IDM Server Active Directy Trust with LDAP Signing

Posted on

I've searched far and wide about if this implementation will work or not, but haven't had a lot of luck.

I'm currently in the process of trying to get my RedHat machines indirectly integrated with Active Directory. Currently they are Directly Integrated using SSSD but the overhead is too much to handle. I have a working IDM instance with a handful of test clients, and everything is functioning well.

I don't have the ability to test this in my environment, but we're looking at turning on LDAP signing on our Windows Domain Controller. (Policies > Computer Config > Windows Settings > Security Settings > Security Options > Domain Controller: LDAP server signing requirements) It's currently set to negotiate signing, but our security environment may require the "Require Signature" option set.

I've read through a bunch of IDM documentation, but can't seem to find if TLS/SSL is being used to look up user information within Active Directory. Does anyone know if this is the case, or if this will break the IDM trust with AD? All user info is in AD, with POSIX attributes set, and it is currently getting looked up correctly.

TL;DR: Will setting Windows Server LDAP signing requirements to "Require Signature" break my IDM trust with AD?

Appreciate any help in advance!

Responses