A Question for people deploying LDAP based Attribute resolution

[IAM David Bantz]

>
>         <StartTLSTrustCredential xsi:type="security:X509ResourceBacked"
>                                  xmlns:security=
> "urn:mace:shibboleth:2.0:security"
>                                  id=".........">
>             <security:Certificate>/...CA.pem</security:Certificate>
>         </StartTLSTrustCredential>






On Fri, Sep 9, 2016 at 6:35 AM, Rod Widdowson <rdw at steadingsoftware.com>
wrote:

> TLDR:
> How many people use anything other than X509ResourceBacked to secure their
> LDAP connection and if so what do they use?
>
> Long version:
>
> I’m looking for some user feedback on a simplification I am going to
> introduce with 3.3 whereby
>
> <resolver:DataConnector type="dc:LDAPDirectory" ….>
>
>   <dc:StartTLSTrustCredential xsi:type="sec:X509ResourceBacked"…>
>      <sec: Certificate>/dir/file.xml</sec:Certificate>
>   </dc:StartTLSTrustCredential>
>
> Will become
>
> <DataConnector type="LDAPDirectory"  trustFile="/dir/file.xml">
>
> In a similar manner to the way that we simplified configuring the
> SignatureValidation metadata filter in 3.0.
>
> Just as in that case the old style will still be there and supported for
> all
> 3.x versions (and very possibly beyond).
>
> My questions are:
>       -  Do you use something other than “sec:X509ResourceBacked” to
> specify
> the StartTLSTrustCredential?
>       - Do you use the StartTLSAuthenticationCredential and if so what
> sec:
> type do you use?
>
> If you can respond here I’ll collate the answers and make a call on how
> much
> work to do.
>
> Thanks
>
> Rod
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160909/4cfdfd7f/attachment.html>