LDAP referrals and StartTLS

[Wessel, Keith]

Daniel,

IMHO, any connection to a referral should work the same as the initial connection. The same credentials are used, correct? Why not also use the same communications settings? And yes, pooling as well.

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Wednesday, January 07, 2015 10:15 AM
To: Shib Users
Subject: Re: LDAP referrals and StartTLS

On Tue, Jan 6, 2015 at 10:22 PM, Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>> wrote:
Thanks, Daniel and Peter. I’ll file the “feature” request tomorrow.

I view it more as a bug because, had my AD allowed passwords over an unencrypted channel, the follow-up query would have succeeded. But because I had startTLS enabled for the data connector, I would have assumed that _all_ connections would be encrypted. One could easily be sending their credentials in the clear and not know it.

I understand where you’re coming from, but in my mind, this seems like a security risk.

It certainly is, but it feels like a misconfiguration rather than a bug.
Your directory is sending referrals and you've configured the IDP to follow them, but I don't want to argue semantics.
How do you think this should work?
My first thought was to provide a component like StartTLSReferralHandler that you would have to configure, it would attempt to startTLS on any referrals.
One of the problems with relying on referrals is that you don't benefit from connection pooling, that may be a feature worth adding as well.

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150107/44c4ce86/attachment.html