Login.config vs. attribute-resolve.xml?

[Kanuch, Andy]

My IDP working via the testshib page with Active Directory (Huzzah!).   Now I just want to be sure I'm applying best practices for security. Is there any reason to not use LDAPS over LDAP as the connection protocol?

I'm also bit confused about what role the login.config  file plays vs. the DataConnector in attribute-resolve.xml.   Both files contain connection information for my LDAP (Active Directory) server.  So when does Shibboleth refer to each data set for connection information?

Login.config:

   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="DomainController.MyDomain.LOCAL"
      port="3268"
      base="DC=MyDomain,DC=local"
      tls="true"
      serviceCredential="62592fmu4tv"
      userRoleAttribute="sAMAccountName"
      serviceUser="shibboleth.user at MyDomain.local"
      subtreeSearch = "true"
      userField="samAccountName";


Attribute-Resolver.xml

    <resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        useStartTLS="true"
        ldapURL="ldap://DomainController.MyDomain.LOCAL:389" baseDN="DC=MyDomain,DC=local" principal="shibboleth.user at MyDomain.local"
        principalCredential="62592fmu4tv">
        <FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </FilterTemplate>

        <!-- We rely on the uniqueness of the objectSid.  But it is binary so we *must* make it so -->
        <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
        <!-- If we are following from the GC we need thus on -->
        <LDAPProperty name="java.naming.referral" value="follow"/>

    </resolver:DataConnector>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120604/9ca60040/attachment.html