[JIRA] Moved: (SC-181) LDAPS certificate verification errors on failover
Chad La Joie (JIRA)
noreply at shibboleth.net
Thu Jun 21 12:49:55 BST 2012
[ https://issues.shibboleth.net/jira/browse/SC-181?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chad La Joie moved SIDP-542 to SC-181:
--------------------------------------
Component/s: (was: Authentication)
Attribute Authority
Fix Version/s: (was: 2.3.7)
1.3.6
Affects Version/s: (was: 2.3.6)
1.3.5
Key: SC-181 (was: SIDP-542)
Project: Shibboleth Common - Java (was: Shibboleth IdP 2 - Java)
> LDAPS certificate verification errors on failover
> -------------------------------------------------
>
> Key: SC-181
> URL: https://issues.shibboleth.net/jira/browse/SC-181
> Project: Shibboleth Common - Java
> Issue Type: Bug
> Components: Attribute Authority
> Affects Versions: 1.3.5
> Environment: CentOS 6. java version "1.7.0_02". apache-tomcat-6.0.35
> Reporter: Kevin Sewell
> Assignee: Chad La Joie
> Fix For: 1.3.6
>
> Attachments: idp-process.log.1.txt
>
>
> It appears that LDAPS bind is failing with certificate verification errors (hostname mismatch) when "failing over" using, in my case, the ACTIVE_PASSIVE connection strategy.
> In attribute-resolver.conf, I have this:
> <resolver:DataConnector
> id="ADLDAP"
> xsi:type="dc:LDAPDirectory"
> ldapURL="ldaps://dc1.domain ldaps://dc2.domain ldaps://dc3.domain ldaps://dc4.domain"
> connectionStrategy="ACTIVE_PASSIVE"
> baseDN="ou=People,dc=domain"
> principal="reader at domain"
> principalCredential="secret">
> <dc:FilterTemplate>
> <![CDATA[
> (sAMAccountName=$requestContext.principalName)
> ]]>
> </dc:FilterTemplate>
> <dc:LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="1000"/>
> <dc:LDAPProperty name="java.naming.referral" value="follow"/>
> <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
> </resolver:DataConnector>
> Each of the ldap servers has a certificate with its own hostname as subject.
> Log attached, but in summary:
> dc1.domain was made to be unavailable, and the IdP was restarted. The IdP failed to start up, apparently attempting to match "dc1.domain" with each subject in all the subsequent certificates, which obviously fails:
> 17:06:46.089 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype = simple
> 17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = reader at domain
> 17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential = <suppressed>
> 17:06:46.152 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set hostname verifier for ldaps
> 17:06:47.213 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc1.domain
> javax.naming.CommunicationException: dc1.domain:636
> <snip>
> Caused by: java.net.SocketTimeoutException: connect timed out
> <snip>
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype = simple
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = reader at domain
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential = <suppressed>
> 17:06:47.229 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at e9fd18b
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 424fd90d
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the following parameters:
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] - hostname = dc1.domain
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] - cert = CN=dc2.domain, OU=...
> 17:06:47.255 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = [dc2.domain]
> 17:06:47.258 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc2.domain
> javax.naming.CommunicationException: simple bind failed: dc2.domain:636
> <snip>
> javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> Caused by: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> 17:06:47.258 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype = simple
> 17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = reader at domain
> 17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential = <suppressed>
> 17:06:47.264 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at e9fd18b
> 17:06:47.272 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 424fd90d
> 17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the following parameters:
> 17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] - hostname = dc1.domain
> 17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] - cert = CN=dc3.domain, OU=...
> 17:06:47.274 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = [dc3.domain]
> 17:06:47.280 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc3.domain
> javax.naming.CommunicationException: simple bind failed: dc3.domain:636
> <snip>
> Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> Caused by: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> etc
> Kevin
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the commits
mailing list