Certificate practices using IdP with MS AD LDAP

[Daniel Fisher]

On Wed, Apr 24, 2013 at 1:04 PM, David Bantz <dabantz at alaska.edu> wrote:

>
> On Wed, 24 Apr 2013, at 06:04 , Daniel Fisher <dfisher at vt.edu> wrote:
>
> ) Import the certificate for the Domain's private CA into an alternate
>> location for java trusted CA?
>>
>>
> This is my preferred solution. I like the trust dependencies to be
> declared in the configuration, even for certificates that would otherwise
> be trusted by default, and stored with the configuration. Storing
> certificate dependencies in cacerts invites problems associated with JVM
> upgrade and certificate expiration.
>
>
>> In either case, how do you ensure that both the private CA and other
>> well-known CAs have up-to-date certificates in that store?
>>
>
> CA expiration is typically greater than five years, and those transitions
> should be well communicated and planned.
>
>
> I'm probably missing something basic and would appreciate your helping me
> get clear:
>
> If I configure java to use an alternate store for trusted certificates,
> I'm told that bypasses trusting certificates in the default location.  So
> how will the IdP appropriately trust certificates(or not)  signed by well
> known CAs?  Do you mean I need to import all the known root CAs into the
> alternate store and then actively manage that alternate store by checking
> for updates and revocations by all known CAs?  That seems a big extra task.
>
>
I'm not suggesting you change the default, JVM wide trust settings. I'm
suggesting you configure trust specifically for your LDAP connections. In
particular this would mean configuring your attribute resolver with
a StartTLSTrustCredential:
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnectorSee
SSL/TLS Support.

If you're using LDAP for authentication you would configure the JAAS module
as well:
sslSocketFactory="{trustCertificates=file:/path/to/my/trust.crt}"

Now your LDAP connections are using only the trust material you've supplied
in configuration and anything else using the default trust manager will
continue to function as normal.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130424/45064009/attachment.html