Shib IDP's LDAPS attribute resolution and SSLv3

[Cantor, Scott]

On 10/15/14, 3:30 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>Hi, all,
> 
>Our AD folks just turned off SSLv3 support on our AD LDAPS service. Shib
>didn¹t like it.

A little quick searching implies to me that the
java.naming.security.protocol JNDI property is what controls this in Java,
and the only value it appears to have is ssl [1]. Which probably means it
doesn't support TLS.

There is no actual standard for running LDAP over SSL, and I think the way
TLS is handled is with StartTLS, and that's probably why Java doesn't
support it.

Daniel probably knows the specifics, but offhand I'd say it's apparently
time to dump ldaps or somebody will need to complain to Oracle.

-- Scott

[1] 
http://docs.oracle.com/javase/7/docs/technotes/guides/jndi/jndi-ldap.html