ldaptive is a java ldap library which replaces vt-ldap shipped with shibboleth and grouper.
There are some nice surprises, like the handling of the ldap extended operation of Password Modify and Password Policy, used by openldap to check if a user's password is locked or need to be changed.
I have tried a ldapsearch authenticated with SASL TLS/EXTERNAL:
Please note that the private key password (the one you set to create the pkcs12) and the keystore password have to be the same.
