Certificate practices using IdP with MS AD LDAP

[Peter Schober]

* Glenn Wearen <glenn.wearen at heanet.ie> [2013-06-25 15:33]:
> I hit this issue a few weeks ago, I tried switching off SSL hostname
> checks but ended up having to switch to plain ldap as  the IdP (or
> the vt ldap library) assumed that the cert offered on AD server 1
> should also be trusted on AD server 2 and rejects the cert offered
> by AD server 2.

Before sending all subjects' passwords in the clear (which might not
be such an issue on a switched network you tighly control access to)
consider stacking several modules with the "sufficient" flag[1], one
for each server.
Or maybe switch to the Krb5LoginModule, maybe that will be less of an
issue with your authn provider?
-peter

[1] http://docs.oracle.com/javase/6/docs/api/javax/security/auth/login/Configuration.html