Skip to content

CleartextLdapUrl.md

Latest commit

 

History

History
28 lines (22 loc) · 1.39 KB

CleartextLdapUrl.md

File metadata and controls

28 lines (22 loc) · 1.39 KB
Raw

Cleartext LDAP URL

Configuring an LDAP context source with an ldap:// URL transmits bind credentials and directory data over an unencrypted channel. An attacker positioned on the network can intercept the service-account password and the contents of every directory query and response.

Recommendation

Use ldaps:// (LDAP over TLS) or enable STARTTLS so that the connection to the directory server is encrypted and authenticated. Store the bind password outside source control (for example in a secret manager or environment variable).

Example

The following example configures a Spring LdapContextSource with a cleartext ldap:// URL, so the bind credentials cross the network in the clear.

@Bean
public LdapContextSource ldapContextSource() {
    LdapContextSource ctx = new LdapContextSource();
    // BAD: cleartext ldap:// transmits the bind password unencrypted.
    ctx.setUrl("ldap://ldap.corp.example.com:389");
    ctx.setUserDn("cn=svc-app,ou=ServiceAccounts,dc=corp,dc=example,dc=com");
    ctx.setPassword(System.getenv("LDAP_PASSWORD"));
    ctx.afterPropertiesSet();
    return ctx;
}

Use ldaps://ldap.corp.example.com:636 instead.

References