login.config to use private-CA-issued certificate

[David Bantz]

The config below for a single server configured to trust a single imported server cert works (with needed assist from Daniel Fisher).
There seem to be at least two conceivable routes to add redundancy:

	(A) "stacked" login modules for multiple AD server instances:
		edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
       ldapUrl="ldap://ad02.ua.ad.alaska.edu:3268"
		…
		edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
		ldapUrl="ldap://ad03.ua.ad.alaska.edu:3268"
		..., or

	(B) "failover" configuration with multiple server instances in a single module:
		edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
		ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3268 ldap://fbk-adua03.ua.ad.alaska.edu:3268"
       sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/????}"
	
(B) may be infeasible unless there is some way to include reference to multiple trusted server certificates (non-obviousi to me).  
If there is such a mechanism, is (A) or (B) or some third way preferable for high availability based on redundancy?
		
David Bantz

login.config fragment:

// UA AD Auth
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="ldap://ad02.ua.ad.alaska.edu:3268"
      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
      bindCredential="••••••••••"
      subtreeSearch="true"
// Directly reference imported server certificate for TLS on 3268
      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Ad02.ua.ad.alaska.edu.pem}"
      ssl="false"
      tls="true"
      userField="sAMAccountName,uaIdentifier";

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130730/28055331/attachment.html