Security Advisory 20120227

[Juan Quintanilla]

Hi,

I'm getting a similar error with connection to ldap.  We use a wild card cert *.fiu.edu and the message we receive is:

15:14:00.487 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unabled to connect to the ldap
javax.naming.CommunicationException: simple bind failed: fiuldap1.fiu.edu:636

Caused by: java.security.cert.CertificateException: Hostname '[fiuldap1.fiu.edu]' does not match the hostname in the server's certificate

Any ideas?

Thanks!
___________________
Juan Quintanilla
UTS - Enterprise Group
305-348-6573
jquin014 at fiu.edu
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Mark Cairney [mark.cairney at ed.ac.uk]
Sent: Monday, February 27, 2012 10:49 AM
To: Shib Users
Subject: Re: Security Advisory 20120227

OK I've amended my config to point at one of the individual servers which does match the *.authorise-test.is.ed.ac.uk pattern and that seems to be working.

authorise-test.is.ed.ac.uk is a round-robin DNS between 2 servers. We do have another identical round-robin DNS which does match the pattern- using this instead would be the simplest solution.

Thanks,

Mark

On 27 Feb 2012, at 15:38, Cantor, Scott wrote:

> On 2/27/12 10:28 AM, "Mark Cairney" <mark.cairney at ed.ac.uk> wrote:
>>
>> 15:22:25.776 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109]
>> - unabled to connect to the ldap
>> javax.naming.CommunicationException: hostname of the server
>> 'authorise-test.is.ed.ac.uk' does not match the hostname in the server's
>> certificate.
>
> That doesn't match the wildcard you have here:
>
>> Owner: EMAILADDRESS=ext6033 at ed.ac.uk, CN=*.authorise-test.is.ed.ac.uk,
>> OU=Information Services, O=University of Edinburgh, L=Edinburgh,
>> ST=Scotland, C=GB
>
> That would be a bug to accept it.
>
>> Is this expected behaviour and are you aware of any workarounds? This
>> setup was working fine with Shibboleth 2.3.5..
>
> That's because the library in 2.3.5 didn't verify it at all.
>
> I believe Daniel allowed for an override of the hostname verification via
> a custom class. I don't know if there's a class built-in that literally
> disables the check.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

/*********************************
Mark Cairney
ITI UNIX Section
Information Services
University of Edinburgh

Tel: 0131 650 6565
Email: mark.cairney at ed.ac.uk

*********************************/


--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net