Please note, this is about communication between Liferay and the LDAP server, not communication between the user's browser and Liferay
I'm asking this here since I got zero views (other than my own) in 30 minutes at the liferay forums, and I'd like to solve this today if possible...
I've looked at:
I've also read this:
And I've done a bunch of searching and found lots of folks setting up CAS and mentioning LDAP in their posts.
Problem is I'm not (Yet?) interested in implementing CAS. I want to set up a demo server for folks and allow them to log in with their LDAP/AD credentials. I've opted for binding since I don't have access to a login that allows me (and therefore liferay) to see said passwords.
I know this is crazy, but I also don't want their passwords to be sent in the clear. :)
None of the liferay docs discuss how to ensure that liferay starts TLS. I'm not an LDAP expert, so perhaps this is normally enforced by the LDAP or AD server, but even in that case it would have been nice if the docs said something about how to ensure that an evil employee, or evil network intruder can't simply listen to life-ray log-in requests to gain access to everyone's stuff.
From what I've read, the right thing for current LDAP implementations is for the client to initiate TLS communication for sensitive queries
So does Liferay do this? Do I need to configure anything extra to enable it?
The fact that http://issues.liferay.com/browse/LEP-4225 comes up when I google, throws signifcant doubt on wether or not this is even implemented in Liferay (I notice however that this is against "old liferay"...)
Basically I'm asking for someone who actually knows, to clear up what is/isn't available and whether or not I need to do anything to enable secure communications with LDAP/AD.
Note that I'm not interested in client certificates or otherwise authenticating the client (liferay) to the LDAP server at this time. Just securely delegating authentication to LDAP/AD.
EDIT: I just confirmed (with wireshark) that in the default configuration "test connection" sends my password in cleartext, so this seems to be a real problem
EDIT 2: Also confirmed that login attempts send the password in clear text. An encrypted solution is clearly necessary.