Certificate practices using IdP with MS AD LDAP

[David Bantz]

On Tue, 25 Jun 2013, at 18:37 , Daniel Fisher <dfisher at vt.edu> wrote:

> On Tue, Jun 25, 2013 at 1:15 PM, David Bantz <dabantz at alaska.edu> wrote:

> ... in our IdP I do already have a non-AD LDAP in parallel to the AD authenticator with both as "sufficient."    The non-AD LDAP is an 8-node cluster, but the AD instances are not clustered, so I have to specify individual servers, which I've been doing with 
> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>     ldapUrl="ldap://ad01.ua.ad.alaska.edu:3269 ldap://ad02.ua.ad.alaska.edu:3269"
>   	  ...
> 
> I'm still unclear on your configuration.  You're specifying failover hosts in the ldapUrl parameter and you're putting trust material for only the first host in a file that is specified with sslSocketFactory="{trustCertificates=file:/path/to/my/trust.crt}" ? Is that correct?

My existing production config is failover in the ldapUrl parameter without any sslSocketFactory statement, relying on certificate signed by known CA (Comodo) for the AD server(s).  The AD server group going forward will use only the certificates from the MS (private) CA, so I need a revised configuration that will utilize those new certificates issued by the private CA.  So far, I have a revised configuration in test mode for a single server with sslSociketFactory trusting a certificate.  But of course I would like failover server(s) as well as trust of imported certificates.  

> 
> --Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130625/e9399817/attachment-0001.html