SSL and TLS activation

LSC can encrypt communication with a LDAP server, using either the StartTLS operation (on standard LDAP port, 389) or via SSL (on a specific port, 636).

Configuring LSC

TLS (StartTLS operation)

You can use the startTLS extended operation to secure a connection on the standard 389 port. This feature is available since LSC 1.1.0.

To enable TLS on the LDAP connection, set the following node in lsc.xml:

<connection>
  <.../>
  <tlsActivated>true</tlsActivated>
</connection>

SSL

You can use SSL to create a secure tunnel. This implies to use ldaps:// URI in lsc.xml:

<connection>
  <.../>
  <url>ldaps://localhost/</url>
</connection>

Trusting the certificate

Choose one of the two options below to get your server's certificate trusted.

Global use: LSC will use system-wide JVM Truststore

First step, add the CA certificate (which signed the LDAP server certificate) in the JVM running LSC.

This tutorial is written from http://java.sun.com/products/jndi/tutorial/ldap/security/ssl.html#CLIENT

First, go to the security folder of your JVM installation:

cd $JAVA_HOME/jre/lib/security/

Then import the CA certificate (we suppose it is in a file named cacert.pem):

../../bin/keytool -import -file /path/to/cacert.pem -keystore jssecacerts

Specific use: LSC will use its own truststore

This is exactly the same procedure as described above. But, at the end, LSC will use its own truststore instead of the system-wide JVM truststore.

First step, copy the JVM truststore to your LSC installation:

cp $JAVA_HOME/jre/lib/security/cacerts /usr/local/lsc/etc

Then import the new certificate into this truststore:

$JAVA_HOME/bin/keytool -import -file /path/to/certificate.pem \
  -keystore /usr/local/lsc/etc/cacerts

Now, edit the shell script that launches LSC synchronization tasks. We suppose this is /usr/local/lsc/bin/lsc. Replace the following line:

$JAVA_HOME/bin/java -cp $CLASSPATH org.lsc.Launcher $*

by this line:

$JAVA_HOME/bin/java -cp $CLASSPATH \
  -Djavax.net.ssl.trustStore=$CFG_DIR/cacerts \
  -Djavax.net.ssl.trustStorePassword=changeit \
  org.lsc.Launcher $*