Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of elecharny@gmail.com
 designates 209.85.215.50 as permitted sender)
Message-ID: <50B4D036.2030008@gmail.com>
Date: Tue, 27 Nov 2012 15:37:42 +0100
From: =?UTF-8?B?RW1tYW51ZWwgTMOpY2hhcm55?= <elecharny@gmail.com>
Reply-To: elecharny@apache.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7;
 rv:17.0) Gecko/17.0 Thunderbird/17.0
MIME-Version: 1.0
To: users@directory.apache.org
Subject: Re: Configure LDAPS with 1x and 2x SSL on ApacheDS 2.0 M8
References: <009401cdc8df$9a0b0c90$ce2125b0$@dtechspace.com>
 <CABzFU-e9bhU9WsQD+fnOAZFXU=_532erTZemNO7xM9fH3oTrMw@mail.gmail.com>
 <000301cdcb8e$74a61b50$5df251f0$@dtechspace.com>
In-Reply-To: <000301cdcb8e$74a61b50$5df251f0$@dtechspace.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le 11/26/12 5:28 AM, Nick Duan a écrit :
> Thanks a lot for all your responses.   I am sorry to hear that client
> authentication using X.509 cert isn't implemented in Apache DS.   Is there
> any plan to implement this in future releases?  
Yes, definitively.
>  Could someone perhaps point
> out which class/package in ApacheDS is responsible for handling the SSL
> connection?
This is not that simple...

SSL is handle in two places in the server :
1) In MINA (the network layer) when you use LDAPS
2) In the apacheds/protocol-ldap module, in the StartTlsHandler class
when you use StartTLS instead of LDPAS.

All the handshake is done by MINA.

Currently we only use the NoVerificationTrustManager class, so it
accepts all the incoming clients.

We certinly want to improve this area. I have created a JIRA for that FYI.


-- 
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com