Syntax for referral in login.config

[Cantor, Scott]

On 10/31/14, 9:55 PM, "Christopher Bland" <chris at fdu.edu> wrote:
>
>Have been struggling with the syntax for querying Active Directory using
>ssl.  Currently getting a error which I believe is caused by the referral
>property.  I am configured like this
>
>ShibUserPassAuth {
>   edu.vt.middleware.ldap.jaas.LdapLoginModule required
>      host="<host>"
>      port="636"
>      base="<base>"
>      
>sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedserve
>rcerts/activedirectory.crt}"
>      ssl="false"
>      tls="true"
>      userField="userPrincipalName"
>      subtreeSearch="true"
>      referral="follow"
>      serviceUser="<service_user>"
>      serviceCredential="<password>";
>};

Can't say anything about referrals, but that looks a little odd to me, you
have ssl off, but startTLS on, but on the port usually used for ldaps.
Maybe that's still common, I don't know.

FWIW, I use an AD behind a NetScaler and there's no referral required,
which probably doesn't help you, but I thought I'd make sure it wasn't
something simpler.

-- Scott