[JIRA] (IDP-1950) Support LDAP connections without neither SSL nor StartTLS

Tue May 10 00:02:45 UTC 2022

Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMDRiZWQxNGNhMzRlNDMxYjljMDQzMDc0ZGI0ZGU3YTMiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/IDP-1950?atlOrigin=eyJpIjoiMDRiZWQxNGNhMzRlNDMxYjljMDQzMDc0ZGI0ZGU3YTMiLCJwIjoiaiJ9 ) IDP-1950 ( https://shibboleth.atlassian.net/browse/IDP-1950?atlOrigin=eyJpIjoiMDRiZWQxNGNhMzRlNDMxYjljMDQzMDc0ZGI0ZGU3YTMiLCJwIjoiaiJ9 ) Support LDAP connections without neither SSL nor StartTLS ( https://shibboleth.atlassian.net/browse/IDP-1950?atlOrigin=eyJpIjoiMDRiZWQxNGNhMzRlNDMxYjljMDQzMDc0ZGI0ZGU3YTMiLCJwIjoiaiJ9 )

Issue Type: New Feature Assignee: Unassigned Created: 09/May/22 8:02 PM Priority: Trivial Reporter: Vladimir Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 )

Hi,

This is a follow-up to a comment I made earlier on https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration (now deleted). Reply to the comment was to create a JIRA ticket instead.

The https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration says:

> 
> 
> 
> We have tentative plans to deprecate the “jvmTrust” option
> 
> 

In the field, I have seen IdP deployments connecting to local AD where they prefer to connect without neither SSL nor StartTLS - trusting the local network.

When idp.authn.LDAP.useStartTLS and idp.authn.LDAP.useSSL are both false, it is hard to come with a suitable setting for idp.authn.LDAP.sslConfig - as the options of certificateTrust and keyStoreTrust require a value to be provided for either idp.authn.LDAP.trustCertificates or idp.authn.LDAP.trustStore. When neither SSL nor StartTLS is used, there is no suitable value to provide for these settings (and startup breaks if not provided).

We’ve been using jvmTrust as the value for idp.authn.LDAP.sslConfig to work around this - as it works in the “no SSL no StartTLS” scenario, without having to provide a trustCertificate or a trustStore.

In particular if jvmTrust is to go away, it would help to provide a noTrust setting for idp.authn.LDAP.sslConfig that could be used in the “no SSL no StartTLS scenario”.

Cheers,
Vlad

( https://shibboleth.atlassian.net/browse/IDP-1950#add-comment?atlOrigin=eyJpIjoiMDRiZWQxNGNhMzRlNDMxYjljMDQzMDc0ZGI0ZGU3YTMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1950#add-comment?atlOrigin=eyJpIjoiMDRiZWQxNGNhMzRlNDMxYjljMDQzMDc0ZGI0ZGU3YTMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:84aea4f )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220510/614c5945/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ec2535d4-c3b1-4274-aac2-1234318a2836
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220510/614c5945/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f89b682c-7557-4f28-a3cb-09a86e03f4d0
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220510/614c5945/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-e4e31a3c-891f-4316-ba77-08f4290d533b
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220510/614c5945/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-6e9d0f2e-082f-43b5-a84a-27b0090b898f
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220510/614c5945/attachment-0007.png>