Pass the Certificate
Last updated
Was this helpful?
Last updated
Was this helpful?
This technique extends the notion of , thus dubbed by in his Twitter . Even if both techniques share the same name and the same concept, the authentication method is different.
Sometimes, Domain Controllers do not support . This can be because their certificates do not have the Smart Card Logon EKU. Most of the time, domain controllers return KDC_ERR_PADATA_TYPE_NOSUPP error when the EKU is missing. Fortunately, several protocols — including LDAP — support Schannel, thus authentication through TLS. As the term "schannel authentication" is derived from the which is the Microsoft SSL/TLS implementation in Windows, it is important to note that schannel authentication is a SSL/TLS client authentication.
Schannel authentication relies on TLS so it is, by design, not subject to channel binding, as the authentication is borne by TLS itself.
Schannel is not subject to LDAP signing either as the bind is performed after a StartTLS command when used on the LDAP TCP port.
Tools like (python version) and can be used to authenticate with the certificate via Schannel against LDAP.
