Shibboleth Identity Provider Security Advisory [4 October 2017]

[Baron Fujimoto]

On Tue, Nov 07, 2017 at 09:01:05PM -0600, Michael A Grady wrote:
>
>> On Nov 7, 2017, at 8:57 PM, Baron Fujimoto <baron at hawaii.edu> wrote:
>> 
>>> Shibboleth Identity Provider Security Advisory [4 October 2017]
>>> 
>>> [...]
>>> 
>>> Recommendations
>>> ===============
>>> All deployers affected should take at least one, and preferably both,
>>> of the following steps:
>>> 
>>> [...]
>>> 2. Copy the server's certificate (or more typically a CA) to a file
>>> and reference it with the trustFile attribute.
>> 
>> Forgive the dumb question, but for the trustFile server certificate
>> referenced above in 2), which server is that? The IdP's X.509 cert?
>
>No, the LDAP server's cert (or CA for that cert is often the better choice.)

Hmm, does that make it fragile in the sense that we have to be cognizant
of the LDAP server's expirations and such (if using just the LDAP server's
cert)?

By CA, do you mean just the root cert for the CA issuing the LDAP server's
cert, or a cert that encompasses some or all of the certificate chain?
Even there, do we need to worry about expiration of any of the CA certs?

I suppose if we upgrade to V3.3.2 before any of the aforementioned
certificate expirations, it's probably moot since the underlying problem
get's resolved by the underlying ldap component fix?

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum