Shib IDP's LDAPS attribute resolution and SSLv3

[Wessel, Keith]

That's startTLS, not TLS protocol negocaton during the connection establishment. I'm hoping that also works on AD, trying it now.

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Charles Hedrick
Sent: Wednesday, October 15, 2014 3:26 PM
To: Shib Users
Subject: Re: Shib IDP's LDAPS attribute resolution and SSLv3

I didn't set up our LDAP support initially, but it appears to use TLS. I guess it's possible that it doesn't actually work.

jaas.conf
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://ldap.rutgers.edu ldap://ldap2.rutgers.edu"
      base="ou=people,dc=rutgers,dc=edu"
      tls="true"
      userField="uid"
      serviceUser="xxxx"
      serviceCredential="xxxx";


attribute-resolver.xml
    <resolver:DataConnector xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        id="myLDAP"
        ldapURL="ldap://ldap.rutgers.edu ldap://ldap2.rutgers.edu"
            baseDN="ou=people,dc=rutgers,dc=edu"
        principal="xxxx"
        principalCredential="xxxx"
            useStartTLS="true">
        <FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </FilterTemplate>
    </resolver:DataConnector>

On Oct 15, 2014, at 4:10 PM, Christopher Bongaarts <cab at umn.edu<mailto:cab at umn.edu>> wrote:


On 10/15/2014 2:56 PM, Cantor, Scott wrote:

A little quick searching implies to me that the
java.naming.security.protocol JNDI property is what controls this in Java,
and the only value it appears to have is ssl [1]. Which probably means it
doesn't support TLS.

There is no actual standard for running LDAP over SSL, and I think the way
TLS is handled is with StartTLS, and that's probably why Java doesn't
support it.

Daniel probably knows the specifics, but offhand I'd say it's apparently
time to dump ldaps or somebody will need to complain to Oracle.

The underlying JSSE support is there (in JDK6 for TLS1.1, JDK7 for
TLS1.2), so it might just be a matter of figuring out where to tweak
those settings... it's tricky here since we have multiple layers
involved (VT-ldap, JNDI, JSSE; plus repeat for the JAAS login handler if
you're using it).

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu<mailto:cab at umn.edu>          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141015/86473216/attachment-0001.html