Certificate practices using IdP with MS AD LDAP

[Daniel Fisher]

On Tue, Jun 25, 2013 at 1:15 PM, David Bantz <dabantz at alaska.edu> wrote:

>
> On Tue, 25 Jun 2013, at 06:18 , Peter Schober <peter.schober at univie.ac.at>
> wrote:
>
> Before sending all subjects' passwords in the clear (which might not
> be such an issue on a switched network you tighly control access to)
> consider stacking several modules with the "sufficient" flag[1], one
> for each server.*
>
>
> That would definitely be my choice.  And in our IdP I do already have a
> non-AD LDAP in parallel to the AD authenticator with both as "sufficient."
>    The non-AD LDAP is an 8-node cluster, but the AD instances are not
> clustered, so I have to specify individual servers, which I've been doing
> with
> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>     ldapUrl="ldap://ad01.ua.ad.alaska.edu:3269
> ldap://ad02.ua.ad.alaska.edu:3269"
>     ...
>

I'm still unclear on your configuration.  You're specifying failover hosts
in the ldapUrl parameter and you're putting trust material for only the
first host in a file that is specified with sslSocketFactory="{
trustCertificates=file:/path/to/my/trust.crt}" ? Is that correct?

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130625/e8f719e8/attachment.html