LDAP defaults

[Daniel Fisher]

On Thu, Oct 1, 2015 at 4:18 PM, Nate Klingenstein <ndk at internet2.edu> wrote:

> 1)  Is there a reason why the attribute filter for resolution doesn’t
> depend on the authentication filter like the other properties do, and is
> there a difference between requestContext.principalName and {user}?  e.g.
>
> idp.authn.LDAP.bindDN                           = uid=myservice,ou=system
> idp.attribute.resolver.LDAP.bindDN              = %{idp.authn.LDAP.bindDN}
>
> …
>
> idp.authn.LDAP.userFilter                       = (uid={user})
> idp.attribute.resolver.LDAP.searchFilter        =
> (uid=$requestContext.principalName)
>
>
The filters are different because the source of that data is fundamentally
different and we don't support velocity in LDAP authentication config. If
we did support it, the filter would look something like this:
(uid=$usernamePasswordContext.username), so they still couldn't depend on
each other. But I suppose we could support some velocity syntax there if
people thought that was valuable.


> 2)  What is the meaning of the “true” built into the Spring property for
> useStartTLS?  Is there a reason why it’s not just “true” or a pointer to
> the property?
>
> idp.attribute.resolver.LDAP.useStartTLS         =
> %{idp.authn.LDAP.useStartTLS:true}
>
>    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
>        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
>        principal="%{idp.attribute.resolver.LDAP.bindDN}"
>
>  principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}”>
>
>
The team made a decision to use startTLS by default for all LDAP
integration. The support for this feature is pretty broad at this point.
The ':true' spring syntax is just defaulting the value if that property
isn't set.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20151001/5aeb0dae/attachment.html>