Changes between Version 25 and Version 26 of ConnectorsSetup

Timestamp:

07/31/13 14:31:22 (11 years ago)

Author:

dabantz@…

Comment:

--

ConnectorsSetup

@@ -60 +60 @@
 
   }}}
+
+For multiple server instances to provide connection fail-over, or simply to avoid importing and maintaining relatively short-lived server certificates, trust the issuing CA's certificate:
+ {{{
+
+// UA AD Auth
+   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
+      ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3268 ldap://fbk-adua03.ua.ad.alaska.edu:3268"
+      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
+      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
+      bindCredential="lkjhyuio87"
+      subtreeSearch="true"
+// Directly reference imported certificate for CA used to create/sign UA AD server certs 
+      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/UA_AD_CA.pem}"
+      ssl="false"
+      tls="true"
+      userField="sAMAccountName,uaIdentifier";
+
+ }}}
  (2.2) Configure the Data Connectors in '$IDP_HOME''/conf/attribute-resolver.xml to use StartTLSTrustCredential.  https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnector
 (additional input from Nate Klingenstein <Nate Klingenstein <ndk@internet2.edu> 2013-06-04):