LDAPS and hostname validation

[mariuss]

Does anyone know if JNDI by default is supposed to do hostname validation with LDAPS?

The SSL certificate is validated, but the hostname is not.

What is the best way to implement or enable this validation?

[ulsa]

Check out the javax.net.ssl.HostnameVerifier usage in our AbstractTlsDirContextAuthenticationStrategy. Perhaps it can be helpful.

[mariuss]

Thanks for the pointer Ulrik, I was not familiar with the Start TLS extension.

If an LDAP server supports SSL is it guaranteed to also support Start TLS?

If not, then hostname verification cannot be done for all LDAPS connections, only if Start TLS is supported?

[beess]

i just want to post once so i can create a thread.

[mariuss]

If an LDAP server supports SSL is it guaranteed to also support Start TLS?

To answer my own question, SSL support does not guarantee Start TLS support. Found at least once instance where LDAPS was supported, but not TLS.

If not, then hostname verification cannot be done for all LDAPS connections, only if Start TLS is supported?

Still not sure about this. Is it possible to do hostname verification with LDAPS only? How?