Chapter 9. Configuring Secure Connections

By default, clients and users connect to the Red Hat Directory Server over a standard connection. Standard connections do not use any encryption, so information is sent back and forth between the server and client in the clear.
Directory Server supports TLS connections, StartTLS connection, and SASL authentication, which provide layers of encryption and security that protect directory data from being read even if it is intercepted.

9.1. Requiring Secure Connections

Directory Server provides the following ways of using encrypted connections:
LDAPS
When you use the LDAPS protocol, the connection starts using encryption and either succeeds or fails. However, no unencrypted data is ever send over the network. For this reason, prefer LDAPS instead of using StartTLS over unencrypted LDAP.
StartTLS over LDAP
Clients establish an unencrypted connection over the LDAP protocol and then send the StartTLS command. If the command succeeds, all further communication is encrypted.

Warning

If the StartTLS command fails and the client does not cancel the connection, all further data, including authentication information, is sent unencrypted over the network.
SASL
Simple Authentication and Security Layer (SASL) enables you to authenticate a user using external authentication methods, such as Kerberos. For details, see Section 9.9, “Setting up SASL Identity Mapping”.