Shib IDP's LDAPS attribute resolution and SSLv3

[Wessel, Keith]

Correct. I thought this might be completely different, but I was hopeful that authentication was authentication. I've put my vote in here for startTLS since all it took was removing the s from ldaps:// and adding useStartTLS="true" to the data connector definition. Hopefully, that'll be what we do. Not only is it easier to do, but it'll keep query responses from coming across unencrypted.

Keith

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, October 15, 2014 3:55 PM
To: Shib Users
Subject: Re: Shib IDP's LDAPS attribute resolution and SSLv3

On 10/15/14, 4:50 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

> Thanks, Scott and Paul. That page talks extensively about adding GSSAPI
>authentication to JAAS, but would
> I just pass the same options to the library inside my LDAP data
>connector definition?

I have absolutely no idea. Using SASL with LDAP is very complex. I doubt
you could do it right now, you'd need to be able to configure lots of
underlying behavior in the LDAP client.

Using Kerberos to authenticate to AD is totally unrelated. That has
nothing to do with securing LDAP binds, which is what you're asking about.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net