Mailing-List: contact api-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: api@directory.apache.org
Received-SPF: pass (nike.apache.org: domain of dfisher@vt.edu designates
 198.82.162.213 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAE6QqXP9Tv6GTeaw7ReDNoM0dBuu+3Z5QsD58CcJ1R=Xc1goLg@mail.gmail.com>
References: 
 <CAE6QqXOs1Hym0JucgAQQgdergqZKFaY-oOWcEbwdCQJiRwbT9w@mail.gmail.com>
 <CABzFU-cmzB4Rvgpmpb6dJFebTzoibKZQR2g_6qHiMzhs_8F85Q@mail.gmail.com>
 <CAE6QqXP9Tv6GTeaw7ReDNoM0dBuu+3Z5QsD58CcJ1R=Xc1goLg@mail.gmail.com>
From: Daniel Fisher <dfisher@vt.edu>
Date: Sat, 16 Nov 2013 10:51:37 -0500
Message-ID: 
 <CAFC6YwRW4kNaKtsoHj-Gw2sKR0Sn=xcxO0OcP=BxQFovtP6K5Q@mail.gmail.com>
Subject: Re: X509 Certificate based authentication w/ssl
To: api@directory.apache.org
Content-Type: multipart/alternative; boundary=089e0160caae705f7604eb4d4bb7

--089e0160caae705f7604eb4d4bb7
Content-Type: text/plain; charset=ISO-8859-1

On Sat, Nov 16, 2013 at 9:24 AM, Michael Moorman <
michael.e.moorman@gmail.com> wrote:

> I looked into it and it seems that someone has already requested this
> feature in 2011: https://issues.apache.org/jira/browse/DIRSTUDIO-743
>
> Is there any interest in enhancing the API to support client certificate
> authentication? It seems like the server project will eventually implement
> it.  I'd wager that there are many others like me out there who use the
> directory API to connect to a non-Apache Directory LDAP servers - not by
> choice, mind you :-)
>

If you're talking about TLS client authentication, the API supports this:
http://directory.apache.org/api/gen-docs/latest/apidocs/org/apache/directory/ldap/client/api/LdapConnectionConfig.html#setKeyManagers(javax.net.ssl.KeyManager[])

If you're referring to SASL external binds, there is an open issue for this:
https://issues.apache.org/jira/browse/DIRAPI-105

--Daniel Fisher

--089e0160caae705f7604eb4d4bb7--