS closure: initiator sends closure alert and MUST discard incoming TLS messages until it receives a closure alert, then ceases TLS PDUs and MAY resume LDAP. The other party MUST immediately transmit a closure alert upon receipt and then ceases TLS PDUs.
ExtendedRequest is APPLICATION 23, a SEQUENCE containing requestName [0] LDAPOID and optional requestValue [1] OCTET STRING. For Start TLS, requestValue is absent.
ExtendedResponse is APPLICATION 24, a SEQUENCE containing COMPONENTS OF LDAPResult, optional responseName [10] LDAPOID, and optional response [11] OCTET STRING. For Start TLS, response is absent and responseName MUST echo the request OID.