Tips on enabling SSL in Active Directory!!!

Question

Finally I can connect to my Active Directory through SSL connection. I don't know what is wrong with my previous settings because I reinstall the server from scratch. Below is the steps I took:
1. Install Windows 2000 Advanced Server + SP4
2. Install Windows 2000 High Encryption Pack (128-Bits SSL)
3. Install Active Directory Service together with MS DNS Server and Enterprise Certificate Authority Service.
4. Install Windows 2000 Support Tools from Windows 2000 installation CD.
5. Launch ldp.exe and connect to local Active Directory on port 636.
6. It should display the rootDSE content if SSL is working properly.
7. Go to C: drive and get the root CA certificate in root directory. It should be named xxx.crt.
8. Import the certificate into ${JAVA.HOME}/lib/security/cacerts file.
9. Right now everything should be OK.
What surprised me is I didn't follow several 'important' steps suggested by both Microsoft and some other developers in this forum. They are:
1. Open the Domain Controller Policy using the Group Policy Editor.
2. Under Computer Configuration , click Windows Settings .
3. Click Security Settings , and then click Public Key Policies.
4. Click Automatic Certificate Request Settings .
5. Use the wizard to add a policy for Domain Controllers.
I double checked that I didn't enable Automatic Certificate Request Settings. But somehow SSL works. Can somebody explain why?
Regards,
WenBin

Answer 1

I am glad that you can benefit from the tips.
Regarding to you question, the answer is like this:
1. A user named David logon
2. You generate the userPrincipal for him - [email protected]
3. Bind to ADS with this userPrincipal and the password he typed in
4. If succeeds, search user container with sAMAccountName=David and meanwhile request any attributes you want. Please refer to JNDI tutorial on how to search LDAP directory and get back some other attributes at the same time.
Hope this help you.
Regards,
WenBin