Spring shorthand, again

[Daniel Fisher]

On Tue, Jan 26, 2016 at 4:57 PM, Nate Klingenstein <
nate.klingenstein at utah.edu> wrote:

> The combination of the default e.g.
> shibboleth-identity-provider-3.2.1/conf/ldap.properties with the following
> comments in it:
>
> ## Connection properties ##
> idp.authn.LDAP.ldapURL                          = ldap://localhost:10389
> #idp.authn.LDAP.useStartTLS                     = true
> #idp.authn.LDAP.useSSL                          = false
>
>
Perhaps simply setting each property to the default, rather than commenting
them out would force the deployer to make a choice?


and the shorthand Spring that does default it to true if that property is
> not set in e.g.
> shibboleth-identity-provider-3.2.1/conf/attribute-resolver-ldap.xml
>
>         useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}”
>

Or removing the default and getting spring errors if the property isn't
set...


>
> appears to be catching a lot of people off guard, and it’s not really
> obvious how to debug it if you don’t know Spring or the IdP well.
>

I would think the logs in this case would be pretty clear. I'm assuming the
deployer ends up with a connection pool that attempts to use startTLS
against a directory that doesn't support it? If you could post the
confusing error, perhaps I can make it better.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160126/298e440c/attachment.html>