NimbostratusAPM AD auth and LDAP request signing
Microsoft intends to require LDAP singing by default in their upcoming January 2020 server security updates. See https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows. This to mitigate certain LDAP vulnerabilities.
In APM, AD Auth uses LDAP SASL GSS-API/Kerberos to implement the user authentication. However it seems that the actual LDAP AS-Requests are not signed (at least in sw 14.1.x), nor there seem to be any option to sign those. This means they can possibly be used for elevation of privilege. Using Kerberos Pre-Auhentication reduces the risk somewhat, but to my understanding, does not remove it fully.
For an APM 14.1.2.1 authentication request, the AD logs indicate:
The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection.
Client IP address:
x.x.x.x:38874
Identity the client attempted to authenticate as:
DOMAINX\svc-f5-account-x
Binding Type:
0Binding type should be "1" to indicate signed request.
Is there any way to get the LDAP requests signed? I would not like to go to LDAP Auth using LDAPS as a workaround to enhance security.
