Certificate practices using IdP with MS AD LDAP

[Daniel Fisher]

On Wed, Jun 26, 2013 at 1:24 AM, David Bantz <dabantz at alaska.edu> wrote:

>
> On Tue, 25 Jun 2013, at 18:37 , Daniel Fisher <dfisher at vt.edu> wrote:
>
> On Tue, Jun 25, 2013 at 1:15 PM, David Bantz <dabantz at alaska.edu> wrote:
>
>
> ... in our IdP I do already have a non-AD LDAP in parallel to the AD
>> authenticator with both as "sufficient."    The non-AD LDAP is an 8-node
>> cluster, but the AD instances are not clustered, so I have to specify
>> individual servers, which I've been doing with
>>  edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>>     ldapUrl="ldap://ad01.ua.ad.alaska.edu:3269
>> ldap://ad02.ua.ad.alaska.edu:3269"
>>     ...
>>
>
> I'm still unclear on your configuration.  You're specifying failover hosts
> in the ldapUrl parameter and you're putting trust material for only the
> first host in a file that is specified with sslSocketFactory="{
> trustCertificates=file:/path/to/my/trust.crt}" ? Is that correct?
>
>
> My existing production config is failover in the ldapUrl parameter without
> any sslSocketFactory statement, relying on certificate signed by known CA
> (Comodo) for the AD server(s).  The AD server group going forward will use
> only the certificates from the MS (private) CA, so I need a revised
> configuration that will utilize those new certificates issued by the
> private CA.  So far, I have a revised configuration in test mode for a
> single server with sslSociketFactory trusting a certificate.  But of course
> I would like failover server(s) as well as trust of imported certificates.
>
>
So you should be able to put *all* your trust material in the trust.crt
file for this to work, however I notice that you are using the GC port
3269. Can you switch to port 3268 and use startTLS?
The SSL socket factory configuration for LDAPS is a bit more involved.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130626/696457b0/attachment.html