[JIRA] Commented: (SIDP-542) LDAPS certificate verification errors on failover

[Kevin Sewell (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-542?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14106#comment-14106 ] 

Kevin Sewell commented on SIDP-542:
-----------------------------------

Thanks. I've applied that fix, and it does indeed solve the described problem.

> LDAPS certificate verification errors on failover
> -------------------------------------------------
>
>                 Key: SIDP-542
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-542
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>          Components: Authentication
>    Affects Versions: 2.3.6
>         Environment: CentOS 6. java version "1.7.0_02". apache-tomcat-6.0.35
>            Reporter: Kevin Sewell
>            Assignee: Chad La Joie
>         Attachments: idp-process.log.1.txt
>
>
> It appears that LDAPS bind is failing with certificate verification errors (hostname mismatch) when "failing over" using, in my case, the ACTIVE_PASSIVE connection strategy.
> In attribute-resolver.conf, I have this:
> <resolver:DataConnector
>   id="ADLDAP"
>   xsi:type="dc:LDAPDirectory"
>   ldapURL="ldaps://dc1.domain ldaps://dc2.domain ldaps://dc3.domain ldaps://dc4.domain"
>   connectionStrategy="ACTIVE_PASSIVE"
>   baseDN="ou=People,dc=domain"
>   principal="reader at domain"
>   principalCredential="secret">
>   <dc:FilterTemplate>
>     <![CDATA[
>       (sAMAccountName=$requestContext.principalName)
>     ]]>
>   </dc:FilterTemplate>
>   <dc:LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="1000"/>
>   <dc:LDAPProperty name="java.naming.referral" value="follow"/>
>   <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
> </resolver:DataConnector>
> Each of the ldap servers has a certificate with its own hostname as subject.
> Log attached, but in summary:
> dc1.domain was made to be unavailable, and the IdP was restarted. The IdP failed to start up, apparently attempting to match "dc1.domain" with each subject in all the subsequent certificates, which obviously fails:
> 17:06:46.089 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
> 17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = reader at domain
> 17:06:46.090 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
> 17:06:46.152 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:128] - Set hostname verifier for ldaps
> 17:06:47.213 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc1.domain
> javax.naming.CommunicationException: dc1.domain:636
> <snip>
> Caused by: java.net.SocketTimeoutException: connect timed out
> <snip>
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = reader at domain
> 17:06:47.214 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
> 17:06:47.229 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at e9fd18b
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 424fd90d
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the following parameters:
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] -   hostname = dc1.domain
> 17:06:47.253 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] -   cert = CN=dc2.domain, OU=...
> 17:06:47.255 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = [dc2.domain]
> 17:06:47.258 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc2.domain
> javax.naming.CommunicationException: simple bind failed: dc2.domain:636
> <snip>
> javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> Caused by: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> 17:06:47.258 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
> 17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = reader at domain
> 17:06:47.259 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
> 17:06:47.264 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for sun.security.ssl.X509TrustManagerImpl at e9fd18b
> 17:06:47.272 - DEBUG [edu.vt.middleware.ldap.ssl.AggregateTrustManager:75] - invoking checkServerTrusted for edu.vt.middleware.ldap.ssl.HostnameVerifyingTrustManager at 424fd90d
> 17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:122] - Verify with the following parameters:
> 17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] -   hostname = dc1.domain
> 17:06:47.273 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] -   cert = CN=dc3.domain, OU=...
> 17:06:47.274 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = [dc3.domain]
> 17:06:47.280 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://dc3.domain
> javax.naming.CommunicationException: simple bind failed: dc3.domain:636
> <snip>
> Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> Caused by: java.security.cert.CertificateException: Hostname '[dc1.domain]' does not match the hostname in the server's certificate
> <snip>
> etc
> Kevin

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira