微软安全公告 ADV190023 的 Spring Ldap 影响(LDAP channel 绑定(bind)和 LDAP 签名)

Question

我们正在使用 Spring Security Ldap Library (v4.0.4) 从我们客户端的 Active Directory (ldap://domain:389) 中获取用户列表，并对他们进行身份验证以登录我们的 Web 应用程序。

Microsoft 最近发布了启用 LDAP channel 绑定(bind)和 LDAP 签名的公告:
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023

“LDAP channel 绑定(bind)和 LDAP 签名提供了提高 LDAP 客户端和 Active Directory 域 Controller 之间通信安全性的方法。Active Directory 域 Controller 上存在一组不安全的 LDAP channel 绑定(bind)和 LDAP 签名默认配置，可让 LDAP 客户端与它们进行通信无需强制执行 LDAP channel 绑定(bind)和 LDAP 签名。这可能会打开 Active Directory 域 Controller 以提升权限漏洞。”

我们被问到在他们的服务器上启用 LDAP channel 绑定(bind)和 LDAP 签名是否会影响我们的流程。我在文档中找不到有关这些的信息:
https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#ldap

Spring Security Ldap Library (v4.0.4) 是否支持这些？
如果是这样，我们是否应该更改任何配置以确保不受影响？

Answer 1

这是我从项目的 Github 页面得到的官方答案，供可能觉得有用的人使用:

https://github.com/spring-projects/spring-security/issues/8037

No, Spring Security's AD support only does simple binds with the user's username and password - the only security enhancement available is to use TLS. If an application needs channel binding, I'd imagine it would be via Java's GSS-API.

Since 4.0.x is no longer a supported branch, any added support would very likely go into modern versions of Spring Security.

Of course, if you find any issues along the way, or would like to suggest a feature, then don't hesitate to open another issue and maybe link it back to this one.