A Question for people deploying LDAP based Attribute resolution

[ROGERS Richard M]

   My questions are:
      -  Do you use something other than "sec:X509ResourceBacked" to specify the StartTLSTrustCredential?

No, sec:X509ResourceBacked it is

      - Do you use the StartTLSAuthenticationCredential and if so what sec: type do you use?
No

Regards

Richard

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: 09 September 2016 15:36
To: Shib Users <users at shibboleth.net>
Subject: A Question for people deploying LDAP based Attribute resolution

TLDR:
How many people use anything other than X509ResourceBacked to secure their LDAP connection and if so what do they use?

Long version:

I'm looking for some user feedback on a simplification I am going to introduce with 3.3 whereby 

<resolver:DataConnector type="dc:LDAPDirectory" ....>

  <dc:StartTLSTrustCredential xsi:type="sec:X509ResourceBacked"...>
     <sec: Certificate>/dir/file.xml</sec:Certificate>
  </dc:StartTLSTrustCredential>

Will become 

<DataConnector type="LDAPDirectory"  trustFile="/dir/file.xml">

In a similar manner to the way that we simplified configuring the SignatureValidation metadata filter in 3.0.

Just as in that case the old style will still be there and supported for all 3.x versions (and very possibly beyond).

My questions are:
      -  Do you use something other than "sec:X509ResourceBacked" to specify the StartTLSTrustCredential?
      - Do you use the StartTLSAuthenticationCredential and if so what sec:
type do you use?

If you can respond here I'll collate the answers and make a call on how much work to do.

Thanks

Rod


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net