login.config to use private-CA-issued certificate

[David Bantz]

With the following in login.config to use and trust a private-CA certificate:

// UA AD Auth
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
//    ldapUrl="ldap://fbk-adua01.ua.ad.alaska.edu:3269 
      ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3269"
      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
      bindCredential="••••••••••"
      subtreeSearch="true"
// Directly reference imported server certificate 
      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"
      ssl="true"
      tls="false"
      userField="sAMAccountName,uaIdentifier";

Logs indicate the certificate file is loaded during authN:

15:44:59.767 - DEBUG [edu.vt.middleware.ldap.ssl.X509CertificatesCredentialReader:76] - Successfully loaded file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem
15:44:59.768 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] - Created authenticator: edu.vt.middleware.ldap.auth.AuthenticatorConfig at 559102764::env={java.naming.provider.url=ldap://fbk-adua02.ua.ad.alaska.edu:3269, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl, java.naming.ldap.factory.socket=edu.vt.middleware.ldap.ssl.TLSSocketFactory}
15:44:59.768 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField
15:44:59.769 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:
15:44:59.769 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -   dn = dc=ua,dc=ad,dc=alaska,dc=edu
15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -   filter = (|(sAMAccountName={0})(uaIdentifier={0}))
15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -   filterArgs = [dabantz]
15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -   searchControls = javax.naming.directory.SearchControls at 5f51d6cb
15:44:59.771 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -   handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 75ecda50]

but the bind fails with "unable to find valid certification path to requested target:"

15:44:59.771 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
15:44:59.772 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
15:44:59.772 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu
15:44:59.772 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
15:45:00.361 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldap://fbk-adua02.ua.ad.alaska.edu:3269
javax.naming.CommunicationException: simple bind failed: fbk-adua02.ua.ad.alaska.edu:3269
…
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
…
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
…
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

What are the possible sources of this failure other than having been provided the wrong certificate for the server?   Do I ALSO need to import the issuing CA certificate?  Use a different certificate file format? …

Thanks in advance,

David Bantz
U Alaska
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130729/63575ada/attachment.html