How to configure for strengthened AD LDAP about mojolicious-plugin-spnego HOT 3 CLOSED

This in itself should be fine ... you just need to user the ldaps:// protocol .. BUT there is a bigger problem which can not be worked around: https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/ldap-session-security-settings-requirements-adv190023

if you enable LdapEnforceChannelBinding, then AD will verify that the ntlm token is generated by the same process that opened the ssl connection to AD ... and thus will prevent this approach from working.

from mojolicious-plugin-spnego.

Just to confirm, that means that the SPNEGO plugin can't be used at all if this is enabled server-side?

from mojolicious-plugin-spnego.

The purpose of LdapEnforceChannelBinding is to make sure that the ldap connection originates from the same place as the ntlm token ... this setting will prevent this approach from working ...

I will be looking into porting https://metacpan.org/pod/release/DRUOSO/Catalyst-Authentication-Credential-GSSAPI-v0.0.5/lib/Catalyst/Authentication/Credential/GSSAPI.pm to mojolicious soo this should provide an alternate method to achieve sort of the same ... with the limitation that your machine must be setup with kerberos.

from mojolicious-plugin-spnego.