<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Tue, Jan 26, 2016 at 4:57 PM, Nate Klingenstein <span dir="ltr"><<a href="mailto:nate.klingenstein@utah.edu" target="_blank">nate.klingenstein@utah.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The combination of the default e.g. shibboleth-identity-provider-3.2.1/conf/ldap.properties with the following comments in it:<br>
<br>
## Connection properties ##<br>
idp.authn.LDAP.ldapURL                          = ldap://localhost:10389<br>
#idp.authn.LDAP.useStartTLS                     = true<br>
#idp.authn.LDAP.useSSL                          = false<br>
<br></blockquote><div><br></div><div>Perhaps simply setting each property to the default, rather than commenting them out would force the deployer to make a choice?</div><div> </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
and the shorthand Spring that does default it to true if that property is not set in e.g. shibboleth-identity-provider-3.2.1/conf/attribute-resolver-ldap.xml<br>
<br>
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}”<br></blockquote><div><br></div><div>Or removing the default and getting spring errors if the property isn't set...</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
appears to be catching a lot of people off guard, and it’s not really obvious how to debug it if you don’t know Spring or the IdP well.<br></blockquote><div><br></div><div>I would think the logs in this case would be pretty clear. I'm assuming the deployer ends up with a connection pool that attempts to use startTLS against a directory that doesn't support it? If you could post the confusing error, perhaps I can make it better.</div><div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div>