Shib IDP's LDAPS attribute resolution and SSLv3

[Charles Hedrick]

I didn’t set up our LDAP support initially, but it appears to use TLS. I guess it’s possible that it doesn’t actually work.

jaas.conf
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://ldap.rutgers.edu ldap://ldap2.rutgers.edu"
      base="ou=people,dc=rutgers,dc=edu"
      tls="true"
      userField="uid"
      serviceUser=“xxxx"
      serviceCredential=“xxxx";


attribute-resolver.xml
    <resolver:DataConnector xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        id="myLDAP"
        ldapURL="ldap://ldap.rutgers.edu ldap://ldap2.rutgers.edu"
	baseDN="ou=people,dc=rutgers,dc=edu"
        principal=“xxxx"
        principalCredential=“xxxx"
	useStartTLS="true">
        <FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </FilterTemplate>
    </resolver:DataConnector>


On Oct 15, 2014, at 4:10 PM, Christopher Bongaarts <cab at umn.edu> wrote:

> On 10/15/2014 2:56 PM, Cantor, Scott wrote:
>> A little quick searching implies to me that the
>> java.naming.security.protocol JNDI property is what controls this in Java,
>> and the only value it appears to have is ssl [1]. Which probably means it
>> doesn't support TLS.
>> 
>> There is no actual standard for running LDAP over SSL, and I think the way
>> TLS is handled is with StartTLS, and that's probably why Java doesn't
>> support it.
>> 
>> Daniel probably knows the specifics, but offhand I'd say it's apparently
>> time to dump ldaps or somebody will need to complain to Oracle.
> 
> The underlying JSSE support is there (in JDK6 for TLS1.1, JDK7 for 
> TLS1.2), so it might just be a matter of figuring out where to tweak 
> those settings... it's tricky here since we have multiple layers 
> involved (VT-ldap, JNDI, JSSE; plus repeat for the JAAS login handler if 
> you're using it).
> 
> -- 
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141015/3002be90/attachment.html