Add SSL support to LdapSessionOptions on Linux

[iguyking]

Description

When using System.DirectoryServices.Protocols.LdapConnection to connect to an LDAPS target on CentOS7, throws the error of

Unhandled exception. System.PlatformNotSupportedException: Operation is not supported on this platform.
   at System.DirectoryServices.Protocols.LdapSessionOptions.set_SecureSocketLayer(Boolean value)
   at activeDirectoryLdapExamples.Program.Main(String[] str) in /home/iguy/exceptionless/Program.cs:line 23

Example Code:

using System;
using System.Net;
using System.DirectoryServices.Protocols;

namespace LdapsExample
{
   class Program
   {
      static void Main(String[] str)
      {
            var ldapInfo = new LdapDirectoryIdentifier("1.2.3.4", 636);

            using (var ldapConnection = new LdapConnection(ldapInfo))
            {
              var nC = new System.Net.NetworkCredential("ldaps_login", "my_password");
               ldapConnection.AuthType = AuthType.Negotiate;
               ldapConnection.SessionOptions.ProtocolVersion = 3;
               ldapConnection.SessionOptions.SecureSocketLayer = true;
               ldapConnection.SessionOptions.VerifyServerCertificate += delegate { return true; };
               ldapConnection.Bind(nC);
            }
            Console.WriteLine("True");
      }
   }
}

Configuration

.NET SDK (reflecting any global.json):
Version: 5.0.100-rc.2.20479.15
Commit: da7dfa8840

Runtime Environment:
OS Name: centos
OS Version: 7
OS Platform: Linux
RID: centos.7-x64
Base Path: /usr/share/dotnet/sdk/5.0.100-rc.2.20479.15/

Host (useful for support):
Version: 5.0.0-rc.2.20475.5
Commit: c5a3f49

.NET SDKs installed:
5.0.100-rc.2.20479.15 [/usr/share/dotnet/sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 5.0.0-rc.2.20475.17 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 5.0.0-rc.2.20475.5 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

OS: CentOS 7 patched as of 2020-10-01 on x86_64

Regression?

Other information

[Dotnet-GitSync-Bot]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[iguyking]

@tquerec @josephisenhour @joperezr I think this is the way I need to reference something to tag it area-System.DirectoryServices.

[joperezr]

Hello @iguyking, yes what you are seeing is expected as we currently don't support SSL on Linux yet. I believe that the native library that we use underneath in Linux does support SSL so it might just be a matter of exposing this functionality by calling the right native API on libldap. I found this interesting thread on the topic: https://www.openldap.org/lists/openldap-software/200603/msg00212.html more specifically :

>>OpenLDAP's -lldap supports initiating TLS (SSL) using either
>>the standard "Start TLS" mechanism [RFC2830] or the non-standard
>>"ldaps:" (Secure LDAP) mechanism.  In the former case, the
>>program should call ldap_initialize(3) with the appropriate
>>ldap: URL, set version to 3, and then call ldap_start_tls_s(3).
>>In the latter case, ldap_initialize(3) is called with the
>>ldaps: URL.  In both cases, appropriate certificate information
>>should be provided via ldap.conf(5) facilities or via
>>ldap_set_option(3)).  See the client/tools for example code.

I'll mark this issue as up-for-grabs in case anybody from the community wants to add this support to Linux before we get to it.

[lawrence-laz]

For anyone looking for a termporal fix until this gets implemented: Novell.Directory.Ldap.NETStandard supports LDAPS and LDAP+StartTLS.