login.config to use private-CA-issued certificate

[Daniel Fisher]

On Tue, Jul 30, 2013 at 7:47 PM, David Bantz <dabantz at alaska.edu> wrote:

> The config below for a single server configured to trust a single imported
> server cert works (with needed assist from Daniel Fisher).
> There seem to be at least two conceivable routes to add redundancy:
>
> (A) "stacked" login modules for multiple AD server instances:
>  edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>  ldapUrl="ldap://ad02.ua.ad.alaska.edu:3268"
>  …
>  edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>  ldapUrl="ldap://ad03.ua.ad.alaska.edu:3268"
>  ..., or
>
> (B) "failover" configuration with multiple server instances in a single
> module:
>  edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>  ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3268 ldap://
> fbk-adua03.ua.ad.alaska.edu:3268"
>
> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/????}"
>

I think your own experience would indicate that (A) is the preferred
option. Failover (B) only fails over on *connection* failures. Other types
of failure modes that may be important to you won't cause the next host to
be tried. Stacked modules should be tried in order until authentication
succeeds.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130731/911fb502/attachment-0001.html