LDAP referrals and StartTLS

[Wessel, Keith]

Hi, all,

Wondering if anyone has seen the IDP's LDAP data connector work when using startTLS and encountering a referral. We've got a connector querying our Active Directory with a search base of the root DN. Microsoft surely has what they think is a good reason why queries against the root DN result in several referrals to various subtrees that the client can try. We've got the IDP set up to follow referrals and, when we're using LDAPS, everything works as designed. When we switch to LDAP with StartTLS, the query fails.

I'm guessing that it only does StartTLS on the initial connection and, because our AD instance won't allow authentication over clear-text LDAP, the authentication to the referred connection fails. Just a theory; I've got nothing in the logs to prove that, even with the LDAP logging turned up to DEBUG, other than the fact that the AD data connector is failing. When I set this same connector's search base to something more specific than the root DN, StartTLS works fine.

Is this a bug in the LDAP library? Or is there something I'm overlooking?

Thanks,
Keith