Description

Sitecore Active Directory module does not support SSL connections to the AD server.

Using of SSL connection can be identified by specifying the 636 port or LDAPS:// protocol in the connection string. Here are the examples of not supported connection strings:

LDAPS://ADServer.domain.name/OU=Managers,DC=ADDomain,DC=company,DC=com

LDAP://ADServer.domain.name:636/OU=Managers,DC=ADDomain,DC=company,DC=com

Configuring the Active Directory module to use SSL connection to the AD server may result in large part of module's functionality being unavailable, as well as the cause the following errors appearing in the Sitecore log:

ERROR Active Directory existing checking exception: System.Runtime.InteropServices.COMException (0x8007203A): The server is not operational.
  at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
  at System.DirectoryServices.DirectoryEntry.Bind()
  at System.DirectoryServices.DirectoryEntry.get_NativeObject()
  at LightLDAP.MembershipResolver.DirectoryEntryExists(String path, String username, String password, AuthenticationTypes types)

ERROR Active Directory existing checking exception: System.Runtime.InteropServices.COMException (0x80005000): Unknown error (0x80005000)
  at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
  at System.DirectoryServices.DirectoryEntry.Bind()
  at System.DirectoryServices.DirectoryEntry.get_NativeObject()
  at LightLDAP.MembershipResolver.DirectoryEntryExists(String path, String username, String password, AuthenticationTypes types)

Technical Details

The Active Directory module consists of 3 security providers, and only one of them supports SSL connection. Specifically:

• The SitecoreADMembershipProvider provider supports SSL connection. This provider is based on System.Web.Security.ActiveDirectoryMembershipProvider, which provides functionality for SSL connection.
• The SitecoreADRoleProvider and SitecoreADProfileProvider providers do not support SSL connection. 
• The Directory Notification feature which uses specific connection to the Active Directory domain, also does not support SSL connection.