Connect to Identity Sources Using LDAPS

By default, Active Directory Domain Services bind to port 389 for insecure LDAP requests and port 636 for LDAP over SSL (LDAPS). Although port 636 is open in the Windows firewall and accepts Transmission Control Protocol (TCP) connections, any directory requests made over this port are rejected if the Domain Controller (DC) does not have a trusted certificate to bind to the service during startup.

If you are connecting to your Identity Source securely using LDAPS, you need the SSL certificate from your LDAP directory server when configuring the connection in the Cloud Administration Console. The following are some methods for retrieving the certificate.

1. Ask your directory server administrator for the certificate chain. When you add your connection to the LDAP directory (following the steps in your Quick Setup Guide), upload this file in the SSL Certificates section.

2. If you are unable or prefer not to request the SSL certificate from your directory server administrator, you can use OpenSSL to obtain it. Follow these steps:

   1. After you add your identity router (following the steps in your Quick Setup Guide), access SSH on your identity router using the instructions in Access SSH for Identity Router Troubleshooting.

   2. From the identity router command line, query the directory server to obtain the certificate chain using the following command:
      openssl s_client -showcerts -connect LDAP.SERVER:636
      where LDAP.SERVER is the LDAP directory server that has the full certificate chain loaded on it. (You might have to ask your directory server admin to know which directory server to query.)

   3. From the output, copy the sections starting from and including the BEGIN CERTIFICATE line to (and including) the last END CERTIFICATE line. Paste these lines into a local file on your desktop and name the file, for example, Idaps.pem.

   4. When you add your Identity Source connection to the LDAP directory (following the steps in your Quick Setup Guide), upload this file in the SSL Certificates section.