Shibboleth Identity Provider Security Advisory [4 October 2017]

[Baron Fujimoto]

On Thu, Nov 09, 2017 at 08:21:25PM +0000, Cantor, Scott wrote:
>> Hmm, does that make it fragile in the sense that we have to be cognizant
>> of the LDAP server's expirations and such (if using just the LDAP server's
>> cert)?
>
>Not if it isn't expiring for no good reason.

I'm not sure I understand this. The certificates have a validity period and
eventually expire. Isn't that to be expected and neither good or bad?

>> By CA, do you mean just the root cert for the CA issuing the LDAP server's
>> cert, or a cert that encompasses some or all of the certificate chain?
>> Even there, do we need to worry about expiration of any of the CA certs?
>
>It's standard PKIX by default, it's the same as any client evaluating the trust chain of a server, like a browser and web server. You decide the trust anchor and everything that's below it has to be presented by the server.
>
>> I suppose if we upgrade to V3.3.2 before any of the aforementioned
>> certificate expirations, it's probably moot since the underlying problem
>> get's resolved by the underlying ldap component fix?
>
>We will no longer support this defaulting nonsense in the future, this is the last security bug we're going to fix on that. Trust cannot be automatic. You should fix it now and decide how you want or need to establish the validation.

Apologies if I'm not sufficiently versed on the the intricacies here, but
I am making my best effort to understand what mitigation options and
implications are. I feel like I don't really have enough context to
understand this. If there's IdP documentation that will give a better
grasp of this, I'd be happy if you could refer me to it. For instance,
based on your reply here, it's not clear to me if maintaining the LDAP
cert locally will be required going forward regardless of IdP updates as
a best practice, or whether 3.3.2 obviates that need in the future. On
what basis do we evaluate how we want or need to establish the validation?

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum