9. Chef Server >= 12.19.26 breaks LDAP compatibility with Microsoft IIS

[glasschef]

Chef Server Version

12.19.26, 12.19.31

Platform Details

RHEL 7.6

Configuration

Standalone, standard ldap configuration (ssl_enabled is true)

Scenario:

AD/LDAP integration fails when connecting to Microsoft IIS due to missing signature_algorithm extensions in the HELLO section of a TLS 1.2 handshake. Per spec, the server should respond with some sort of negotiation, but this specific server simply drops the connection. Relevant details here:

http://erlang.org/pipermail/erlang-questions/2017-September/093310.html
https://bugs.erlang.org/browse/ERL-206

Steps to Reproduce:

• Attempt to configure the Chef Server to use Microsoft AD server for login as documented here: https://docs.chef.io/server_ldap.html

• Observe failure

• Use tcpdump to capture SSL handshake, notice no signature_algorithm extensions

Expected Result:

Chef Server is compatible with Microsoft IIS Active Directory (accounting for slightly broken SSL implementation)

Actual Result:

Chef Server is incompatible with Microsoft IIS Active Directory due to missing signature_algorithm extension in SSL negotiation

[markan]

Nice detective work on this one. It looks like this issue is fixed in R20. We're very close to having all the dependencies in chef server updated to work with R20, so that would be my preferred fix.

While it looks like reverting to R18.3 would fix this, I'm kind of leery of that because of the CVEs fixed since 18.3, including CVE-2016-10253 and CVE-2017-100038. I don't think we're super vulnerable from those, as we don't really expose or use the features at risk, but still better to be up-to-date.

[irvingpop]

hey @markan is this also an issue for Chef Server 13.0.17 ?

[btm]

I think these internal tickets are related:
https://chefio.atlassian.net/browse/TRI-860
https://chefio.atlassian.net/browse/TRI-814

[PrajaktaPurohit]

Chef Infra Server is updated to to use Erlang 20. This change will be available in stable with the next release of Chef Infra Server.

[btm]

This is fixed in Chef Infra Server 13.1.13+ (stable) through the upgrade to Erlang 20 which includes the fix for https://bugs.erlang.org/browse/ERL-206.