Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of elecharny@gmail.com
 designates 74.125.82.44 as permitted sender)
Message-ID: <54D536AA.7030103@gmail.com>
Date: Fri, 06 Feb 2015 22:48:26 +0100
From: =?UTF-8?B?RW1tYW51ZWwgTMOpY2hhcm55?= <elecharny@gmail.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: users@directory.apache.org
Subject: Re: ADS 2.0.0 and TLS
References: 
 <CAJpRgm_hR2SAj6bhhf6Dzp9+rk5w3bdbEV01dd=J7XaJMbmymQ@mail.gmail.com>
In-Reply-To: 
 <CAJpRgm_hR2SAj6bhhf6Dzp9+rk5w3bdbEV01dd=J7XaJMbmymQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Le 06/02/15 15:41, John Strockmeyer a écrit :
> Hello. I have several question on the topic of TLS in ApacheDS 2.0.0-M18:
>
> 1. Does ADS support TLS 1.1 and TLS 1.2 over ldaps?
Yes.
>
> 2. I noticed that class
> org.apache.directory.server.protocol.shared.transport.*TcpTransport* class
> has *setEnableSSL *and *enableSSL* functions. Is there a need for two
> functions? Should I be using both of them, or just a specific one would be
> enough?
No idea why those two methods are existing together, while only one is
necessary.
>
> 3. I know that I can use JNDI API in an ldap client via ldaps, but is it
> possible to also use it via StartTLS? Do I need to use "ssl" or "tls" for
> Context.SECURITY_PROTOCOL?
First, LDAPS is considered as deprecated. You should always use the
startTLS extended operation instead.

Second, you would make your life less painfull by using the Apache LDAP
API instead of JNDI/

>
> 4. When using JNDI client, should javax.naming.ldap.*StartTlsResponse* be
> used after instantiating InitialLdapContext?
I don't remember. I have not used JNDI for years ...