Shib IDP's LDAPS attribute resolution and SSLv3

[Christopher Bongaarts]

On 10/15/2014 2:56 PM, Cantor, Scott wrote:
> A little quick searching implies to me that the
> java.naming.security.protocol JNDI property is what controls this in Java,
> and the only value it appears to have is ssl [1]. Which probably means it
> doesn't support TLS.
>
> There is no actual standard for running LDAP over SSL, and I think the way
> TLS is handled is with StartTLS, and that's probably why Java doesn't
> support it.
>
> Daniel probably knows the specifics, but offhand I'd say it's apparently
> time to dump ldaps or somebody will need to complain to Oracle.

The underlying JSSE support is there (in JDK6 for TLS1.1, JDK7 for 
TLS1.2), so it might just be a matter of figuring out where to tweak 
those settings... it's tricky here since we have multiple layers 
involved (VT-ldap, JNDI, JSSE; plus repeat for the JAAS login handler if 
you're using it).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%