IdP & LDAP source using private CA

[David Bantz]

On Mon, 1 Apr 2013, at 11:42 , "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 4/1/13 1:14 PM, "David Bantz" <dabantz at alaska.edu> wrote:
>> ... failure to bind to the AD LDAP during attribute
>> resolution aborts the attribute resolution
>> process, so that no attributes at all are encoded in the SAML assertion.
>> Is there a way to configure the IdP attribute resolution to be less
>> fragile - that is, to enable encoding and release of those attributes
>> that can be resolved without the second AD LDAP?
> 
> For actual connection failures, yes, you need Failover connectors to fall
> into. If you have to back those up with something completely safe, you can
> configure dummy connectors using "Static" that just return a dummy
> attribute.

This seemed a good idea, so I configured a fail-over DataConnector as per
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverRDBMSDataConnector

But failover does not appear to cover the case of connection failure due to untrusted certificate:
the attribute-resolver aborts encountering an untrusted certificate; in fact the IdP startup process
itself aborts encountering untrusted certificate in the DataConnector.

Am I missing something, or is it just the case that receiving an untrusted certificate in a connector
is a fatal error for the IdP?

David Bantz
U Alaska
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130415/453dfddc/attachment.html