Shib IDP's LDAPS attribute resolution and SSLv3

[Daniel Fisher]

On Wed, Oct 15, 2014 at 3:56 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/15/14, 3:30 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>
>>Hi, all,
>>
>>Our AD folks just turned off SSLv3 support on our AD LDAPS service. Shib
>>didn¹t like it.
>
> A little quick searching implies to me that the
> java.naming.security.protocol JNDI property is what controls this in Java,
> and the only value it appears to have is ssl [1]. Which probably means it
> doesn't support TLS.
>
> There is no actual standard for running LDAP over SSL, and I think the way
> TLS is handled is with StartTLS, and that's probably why Java doesn't
> support it.
>
> Daniel probably knows the specifics, but offhand I'd say it's apparently
> time to dump ldaps or somebody will need to complain to Oracle.
>

You should be able to use either the SSLv3 or TLSv1 protocols with
LDAPS or startTLS.
I'll do some more testing tomorrow to confirm.
We're considering disabling SSLv3 support on our directories as well.

--Daniel Fisher