Hi Denis,

thanks for the info about filetoken, we'll keep that in mind for 2.7 (local LSASS cache, cleaner). For now, we'll test the switch to Require Signing on the AD side without changing our current authentication method, since you confirm that signing is negotiated by default via...

Hello Denis,

Thank you for this clarification, it's reassuring. We are on version 2.6.1.17834-bd5dd3d4.

To clarify: in our case, the pyLDAP module is called on the WAPT server itself (waptservice, on our Debian system), as part of the group membership verification for SSO...

Hi Denis,

Thanks for the feedback. After checking event 2889 on the DCs, the source of the unsigned bind is not the Windows self-service (Lazarus/pyLDAP) but the WAPT server itself:

WAPT version: 2.6.1
Server OS: Debian 13 (Trixie)
The LDAP bind originates from the WAPT server, under its...

We are preparing to activate the Active Directory "LDAP Server Signing Requirements" policy on our domain controllers. By auditing unsigned LDAP traffic (event 2889), we identified that the WAPT self-service module (get_allowed_domain_usergroups() in waptservice/service.py, checking the...).