Microsoft advises using LDAP channel binding:
https://msrc.microsoft.com/update-guide/en-us/vulnerability/ADV190023

LDAP channel binding was implemented in OpenJDK 16:
https://bugs.openjdk.java.net/browse/JDK-8247311

And was backported to OpenJDK 11:
https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-April/005860.html

The tomcat JNDIRealm.getDirectoryContextEnvironment() method needs to be updated to provide the capability to set 'com.sun.jndi.ldap.tls.cbtype' to 'tls-server-end-point' for channel-binding to work[1]. Or we could add a more general improvement to allow any com.sun.jndi property customizaition.

Source references:
[1]https://github.com/apache/tomcat/blob/master/java/org/apache/catalina/realm/JNDIRealm.java#L2603

ASF BZ: https://bz.apache.org/bugzilla/show_bug.cgi?id=65302