<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br><div><div>On Tue, 25 Jun 2013, at 06:18 , Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">Before sending all subjects' passwords in the clear (which might not</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">be such an issue on a switched network you tighly control access to)</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">consider stacking several modules with the "sufficient" flag[1], one</span><br style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">for each server.*</span></blockquote></div><br></div><div>That would definitely be my choice. And in our IdP I do already have a non-AD LDAP in parallel to the AD authenticator with both as "sufficient." The non-AD LDAP is an 8-node cluster, but the AD instances are not clustered, so I have to specify individual servers, which I've been doing with <br><div><span style="background-color: rgb(255, 255, 255); "><font face="Andale Mono">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></span></div><div><span style="background-color: rgb(255, 255, 255); "><font face="Andale Mono"> ldapUrl="<a href="ldap://ad01.ua.ad.alaska.edu:3269">ldap://ad01.ua.ad.alaska.edu:3269</a> <a href="ldap://ad02.ua.ad.alaska.edu:3269">ldap://ad02.ua.ad.alaska.edu:3269</a>"</font></span></div></div><div style="font-size: 11px; "> <span class="Apple-tab-span" style="white-space:pre"> </span> ...</div><div>If I instead include two or more modules,</div><div><br></div><div><span style="background-color: rgb(255, 255, 255); "><font face="Andale Mono">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></span></div><div><font face="Andale Mono"><span style="background-color: rgb(255, 255, 255); "><span class="Apple-tab-span" style="white-space:pre"> </span></span><span style="background-color: rgb(255, 255, 255); ">ldapUrl="<a href="ldap://ad01.ua.ad.alaska.edu:3269">ldap://ad01.ua.ad.alaska.edu:3269</a>"</span></font></div><div><font face="Andale Mono"><span style="background-color: rgb(255, 255, 255); "><span class="Apple-tab-span" style="white-space:pre"> </span></span>…</font></div><div><div><span style="background-color: rgb(255, 255, 255); "><font face="Andale Mono">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></span></div><div><font face="Andale Mono"><span style="background-color: rgb(255, 255, 255); "><span class="Apple-tab-span" style="white-space: pre; "> </span></span><span style="background-color: rgb(255, 255, 255); ">ldapUrl="<a href="ldap://ad02.ua.ad.alaska.edu:3269">ldap://ad02.ua.ad.alaska.edu:3269</a>"</span></font></div><div><span style="background-color: rgb(255, 255, 255); "><span class="Apple-tab-span" style="white-space:pre"> </span>...</span></div><div><span style="background-color: rgb(255, 255, 255); ">what is the user experience if, say ad01 becomes unavailable or its certificate invalid? </span></div></div><div><span style="background-color: rgb(255, 255, 255); ">Is it qualitatively different than the stacked Url's in the current configuration?</span></div><div><span style="background-color: rgb(255, 255, 255); ">Are there good reasons to prefer one to the other (apart from the current one not supporting explicitly referenced certificate)?</span></div><div><span style="background-color: rgb(255, 255, 255); "><br></span></div><div><span style="background-color: rgb(255, 255, 255); ">David Bantz</span></div><div><span style="background-color: rgb(255, 255, 255); "><br></span></div></body></html>