Shibboleth Identity Provider Security Advisory [4 October 2017]

[Michael A Grady]

> On Nov 15, 2017, at 7:02 PM, Baron Fujimoto <baron at hawaii.edu> wrote:
> 
> One (*interim?) option is to point the LDAP connector at a file containing
> the LDAP host's CA in it via the trustFile attribute. But this file should
> not be the CA cert bundle (because security). So we should extract the
> LDAP host's CA into a not-Java-CA-cert-bundle file and reference that with
> trustFile instead.


Why would you want a "bundle of CAs"? There is one and only one CA at the root of the LDAP server cert, and that is the only one you need to trust if you are going to put the CA root cert in that file. Presumably your institution has a consistent CA it uses, and would not change lightly or without notification. (In which case you add a second CA cert to that file, to cover the transition.)

The LDAP server should be serving out not only its server cert, but all needed intermediate certs. If it isn't doing that today, then that should change. You should only need one and only one cert in that file, the Root CA. (Unless they use a self-signed cert, in which case all you need/want is a copy of that in the file.)

I prefer to put the PEM formatted cert into that file, but I'm not sure if that is the only format that will work with that trustFile attribute.

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171115/acad8dbd/attachment-0001.html>