A Question for people deploying LDAP based Attribute resolution

[Wessel, Keith]

Our LDAP server has a cert signed by InCommon, so we don't specify a cert for startTLS trust. The chain gets resolved.

Authentication uses username/password, not a cert.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: Friday, September 09, 2016 9:36 AM
To: Shib Users <users at shibboleth.net>
Subject: A Question for people deploying LDAP based Attribute resolution

TLDR:
How many people use anything other than X509ResourceBacked to secure their
LDAP connection and if so what do they use?

Long version:

I'm looking for some user feedback on a simplification I am going to
introduce with 3.3 whereby 

<resolver:DataConnector type="dc:LDAPDirectory" ....>

  <dc:StartTLSTrustCredential xsi:type="sec:X509ResourceBacked"...>
     <sec: Certificate>/dir/file.xml</sec:Certificate>
  </dc:StartTLSTrustCredential>

Will become 

<DataConnector type="LDAPDirectory"  trustFile="/dir/file.xml">

In a similar manner to the way that we simplified configuring the
SignatureValidation metadata filter in 3.0.

Just as in that case the old style will still be there and supported for all
3.x versions (and very possibly beyond).

My questions are:
      -  Do you use something other than "sec:X509ResourceBacked" to specify
the StartTLSTrustCredential?
      - Do you use the StartTLSAuthenticationCredential and if so what sec:
type do you use?

If you can respond here I'll collate the answers and make a call on how much
work to do.

Thanks

Rod


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net