Chapter 9. Configuring Secure Connections
STARTTLSconnection, and SASL authentication, which provide layers of encryption and security that protect directory data from being read even if it is intercepted.
9.1. Requiring Secure Connections
- When you use the LDAPS protocol, the connection starts using encryption and either succeeds or fails. However, no unencrypted data is ever send over the network. For this reason, prefer LDAPS instead of using
STARTTLSover unencrypted LDAP.
- Clients establish an unencrypted connection over the LDAP protocol and then send the
STARTTLScommand. If the command succeeds, all further communication is encrypted.
STARTTLScommand fails and the client does not cancel the connection, all further data, including authentication information, is sent unencrypted over the network.
- Simple Authentication and Security Layer (SASL) enables you to authenticate a user using external authentication methods, such as Kerberos. For details, see Section 9.10, “Setting up SASL Identity Mapping”.