Shib IDP's LDAPS attribute resolution and SSLv3

[Wessel, Keith]

Thanks for testing and getting back on this so quickly, Daniel. I've forwarded your very reasonable theory on to our AD team. We'll see what we find out and, if it's something interesting, I'll report back here.

Thanks,
Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Thursday, October 16, 2014 1:01 PM
To: Shib Users
Subject: Re: Shib IDP's LDAPS attribute resolution and SSLv3

On Wed, Oct 15, 2014 at 11:50 PM, Daniel Fisher <dfisher at vt.edu> wrote:
> On Wed, Oct 15, 2014 at 3:56 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> On 10/15/14, 3:30 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:
>>
>>>Hi, all,
>>>
>>>Our AD folks just turned off SSLv3 support on our AD LDAPS service. Shib
>>>didn¹t like it.
>>
>> A little quick searching implies to me that the
>> java.naming.security.protocol JNDI property is what controls this in Java,
>> and the only value it appears to have is ssl [1]. Which probably means it
>> doesn't support TLS.
>>
>> There is no actual standard for running LDAP over SSL, and I think the way
>> TLS is handled is with StartTLS, and that's probably why Java doesn't
>> support it.
>>
>> Daniel probably knows the specifics, but offhand I'd say it's apparently
>> time to dump ldaps or somebody will need to complain to Oracle.
>>
>
> You should be able to use either the SSLv3 or TLSv1 protocols with
> LDAPS or startTLS.
> I'll do some more testing tomorrow to confirm.
> We're considering disabling SSLv3 support on our directories as well.
>

We tested an instance of OpenLDAP with SSLv3 disabled.
I was able to use both startTLS and LDAPS using TLSv1 on Java 6 with JNDI.

It's worth noting that with OpenSSL there are at least two ways to
restrict the use of SSLv3.
You can set the supported protocol version, but you can also set the
supported cipher suites.
If you choose to set cipher suites to something like: HIGH:MEDIUM:-SSLv2:-SSLv3
You may also restrict the use of TLSv1 if you've only left ciphers
supported by TLSv1.1/1.2

The AD configuration that started this thread may have inadvertently
done more than disable the SSLv3 protocol.
We certainly had issues with both Java 6 and 7 with a restricted list
of supported cipher suites.

--Daniel Fisher
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net