LDAP referrals and StartTLS

[Wessel, Keith]

Thanks, Daniel and Peter. I’ll file the “feature” request tomorrow.

I view it more as a bug because, had my AD allowed passwords over an unencrypted channel, the follow-up query would have succeeded. But because I had startTLS enabled for the data connector, I would have assumed that _all_ connections would be encrypted. One could easily be sending their credentials in the clear and not know it.

I understand where you’re coming from, but in my mind, this seems like a security risk.

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Tuesday, January 06, 2015 9:11 PM
To: Shib Users
Subject: Re: LDAP referrals and StartTLS

On Tue, Jan 6, 2015 at 5:13 PM, Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>> wrote:
Absolutely. I had our AD admin look and, sure enough, we're seeing a simple auth over an unencrypted channel just after the initial query. The initial query is working properly, doing a simple auth over the StartTLS-encrypted channel.

Seems like a bug, probably in the edu.vt.ldap library. Where should I report it?

It's more of a feature request. You can file it here: https://github.com/vt-middleware/ldaptive
The problem is that startTLS isn't something that is communicated in the continuation reference, so you'd have to follow the referral manually to do what you want.
There is no functionality in vt-ldap to do that and it's more likely to get added for IDP 3.x.

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150107/9d8524de/attachment-0001.html