By configuring the directory server to reject SASL (Negotiated, Kerberos, NTLM, or Digest) LDAP binds that do not request a signature (integrity verification) and connections in the clear (non-SSL/TLS encrypted) A simple LDAP bind performed on the server can significantly enhance the security of this server. Even if no clients use such bindings, configuring the server to reject such bindings will increase the security of the server.

Some clients may currently rely on unsigned SASL bindings or LDAP simple bindings on non-SSL/TLS connections and will stop working when this configuration change is made. If such bindings occur, to assist in identifying these clients, this directory server will log a summary event every 24 hours showing the number of such bindings. It is recommended that those clients be configured not to use such bindings. Once such an event is not observed for too long, it is recommended that the server be configured to reject such bindings.