Microsoft requiring LDAP channel binding and LDAP signing with 2020 update

Microsoft requiring LDAP channel binding and LDAP signing with 2020 update

Issue
Microsoft Advisory ADV190023:
Microsoft is planning to push out an update in March 2020 that will require LDAP channel binding and LDAP signing for LDAP connections.
(Please note, Microsoft initially planned to push the change in January.)


Solution
What does this mean for Unified Workspace?

As long as your LDAP connections for UW are using LDAPS (SSL over port 636) this update will not affect UW.  If the LDAP connections are using plain text (non-SSL over port 389) this update will prevent UW from making the Simple Bind connection to your directory.

To verify that UW is using LDAPS, when connecting to Active Directory:
  1. Browse to the 8090 Management Console of your loader (https://127.0.0.1:8090/)
  2. Select the Directory Tab
  3. Verify the Enable SSL checkbox is checked


AD LDS installations are configured to use LDAPS to connect to the AD LDS instance, however, it is possible the Sync process that syncs AD to the AD LDS instance may not be set to use LDAPS.

To verify that UW is using LDAPS, when syncing AD to the AD LDS instance:
  1. Open webAdmin
  2. Expand Tree Root
  3. Select the container object being synced from AD
  4. Select the Directory Sync tab
  5. Verify the External Directory LDAP address contains ldaps (Example: ldaps://ADServer1.org1.local)


To use LDAPS (SSL) to connect to AD, requires LDAPS support to be enabled:

Please review this Petri article for steps on enabling LDAPS support.


    Can't find the KB

    Unable to find the KB to address your issue ?  

      • Recent Articles

      • Lenovo Unified Workspace End-of-Life Questions and Answers

        Will the shutdown of LUW servers and access to downloads affect my server licensing? No, the shutdown of the customer servers and access to the product and licensing downloads will not affect your server licensing. This license is downloaded and ...
      • How do I determine my Unified Workspace license expiration date?

        The best method for determining the licensing information including the expiration date of your Unified Workspace license: Login to your 8090 management console on each server This may take remoting into each LUW server and relay, opening a browser, ...
      • Lenovo Unified Workspace 7.0.2.13 Released

        Highlights of Unified Workspace 7.0.2.13 Before you install: Please view the installation notes here. 7.0.2.13 requires a 7.0 license file. Below is a list of enhancements and fixes released in Unified Workspace 7.0.2.13 Fixed external storage ...
      • LanSchool Documentation Guides

        LanSchool Classic Teacher Console The LanSchool Teacher Console is the interface teachers will use to manage their classroom and students. It contains all the tools necessary for a teacher to effectively interact with students and create a ...
      • Lenovo Unified Workspace 7.0.1.41 Released

        Highlights of Unified Workspace 7.0.1.41 Before you install: Please view the installation notes here. 7.0.1.41 requires a 7.0 license file. Below is a list of enhancements and fixes for Unified Workspace 7.0.1.41 Updated Log4j Updated Java Updated ...
      • Related Articles

      • LDAP Signing on windows server 2008 and higher

        The customer is trying to connect to a windows server 2008 domain controller and is getting : javax.naming.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on ...
      • Unable to update schema

        The customer is a doing new install and can not perform wizard #2 when using Active directory. Customer turned on com.stoneware.service.directoryManager.schema debug and got the following error:  FATAL (04/29) 10:58:32 ...
      • Update schema during upgrades.

        During an upgrade, it says that I may have to make changed to update the schema. During an upgrade, the schema usually requires updating to add new attributes for webNetwork. If you use eDirectory there is typically nothing else that has to be done. ...
      • Unable to update schema - problem 5001 ( BUSY )

        The customer is trying to install webnetwork into Microsoft ad and is getting Unable to update the schema. And the following error is displayed: INFO (12/19) 11:01:05 [com.stoneware.service.DirectoryManager]: We are creating an AD connection. FATAL ...
      • Common Microsoft AD LDAP bind errors.

        LDAP error code 49 is the generic code for authentication error. https://helpdesk.lenovosoftware.com/portal/kb/articles/ldap-error-codes-22-8-2017 has the list of java ldap top level error codes. To fully understand the error you need the rest of the ...