Changes between Version 24 and Version 25 of ConnectorsSetup

Timestamp:

07/30/13 10:02:01 (11 years ago)

Author:

dabantz@…

Comment:

--

ConnectorsSetup

@@ -43 +43 @@
 (2) Configure the IdP to directly trust these certificates: (2.1) for authN and (2.2) for retrieving attributes from the LDAP directory [these are independent]:
 
- (2.1) Configure the authentication module to trust the AD certificate by adding to the configuration in ''$IDP_HOME''/conf/login.config a line like (per Daniel Fisher <dfisher@vt.edu> 2013-04-24):
+ (2.1) Configure the authentication module to trust the AD certificate by adding to the configuration in ''$IDP_HOME''/conf/login.config a line like (per Daniel Fisher <dfisher@vt.edu> 2013-04-24 and 2013-07-30):
 
   {{{
-  sslSocketFactory="{trustCertificates=file:/path/to/my/trust.crt}"
+// UA AD Auth
+   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
+      ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3268"
+      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
+      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
+      bindCredential="••••••••••"
+      subtreeSearch="true"
+// Directly reference imported server certificate for TLS on 3268 rather than SSL on 3269
+      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"
+      ssl="false"
+      tls="true"
+      userField="sAMAccountName,uaIdentifier";
+
   }}}
  (2.2) Configure the Data Connectors in '$IDP_HOME''/conf/attribute-resolver.xml to use StartTLSTrustCredential.  https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnector