LDAP referrals and StartTLS

[Daniel Fisher]

On Tue, Jan 6, 2015 at 10:22 PM, Wessel, Keith <kwessel at illinois.edu> wrote:

>  Thanks, Daniel and Peter. I’ll file the “feature” request tomorrow.
>
>
>
> I view it more as a bug because, had my AD allowed passwords over an
> unencrypted channel, the follow-up query would have succeeded. But because
> I had startTLS enabled for the data connector, I would have assumed that _
> *all*_ connections would be encrypted. One could easily be sending their
> credentials in the clear and not know it.
>
>
>
> I understand where you’re coming from, but in my mind, this seems like a
> security risk.
>

It certainly is, but it feels like a misconfiguration rather than a bug.
Your directory is sending referrals and you've configured the IDP to follow
them, but I don't want to argue semantics.
How do you think this should work?
My first thought was to provide a component like StartTLSReferralHandler
that you would have to configure, it would attempt to startTLS on any
referrals.
One of the problems with relying on referrals is that you don't benefit
from connection pooling, that may be a feature worth adding as well.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150107/7e2f012a/attachment.html