I currently have DNN set up and authenticating against our ADon our corporate intranet.  Our IT department plans to secure all of our LDAP servers in the near future, and they have informed us that our server is making anonymous, clear LDAP queries which will not be accepted in the near future.  How would I go about configuring DNN so that it makes secure, authenticated requests against AD?  As my first attempt, I disabled anonymous access to the entire DNN installation directory in IIS and then enabled impersonation in the web.config file.  I then selected "Secure" for the authentication type and left the username and password blank in the AD authentication settings.  I was hoping that this would cause DNN to make secure LDAP queries using the identity of the user. 

This configuration still auto-logins users against AD and everything appears to be working okay (except that you can't log out and then log in using the host or admin account, but that's okay since I configured my domain account as a superuser).

The problem is that our IT folks are still telling us that we are making unauthenticated (anonymous), clear LDAP queries against their server.  My question is whether I have properly configured DNN so that it will make secure LDAP queries using the identity of the requesting user.  It is possible that another application on our server is making the unauthenticated LDAP queries, I'm just trying to figure out if it is still DNN.

Okay, I was remembering what I did incorrectly.  I did NOT enable impersonation in the web.config.  I am running the asp.net worker process under a network account (configured in the machine.config), and I actually don't want it impersonating the individual user.  I did however enable Windows Authentication in the web.config.

It does not appear that I'm taking DNN out of the equation, as the users get logged in as a DNN user (i.e. it associates my Windows identity to the host account, and other users get associated to their DNN accounts also so I can see them online).

Thanks.

So I've been able to capture a few LDAP packets leaving our server.  It appears that some of the LDAP queries are looking for the configured DNN groups (they don't exist in AD).  What section of code would be doing this type of search and why?  Are these LDAP requests being made over secure channels and under what account credentials are they being made?