All,

I apologize if this has been covered already.  But this was just brought up by our cybersecurity team.  They plan to disable "deprecated protocols".  By that, they mean simple LDAP binding to AD's LDAP port.  Because of passing content in clear text.

They flagged our Linux AD connections  (using sssd), which are using SASL binding.  The usual sssd stuff:
 to AD's LDAP port and the LDAP GC port.   

Flagging those connections is a mistake;  these connections are encrypted.
 
https://www.pkisolutions.com/reminder-ldap-signing-requirements-in-march-2020/

But cybersecurity is asking --  are the question "are these connections signed?".   I don't know the answer to that.  If not, is there a simple parameter that will allow sssd to sign these connections.  Or is "signing" a SASL binding a characteristic of the MS-Specific SASL binding (MS-SPNG)?  

BTW, we use a couple of AD integration clients for Linux.  sssd can satisfy 95% of the use cases, but there's a couple of use cases that sssd can't do.  For that, we have to use the older (commercial) product.  That older commercial product does *not* have any support to run SASL binding over LDAPS.  

So why I realize that I could technically have sssd run its SASL bindings over LDAPS -- that other client can't.  So I'm not really investigating SASL bindings over LDAPS.

Spike