LDAP referrals and StartTLS

[Wessel, Keith]

Absolutely. I had our AD admin look and, sure enough, we're seeing a simple auth over an unencrypted channel just after the initial query. The initial query is working properly, doing a simple auth over the StartTLS-encrypted channel.

Seems like a bug, probably in the edu.vt.ldap library. Where should I report it?

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Tuesday, January 06, 2015 7:34 AM
To: users at shibboleth.net
Subject: Re: LDAP referrals and StartTLS

* Wessel, Keith <kwessel at illinois.edu> [2015-01-06 04:53]:
> I'm guessing that it only does StartTLS on the initial connection
> and, because our AD instance won't allow authentication over
> clear-text LDAP, the authentication to the referred connection
> fails.

At the danger of stating the obvious: The LDAP DSA's logs should tell
you that. Lacking those a network trace will also do, e.g. taken with
tcpdump on the machine hosting the IDP (for all outgoing traffic to
the ports used by your DSA deployment). Then feed the trace to a
protocol analzyer (such as wireshark) and you'll see whether any
non-TLS connections are being made, as well as their content.
-peter
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net