[JIRA] Created: (SIDP-542) LDAPS certificate verification errors on failover

Wed Mar 7 19:36:16 GMT 2012

LDAPS certificate verification errors on failover
-------------------------------------------------

                 Key: SIDP-542
                 URL: https://issues.shibboleth.net/jira/browse/SIDP-542
             Project: Shibboleth IdP 2 - Java
          Issue Type: Bug
          Components: Authentication
    Affects Versions: 2.3.6
         Environment: CentOS 6. java version "1.7.0_02". apache-tomcat-6.0.35
            Reporter: 3h0mdywugzdyek52fu6zi7gmaje=@https://shidp.glam.ac.uk/shibboleth
            Assignee: Chad La Joie
         Attachments: idp-process.log.1.txt

It appears that LDAPS bind is failing with certificate verification errors (hostname mismatch) when "failing over" using, in my case, the ACTIVE_PASSIVE connection strategy.

In attribute-resolver.conf, I have this:
<resolver:DataConnector
  id="ADLDAP"
  xsi:type="dc:LDAPDirectory"
  ldapURL="ldaps://dc1.domain ldaps://dc2.domain ldaps://dc3.domain ldaps://dc4.domain"
  connectionStrategy="ACTIVE_PASSIVE"
  baseDN="ou=People,dc=domain"
  principal="reader at domain"
  principalCredential="secret">
  <dc:FilterTemplate>
    <![CDATA[
      (sAMAccountName=$requestContext.principalName)
    ]]>
  </dc:FilterTemplate>
  <dc:LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="1000"/>
  <dc:LDAPProperty name="java.naming.referral" value="follow"/>
  <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
</resolver:DataConnector>

Each of the ldap servers has a certificate with its own hostname as subject.

Log attached, but in summary:
dc1.domain was made to be unavailable, and the IdP was restarted. The IdP failed to start up, apparently attempting to match "dc1.domain" with each subject in all the subsequent certificates, which obviously fails:

17:06:46.089 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = reader at domain
17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
17:06:46.152 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set hostname verifier for ldaps
17:06:47.213 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc1.domain
javax.naming.CommunicationException: dc1.domain:636
<snip>
Caused by: java.net.SocketTimeoutException: connect timed out
<snip>
17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = reader at domain
17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
17:06:47.229 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at e9fd18b
17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 424fd90d
17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the following parameters:
17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] -   hostname = dc1.domain
17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] -   cert = CN=dc2.domain, OU=...
17:06:47.255 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = [dc2.domain]
17:06:47.258 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc2.domain
javax.naming.CommunicationException: simple bind failed: dc2.domain:636
<snip>
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
<snip>
Caused by: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
<snip>
17:06:47.258 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = reader at domain
17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
17:06:47.264 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at e9fd18b
17:06:47.272 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 424fd90d
17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the following parameters:
17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] -   hostname = dc1.domain
17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] -   cert = CN=dc3.domain, OU=...
17:06:47.274 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = [dc3.domain]
17:06:47.280 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc3.domain
javax.naming.CommunicationException: simple bind failed: dc3.domain:636
<snip>
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
<snip>
Caused by: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
<snip>

etc
Kevin

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira