Resolving LDAP Port 389 Usage in .NET Core 3.1 Razor Pages with Windows Authentication

Discover how to redirect LDAP traffic from port 389 to port 636 in your .NET Core 3.1 Razor Pages application using Windows Authentication and Active Directory.
---
This video is based on the question https://stackoverflow.com/q/72511738/ asked by the user 'made_it_ma' ( https://stackoverflow.com/u/12126164/ ) and on the answer https://stackoverflow.com/a/72707692/ provided by the user 'made_it_ma' ( https://stackoverflow.com/u/12126164/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Windows Authentication, .netcore 3.1 razor pages app, getting the logged in user results in ldap port 389 getting used

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/licensing
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/by-sa/4.0/ ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Solving LDAP Port 389 Usage in Your .NET Core 3.1 Application

When working with a .NET Core 3.1 Razor Pages application that uses Windows Authentication against Active Directory, developers may encounter a common issue: unwanted communications over LDAP port 389 instead of the more secure port 636. This guide aims to provide clarity on how to manage this situation to ensure your application meets security standards, especially in relation to cybersecurity testing.

Understanding the Problem

In your scenario, you have successfully implemented Windows Authentication. However, while trying to retrieve the currently logged-in user's information via User.Identity.Name, you discovered that your application is generating traffic over port 389 (which is typically used for unsecured LDAP). Not only is this a security concern but it may also hinder your application’s approval to go live due to cybersecurity audits that require a secure environment.

The Risks of Using Port 389

Unencrypted Traffic: Port 389 does not provide encryption, making sensitive user information vulnerable to interception.

Compliance Issues: Many organizations require all communication over the network to use secure protocols due to data protection regulations.

Analyzing the Network Traffic

To address the issue, you need to determine the source of the unwanted LDAP traffic. Using tools like Wireshark can help you monitor network requests and responses. Here’s how you can approach this:

Monitor Network Traffic: Use Wireshark to capture outgoing and incoming traffic while your application is running.

Identify Active Processes: Run the command netstat -b in the Command Prompt to find out which processes are generating LDAP calls.

Pinpoint the Culprits: From monitoring, if you discover that services such as DFS (Distributed File System) and lsass.exe (Local Security Authority Subsystem Service) are making the insecure LDAP calls, you know where to focus your efforts.

Implementing a Solution

Once you’ve identified the cause of the problem, the next step is to address it without disrupting your application’s functionality.

Try Adjusting Your Firewall Settings

One effective solution that worked in this case was to block incoming and outgoing traffic on port 389 using the Windows Firewall. Here’s how to do that:

Open Windows Firewall:

Go to Control Panel - System and Security - Windows Defender Firewall.

Advanced Settings:

Click on “Advanced settings” on the left sidebar.

Create New Rules:

In the Inbound Rules and Outbound Rules, create new rules to block connections on port 389.

Apply Changes:

Save the changes and monitor if the application now utilizes port 636 for LDAP communications.

Potential Risks of Stopping Services

While you might be tempted to stop services like DFS or lsass.exe, be cautious as these services are crucial for system security and stability. Stopping lsass.exe can lead to system reboots and should, therefore, be avoided unless absolutely necessary.

Conclusion

By identifying the cause of the LDAP traffic and implementing firewall rules effectively, you can transition your .NET Core 3.1 Razor Pages application's communication to the more secure LDAP port 636. This not only meets cybersecurity requirements but also instills confidence in your application's security infrastructure.

If you still face challenges, consider reaching out to IT professionals or communities who may have faced similar issues. It’s always useful to share experiences and solutions in the vast landscape of software development.

By following the steps outlined above, you can ensure that your application functions securely

Видео Resolving LDAP Port 389 Usage in .NET Core 3.1 Razor Pages with Windows Authentication канала vlogize