For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

djz_104054's avatar
djz_104054
Icon for Nimbostratus rankNimbostratus
Feb 13, 2014

Client SSL converion to TLS for the server for LDAP

My use case is to translate a SSL connection coming from the client into a TLS connection directed to the server for the LDAP protocol. The client cannot use STARTTLS via port 389, as this is just not implemented in Oracle's DBMS_LDAP package. Somehow the F5 hast to negotiate first with the client and start a TLS session with the LDAP server before LDAP-binding with DN/password transfer could take place. But I do not have a clue as how to implement this using iRules and would appreciate any hint /directions at all.

 

application delivery
devops
iRules
LTM
security
ssl
tls

4 Replies

  • David_Holmes_12's avatar
    David_Holmes_12
    Historic F5 Account
    Feb 14, 2014
    Are you asking for STARTTLS / LDAP support on the BIG-IP? Current versions do not support it, but I have heard it might be on the roadmap in the future. Let me back up for a second. The client speaks SSL. The server speaks LDAP. Correct? Have you tried setting up a virtual to include clientssl profile WITHOUT an associated HTTP profile? That would cause the bigip to strip off the SSL and just send through whatever the client was sending underneath.
  • JoshBecigneul's avatar
    JoshBecigneul
    Icon for MVP rankMVP
    Feb 15, 2014

    Does your LDAP server not support SSLv3 and only supports TLS protocols? Does your client only support SSLv2 or SSLv3?

     

    If this is the case then you could likely use a standard virtual server with clientssl and serverssl profiles properly tuned to support what you want. The SSL/TLS connections on each side of the F5 can use different settings during initialization.

     

  • djz_104054's avatar
    djz_104054
    Icon for Nimbostratus rankNimbostratus
    Feb 17, 2014
    Thanks David. As I did not find anything abour STARTTLS/LDAP in conjunction w/BigIP I assumed I missed something. So that type of protocol is not supported (yet). Just good to know & thank you that piec of information.
  • Colin_Streicher's avatar
    Colin_Streicher
    Icon for Nimbostratus rankNimbostratus
    Jul 16, 2014

    So I've been fighting with this for a while, the issue appears to be that the F5 does not support terminating TLS connections on LDAP. Since LDAPS has been deprecated for a while in openldap, I've turned it off explicitly so there are no surprises if it is removed.

     

    This is pretty annoying to me since its complicated the setup I am working with. There is also a strong chance that I'm missing something since the ldap monitor supports TLS and works fine. It seems odd that it would support half of TLS on LDAP and not the other half. Anyways, just my $.02, if anyone from F5 can comment on where ldap TLS termination is in fact supported or not that would be helpful.