LDAP referrals and StartTLS

[Peter Schober]

* Wessel, Keith <kwessel at illinois.edu> [2015-01-06 04:53]:
> I'm guessing that it only does StartTLS on the initial connection
> and, because our AD instance won't allow authentication over
> clear-text LDAP, the authentication to the referred connection
> fails.

At the danger of stating the obvious: The LDAP DSA's logs should tell
you that. Lacking those a network trace will also do, e.g. taken with
tcpdump on the machine hosting the IDP (for all outgoing traffic to
the ports used by your DSA deployment). Then feed the trace to a
protocol analzyer (such as wireshark) and you'll see whether any
non-TLS connections are being made, as well as their content.
-peter