StartTLS vs SSL?

[Derp Niner]

good, thanks!

On Thu, Apr 2, 2015 at 4:54 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Derp Niner <derpniner at gmail.com> [2015-04-02 03:03]:
>> I would like to know which one is preferred (and why if you have a
>> few minutes to explain).
>
> The question of LDAPs vs LDAP+StartTLS is not related to Shibboleth
> more than to, say, phpBB or any other software that also supports
> LDAP.
> And there are many aspects to this, some more academic than others
> (e.g. IANA not wanting to define two ports for each protocol, one
> plain, the other SSL/TLS-wrapped), some purely practical (many vendor
> products only support LDAPS, making the question moot for deployers
> stuck with such a product), some claim differences in trust model or
> attack vectors, etc.
>
> One simple answer is that there is no specification for LDAPS, it's
> only a de facto "standard".
> OTOH the LDAP Technical Specifications (RFC4510) also contain RFC4513
> which has an implementation requirement for StartTLS if you wanted to
> support Simple binds (not SASL authn method).
> So if you cared about Internet Standards you have your answer.
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net