Shib IDP's LDAPS attribute resolution and SSLv3

[Rhys Smith]

On 16 Oct 2014, at 07:50, Ian Young <ian at iay.org.uk> wrote:

> If you have a secure network between the server and all clients, that's true. However, in those circumstances you should feel equally safe without using SSL/TLS at all, no? If you don't feel that safe, you really need to disable SSLv3.

Well, having the confidence in your corporate network that your firewalls will light up and switch the ship to red alert when one machine (ldap client) is actively attacking another - pumping the LDAP server with enough packets to hit the right combination of bytes to trigger the padding bug - is somewhat different to the confidence required that there is nothing on the network passively listening to unencrypted traffic…

Anyway, just saying that waking up to find your Shib IdP no longer works because your directory admins have instantly turned off SSLv3 is probably overkill on their part, at the moment. We have time to make the switch after first doing some appropriate testing and reconfiguration where necessary… Orderly transition is good.

Rhys.
--
Dr Rhys Smith
Identity, Access, and Middleware Specialist
Cardiff University & Janet, the UK's research and education network

email: smith at cardiff.ac.uk / rhys.smith at ja.net
GPG: 0x4638C985

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20141016/4c96dcc7/attachment.bin