login.config to use private-CA-issued certificate

[Daniel Fisher]

On Mon, Jul 29, 2013 at 8:16 PM, David Bantz <dabantz at alaska.edu> wrote:

>
> *With the following in login.config to use and trust a private-CA
> certificate:*
>
> // UA AD Auth
>    edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
> //    ldapUrl="ldap://fbk-adua01.ua.ad.alaska.edu:3269
>       ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3269"
>       baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
>       bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
>       bindCredential="••••••••••"
>       subtreeSearch="true"
> // Directly reference imported server certificate
>
> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"
>       ssl="true"
>       tls="false"
>       userField="sAMAccountName,uaIdentifier";
>

Try using port 3268 with ssl="false" and tls="true". Using a custom SSL
socket factory with LDAPS is going to require a more complicated
configuration than what you have here.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130730/1e6d7142/attachment.html