Description of problem:

Microsoft has announced that as of March 2020, all supported versions of Active Directory will require LDAP channel binding and LDAP signing by default:

https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows

On RHEL7 and later, the sssd-ad provider can perform LDAP channel binding and LDAP signing by setting "ldap_sasl_mech = GSS-SPNEGO" in sssd.conf, overriding the default value of "GSSAPI" (which does not perform signing).

However, the latest sssd-ldap for RHEL6 is sssd-ldap-1.13.3-60.el6_10.2.x86_64, which only supports "GSSAPI" for ldap_sasl_mech.

Thus, when Microsoft releases the security update that requires LDAP channel binding and LDAP signing by default, unless Active Directory administrators specifically override it, this Microsoft change will break the ability for the RHEL6 sssd to use Active Directory as an identity provider. This will effectively break any RHEL6 host joined to Active Directory.

I would argue that breaking the ability for RHEL6 hosts to use Active Directory as an identity source unless a known attack vector (non-sealed LDAP binds) is enabled counts as an "Important" impact security fix under the "Maintenance Support 2" description and is thus appropriate to release for RHEL6.

Please consider backporting the GSS-SPNEGO ldap_sasl_mech option to the RHEL6 sssd, or providing some other mechanism for the RHEL6 sssd to satisfy Microsoft's requirements for LDAP channel binding and LDAP signing.

Version-Release number of selected component (if applicable):

sssd-ldap-1.13.3-60.el6_10.2.x86_64

How reproducible:

Routine operations by the sssd-ldap identity provider against an Active Directory data provider will generate warnings in the Windows Event Log, although it may be necessary to enable more verbose log messages in order to see the warnings.

Steps to Reproduce:

1. On a RHEL6 host joined to Active Directory, perform some routine lookup operations (e.g., "getent passwd username").

2. On Windows, inspect the Windows Event Log.

Actual results:

There should be no warnings.

Expected results:

A warning something like the following will be logged:

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          12/23/2019 2:29:56 PM
Event ID:      2889
Task Category: LDAP Interface
Level:         Information
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      server.example.org
Description:
The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection. 
 
Client IP address:
1.2.3.4:12345
Identity the client attempted to authenticate as:
DOMAIN\username 
Binding Type:
0

Additional info:

I will anticipate a few counterarguments to this request.

Counterargument: "Migrate to RHEL7 or later."

While most sites are undoubtably in the process of migrating from RHEL6 (given that Support Phase 2 ends on 2020-11-30), Microsoft's change will land 8 months before RHEL6 goes EOL.

Even for sites whose migration to RHEL6 is well underway, shortening the migration timeline from 8 months to 2 months is not realistic.

Counterargument: "Override the [new] Microsoft default until you have migrated all hosts to RHEL6 or later."

For sites that are contractually required to adhere to various security guidelines (e.g., DISA STIGs), overriding a Microsoft security control may cause the host and/or site to fall out of conformance.

While I do not know if any such security guidelines currently require LDAP signing, especially once Microsoft changes the default to require signing, I would expect that most security guidelines would update to require the default setting (require signing) not be overridden. If this occurs before the site's migration to RHEL7 or later is complete, this will create a no-win scenario: override the Microsoft default and incur a potentially severe hit on security audits, or refrain from overriding the Microsoft default and break all RHEL6 hosts joined to Active Directory.