Shibboleth Developers

[Jim Fox <>]

It appears that client cert authentication to an ldap service
can be made to work for 2.0 with some property definitions in the
ldap resolver section, e.g.,

  <LDAPProperty  name="javax.net.ssl.trustStore"
            value="path_to_keystore" />
  <LDAPProperty  name="javax.net.ssl.trustStorePassword"
            value="store_pw" />
  <LDAPProperty  name="javax.net.ssl.keyStore"
            value="path_to_truststore" />
  <LDAPProperty  name="javax.net.ssl.keyStorePassword"
            value="store_pw" />
  <LDAPProperty  name="java.naming.security.authentication"
            value="EXTERNAL" />


I know these keystores are the java way, but they aren't
the shib way.  I much preferred using Credential elements.

Jim

p.s. If I can use a <Credential ../>  and normal cert and key
files for this someone please explain how.