Certificate practices using IdP with MS AD LDAP

[David Bantz]

On Tue, 25 Jun 2013, at 06:18 , Peter Schober <peter.schober at univie.ac.at> wrote:

> Before sending all subjects' passwords in the clear (which might not
> be such an issue on a switched network you tighly control access to)
> consider stacking several modules with the "sufficient" flag[1], one
> for each server.*

That would definitely be my choice.  And in our IdP I do already have a non-AD LDAP in parallel to the AD authenticator with both as "sufficient."    The non-AD LDAP is an 8-node cluster, but the AD instances are not clustered, so I have to specify individual servers, which I've been doing with 
edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
    ldapUrl="ldap://ad01.ua.ad.alaska.edu:3269 ldap://ad02.ua.ad.alaska.edu:3269"
  	  ...
If I instead include two or more modules,

edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
	ldapUrl="ldap://ad01.ua.ad.alaska.edu:3269"
	…
edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
	ldapUrl="ldap://ad02.ua.ad.alaska.edu:3269"
		...
what is the user experience if, say ad01 becomes unavailable or its certificate invalid?  
Is it qualitatively different than the stacked Url's in the current configuration?
Are there good reasons to prefer one to the other (apart from the current one not supporting explicitly referenced certificate)?

David Bantz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130625/94cdd742/attachment-0001.html