StartTLS vs SSL?

[Peter Schober]

* Derp Niner <derpniner at gmail.com> [2015-04-02 03:03]:
> I would like to know which one is preferred (and why if you have a
> few minutes to explain).

The question of LDAPs vs LDAP+StartTLS is not related to Shibboleth
more than to, say, phpBB or any other software that also supports
LDAP.
And there are many aspects to this, some more academic than others
(e.g. IANA not wanting to define two ports for each protocol, one
plain, the other SSL/TLS-wrapped), some purely practical (many vendor
products only support LDAPS, making the question moot for deployers
stuck with such a product), some claim differences in trust model or
attack vectors, etc.

One simple answer is that there is no specification for LDAPS, it's
only a de facto "standard".
OTOH the LDAP Technical Specifications (RFC4510) also contain RFC4513
which has an implementation requirement for StartTLS if you wanted to
support Simple binds (not SASL authn method).
So if you cared about Internet Standards you have your answer.
-peter