Shib IDP's LDAPS attribute resolution and SSLv3

[Caskey, Paul]

FWIW, we've been doing Kerberos to AD using shibb for a while now, works fine (no pre-auth however).



> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Wessel, Keith
> Sent: Wednesday, October 15, 2014 3:42 PM
> To: Shib Users
> Subject: RE: Shib IDP's LDAPS attribute resolution and SSLv3
> 
> If someone does find the options, I'd love to know about them.
> 
> In the meantime, it appears that recent versions of AD are happy supporting
> starttls on port 389, and that may have to do.
> 
> If anyone knows a way to change the sasl mechanism used by the LDAP
> library to gssapi, our AD admins would prefer I do what I said earlier:
> Kerberos authentication over the cleartext channel. Personally, this feels like
> more that could break moving forward than just using startTLS.
> 
> Keith
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
> Sent: Wednesday, October 15, 2014 3:11 PM
> To: users at shibboleth.net
> Subject: Re: Shib IDP's LDAPS attribute resolution and SSLv3
> 
> On 10/15/2014 2:56 PM, Cantor, Scott wrote:
> > A little quick searching implies to me that the
> > java.naming.security.protocol JNDI property is what controls this in
> > Java, and the only value it appears to have is ssl [1]. Which probably
> > means it doesn't support TLS.
> >
> > There is no actual standard for running LDAP over SSL, and I think the
> > way TLS is handled is with StartTLS, and that's probably why Java
> > doesn't support it.
> >
> > Daniel probably knows the specifics, but offhand I'd say it's
> > apparently time to dump ldaps or somebody will need to complain to
> Oracle.
> 
> The underlying JSSE support is there (in JDK6 for TLS1.1, JDK7 for TLS1.2), so it
> might just be a matter of figuring out where to tweak those settings... it's
> tricky here since we have multiple layers involved (VT-ldap, JNDI, JSSE; plus
> repeat for the JAAS login handler if you're using it).
> 
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
> 
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net