Shib IDP's LDAPS attribute resolution and SSLv3

[Wessel, Keith]

If someone does find the options, I'd love to know about them.

In the meantime, it appears that recent versions of AD are happy supporting starttls on port 389, and that may have to do.

If anyone knows a way to change the sasl mechanism used by the LDAP library to gssapi, our AD admins would prefer I do what I said earlier: Kerberos authentication over the cleartext channel. Personally, this feels like more that could break moving forward than just using startTLS.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Wednesday, October 15, 2014 3:11 PM
To: users at shibboleth.net
Subject: Re: Shib IDP's LDAPS attribute resolution and SSLv3

On 10/15/2014 2:56 PM, Cantor, Scott wrote:
> A little quick searching implies to me that the
> java.naming.security.protocol JNDI property is what controls this in Java,
> and the only value it appears to have is ssl [1]. Which probably means it
> doesn't support TLS.
>
> There is no actual standard for running LDAP over SSL, and I think the way
> TLS is handled is with StartTLS, and that's probably why Java doesn't
> support it.
>
> Daniel probably knows the specifics, but offhand I'd say it's apparently
> time to dump ldaps or somebody will need to complain to Oracle.

The underlying JSSE support is there (in JDK6 for TLS1.1, JDK7 for 
TLS1.2), so it might just be a matter of figuring out where to tweak 
those settings... it's tricky here since we have multiple layers 
involved (VT-ldap, JNDI, JSSE; plus repeat for the JAAS login handler if 
you're using it).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net