Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
Subject: Re: StartTLS enforced
From: Ogg <ogg@sr375.com>
In-Reply-To: <56CF322C.2050603@gmail.com>
Date: Thu, 25 Feb 2016 08:59:15 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <9FF94D07-1B62-4254-BA9E-530CFC20BB7A@sr375.com>
References: 
 <678353651.15690933.1456414417251.JavaMail.yahoo.ref@mail.yahoo.com>
 <678353651.15690933.1456414417251.JavaMail.yahoo@mail.yahoo.com>
 <56CF322C.2050603@gmail.com>
To: users@directory.apache.org

I also would be interested in the feature. It, would also be interesting =
to deprecate TLS 1.0, TLS 1.1  and SSL any flavor.

> On Feb 25, 2016, at 8:56 AM, Emmanuel L=C3=A9charny =
<elecharny@gmail.com> wrote:
>=20
> Le 25/02/16 16:33, s_humbi a =C3=A9crit :
>> Hello,does anybody know, if there is a way to force the ldap-client =
to use StartTLS ? I dont wont to offer our ldap-clients an unsecure way =
to talk with our LDAP-Server.
>> Yes I can disable the default-Port 389 and only enable the SSL-Port =
636.But there is written in the DS documentation: " **LDAPS** is =
considered as deprecated. You should always favor startTLS instead. "
>> And I also need the port 389 (with StartTLS) for replication, so i =
can not disable it.
>> At the moment i use onlyTLSV1.2 (attribute ads-enabledProtocols). But =
the users can still connect without TLS.
>> I found this interesting paper:
>> =
http://people.apache.org/~elecharny/ldapcon/Andrew%20Findlay-paper.pdf--> =
see Caption caption:  "The correct and standard approach is to start =
LDAP without encryption and then negotiate the TLS security layer. If =
necessary, the server can be configured to refuse all operations other =
than 'Start TLS' until TLS is in place"
>>=20
>> Is this possible with Apache DS ?
>> Many Thanks for helping ...Humbi
>>=20
>>=20
>>=20
>>=20
> No, sorry, we can't enforce that atm. At least, here is no way to do
> that through configuration.
>=20
> And yes, this is missing. In OpenLDAP, you can enforce TLS through =
some
> parameter, and I think that would be a good addition to ApacheDS.
> Would you fancy creating a JIRA with such a demand ?
>=20
> Thanks !