LDAPS and UnicodePWD

If you are wiring up Kerberos against Active Directory and wondering whether you can skip LDAPS, the short answer is no. LDAPS is non-optional. It is required and cannot be side-stepped.

Our use of unicodePwd to set passwords during credential generation means that requests over non-TLS encapsulated connections are rejected directly by AD based on its internal constraints. The only alternative to this is SASL, and we provide no such support for SASL to cover the use of unicodePwd. Therefore, LDAPS is required.

The Microsoft documentation does suggest there is a way to turn off this restriction under very specific circumstances for certain releases of Windows. To be frank, it would be ill advised to perform this, and we do not and will not support it.

Reference

• MS-ADTS: Active Directory Technical Specification

• Security

• Active-Directory
• Kerberos
• Tls
• Ssl