AD ports 389/636 vs 3268/3269 and LDAP referrals (from Shibb IdP)

[IAM David Bantz]

For years I've used the global catalog port 3268 with startTLS to connect
my IdP to our institutional Active Directory, on advice such as:

https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues

because in our AD "users are spread across multiple object[s]" (e.g.,
CN={username},OU=userAccounts,...OU=consultants
and others), which in that wiki page is the triggering condition for using
the global catalog.

My AD team strongly objected to my request to add a small number of
attributes to to the General Catalog, and scorned the advice I cited in
that wiki page as my justification for relying on the global catalog. They
requested I re-configure the IdP for what they describe as "normal" LDAP
searches (port 389/636).

Yielding to the inevitable, I have tested the port switched from 3268 to
389 (with startTLS). An initial PoC using Apache Directory Browser seemed
to confirm the behavior described in our wiki page, presenting a modal
dialog for me to indicate a subsequent connection to use for referrals; but
after that inital request, searches returned all needed attributes. Trying
in the IdP attribute resolver itself, I was expecting to see some analog of
the referral connection request, but, on the contrary, changing the port in
the attribute resolver seems to have no impact. Shibb logs show a
connection and response with about 100 attributes in ~ 10 msec.

My question from this experience is whether this 2013 wiki page above needs
clarification or revision. My AD folks suggest the need for general catalog
should arise only if users are spread across multiple *domains*, not merely
multiple OUs within a single domain. Or perhaps the *default behavior* of
the LDAP library has changed to by default follow referrals?

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180107/b762bc76/attachment.html>