disable ldap hostname verification?

[Baron Fujimoto]

Mahalo!  Adding the following to my LDAP data connector did the trick:

<dc:LDAPProperty name="java.naming.ldap.factory.socket" value="javax.net.ssl.SSLSocketFactory"/>

-baron

On Tue, May 15, 2012 at 07:21:14AM +0100, Rod Widdowson wrote:
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnector
> 
> points to 
> 
> http://code.google.com/p/vt-middleware/wiki/vtldap
> 
> from which 
> http://code.google.com/p/vt-middleware/wiki/vtldapTLS
> 
> suggests that 
> 
> java.naming.ldap.factory.socket=javax.net.ssl.SSLSocketFactory
> 
> will do what you want... (set via <LDAPProperty/>)
> 
> > -----Original Message-----
> > From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Baron Fujimoto
> > Sent: 15 May 2012 02:14
> > To: Shib Users
> > Subject: disable ldap hostname verification?
> > 
> > Is there a way to disable hostname verification for LDAPS in 2.3.6 via IdP config files?  I understand
> > that it's there for the security update, but due to peculiarities of our current architecture[*],
> > we're getting tripped up by this. Unless there's a way to disable this, we'll have to forego upgrading
> > our IdP until we can figure out a workaround.
> > 
> > [*] ldap hosts behind a load-balanced virtual host, the SSL cert is issued for the virtual hostame.
> > However, because we have suspected issues with our load balancer, I've been pointing our attribute
> > resolver at the pool of real ldap hosts behind the virtual host - but these hostnames don't match the
> > SSL cert's.

-- 
Baron Fujimoto <baron at hawaii.edu> :> UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum