LDAP SSL client affects with LDAP Signing/SASL?

mousumimukherjee 

This simple explanation (probably a bit over-simplified but it'll do) is this:

SASL

• The LDAP connection itself is not encrypted;
• The chosen authentication scheme/package provides its own encryption/securing of the logon credentials. For example, if Kerberos is selected then Kerberos-specific methods are used to secure the authentication process.

LDAP over TLS

• The LDAP connection itself is encrypted;
• Nobody cares about the authentication scheme because the session was already set up as encrypted. Okay, I jest, we do care, but in principle it shouldn't really matter (unless you're running susceptible ciphers and whatnot.)

So, SASL secures the authentication process subject to the limitations of the package (for example Kerberos does a better job of securing thing than NTLMv1).

TLS sets up security first, meaning what comes (i.e. authentication) after doesn't really matter.

Understandable explanations

Understanding LDAP Security Processing - Microsoft Tech Community

LDAP session security settings and requirements after ADV190023 - Windows Server | Microsoft Docs

Technical explanations

[MS-ADTS]: Using SSL/TLS | Microsoft Docs

[MS-ADTS]: SASL Authentication | Microsoft Docs

The important thing is that both provide security to the authentication (i.e. your credentials passing over the wire) process to a varying extents.

Cheers,

Lain