PRB: Authentication Fails When You Log On As Current User by Using ADSI over SSL (308149)

CAUSE

By default, anonymous users are not given permissions to view objects in the Active Directory.

The symptoms described earlier are caused, in part, because ADSI is designed to use simple binds when using SSL. Simple binds convey a user name and password in clear text across the network. This is not recommended because this traffic can be monitored by a malicious user. When you use an SSL connection, the network traffic is encrypted and the username and password are protected. Therefore, using simple binds over SSL is an acceptable method.

From an ADSI perspective, there is an important semantic difference between simple binds and binds that use Security Service Provider Interface (SSPI); for example, Kerberos or NTLM. In SSPI binds, you pass a NULL value for the user name and password. The result is a negotiated bind that uses the security credentials that are making the bind. With a simple bind, however, when you pass NULL credentials, you instruct ADSI to use the anonymous user credentials.

ADSI performs simple binds when a secure socket is requested. Those binds that pass NULL credentials result in an anonymous bind being performed over the secure socket connection.

The error is generated because the anonymous user does not typically have sufficient rights to view directory objects.