AD Module over SSL

Question

According to https://kb.sitecore.net/articles/886061 the AD module does not fully support SSL:

• The SitecoreADMembershipProvider provider supports SSL connection. This provider is based on System.Web.Security.ActiveDirectoryMembershipProvider, which provides functionality for SSL connection.
• The SitecoreADRoleProvider and SitecoreADProfileProvider providers do not support SSL connection.
• The Directory Notification feature which uses specific connection to the Active Directory domain, also does not support SSL connection.

What functionality would I loose/not work (or what is the only functionality that would work) if I configured the the AD connection over https?

Answer 1

You can setup Domain Controller Firewall to accept connections on the 389 port only from the limited IP addresses and this would add an additional level of the security.

Please notice that even if we do not use SSL, the connectionProtection="secure" method allows us to establish the sign-and-seal connection: http://msdn.microsoft.com/en-us/library/system.web.security.activedirectorymembershipprovider.aspx SignAndSeal - the connection to the Active Directory server is secured by digitally signing and encrypting each packet sent to the server.

How it works: This secure method allows to try to establish SSL connection through the 636 port, and if failed, the sign-and-seal connection established through the default 389 port.