A custom NTLM Negotiator for go-ldap implementing support for TLS channel bindings.

Many AD deployments nowadays are configured to require channel bindings for TLS connections using authentication methods that support it (https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements). The library go-ldap uses to handle ntlm authentication - go-ntlmssp - has no support for that, and also has no support for sasl-based integrity or confidentiality (which these same AD deployments require for non-TLS connections: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements). go-ldap v3.4.11 added support for a 'custom NTLM Negotiator', which can be used to interpose between go-ldap and go-ntlmssp in order to modify the authentication blob. This can be leveraged to implement channel-bindings support.

Forked from https://github.com/RedTeamPentesting/adauth.