LDAP SSL with it's own JKS on IDP?

[Daniel Fisher]

On Fri, Nov 1, 2013 at 10:48 AM, Byte Flinger <byteflinger at gmail.com> wrote:

> And I am guessing there is no way to change that in a simple way like you
> can do with login.config file without rewriting a whole new connector? If
> that's the case then it unfortunately makes the suggestion above invalid
> since we'd still have to add the certificates to the java store.
>

I suggested using ldaptive for JAAS because vt-ldap needs to use a
singleton to store the SSLContext configuration for your use case and I
didn't want it stomping on the resolver configuration.
Try adding this to your resolver configuration:

<LDAPProperty name="edu.vt.middleware.ldap.ssl" value="true"/>
<LDAPProperty
  name="edu.vt.middleware.ldap.sslSocketFactory"

value="edu.vt.middleware.ldap.ssl.SingletonTLSSocketFactory{edu.vt.middleware.ldap.ssl.KeyStoreCredentialConfig{{trustStore=file:/path/to/my/truststore}}}"/>

and then use the ldaptive JAAS configuration I posted earlier.
This should allow you to configure truststore locations for both login and
attribute resolution.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131104/52a41c3e/attachment.html