login.config to use private-CA-issued certificate

Tue Jul 30 14:14:30 EDT 2013

Bingo!  

For the record, using TLS on port 3268 rather than SSL on port 3269 successfully established encrypted communication with the AD server using the imported private-CA-issued certificate (config fragment & log output below).

If this seems worth documenting in the wiki as a sample config, which page would you recommend I add it to?

Thank you!

David Bantz

On Tue, 30 Jul 2013, at 08:41 , Daniel Fisher <dfisher at vt.edu> wrote:
> ...
> Try using port 3268 with ssl="false" and tls="true". Using a custom SSL socket factory with LDAPS is going to require a more complicated configuration than what you have here.

login.config fragment:

// UA AD Auth
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3268"
      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
      bindCredential="••••••••••"
      subtreeSearch="true"
// Directly reference imported server certificate for TLS on 3268
      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"
      ssl="false"
      tls="true"
      userField="sAMAccountName,uaIdentifier";

debug-level idp-process.log fragment during authN:

09:37:23.859 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:170] - Attempting to authenticate user dabantz
09:37:23.877 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:180] - useFirstPass = false
09:37:23.877 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:181] - tryFirstPass = false
09:37:23.878 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:182] - storePass = false
09:37:23.878 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:183] - clearPass = false
09:37:23.879 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:184] - setLdapPrincipal = true
09:37:23.879 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:185] - setLdapDnPrincipal = false
09:37:23.879 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:186] - setLdapCredential = true
09:37:23.880 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:187] - defaultRole = []
09:37:23.880 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:188] - principalGroupName = null
09:37:23.881 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:189] - roleGroupName = null
09:37:23.881 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:77] - userRoleAttribute = []
09:37:24.063 - DEBUG [edu.vt.middleware.ldap.ssl.X509CertificatesCredentialReader:76] - Successfully loaded file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem
09:37:24.072 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] - Created authenticator: edu.vt.middleware.ldap.auth.AuthenticatorConfig at 1037797730::env={java.naming.provider.url=ldap://fbk-adua02.ua.ad.alaska.edu:3268, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}
09:37:24.075 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField
09:37:24.076 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:
09:37:24.076 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -   dn = dc=ua,dc=ad,dc=alaska,dc=edu
09:37:24.077 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -   filter = (|(sAMAccountName={0})(uaIdentifier={0}))
09:37:24.077 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -   filterArgs = [dabantz]
09:37:24.077 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -   searchControls = javax.naming.directory.SearchControls at 6db0d235
09:37:24.078 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -   handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 73b8cdd5]
09:37:24.078 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:130] - Bind with the following parameters:
09:37:24.079 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:131] -   authtype = simple
09:37:24.079 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:132] -   dn = cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu
09:37:24.080 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:139] -   credential = <suppressed>
09:37:24.406 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:130] - Bind with the following parameters:
09:37:24.407 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:131] -   authtype = simple
09:37:24.408 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:132] -   dn = CN=dabantz,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu
09:37:24.408 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:139] -   credential = <suppressed>
09:37:24.656 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] - Authentication succeeded for dn: CN=dabantz,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu
09:37:24.674 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField
09:37:24.675 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:
09:37:24.675 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -   dn = dc=ua,dc=ad,dc=alaska,dc=edu
09:37:24.676 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] -   filter = (|(sAMAccountName={0})(uaIdentifier={0}))
09:37:24.676 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] -   filterArgs = [dabantz]
09:37:24.677 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] -   searchControls = javax.naming.directory.SearchControls at 52ed3bff
09:37:24.677 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] -   handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 73b8cdd5]
09:37:24.711 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] - Committed the following principals: [dabantz[]]
09:37:24.712 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] - Committed the following roles: []
09:37:24.712 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:178] - Successfully authenticated user dabantz
09:37:24.715 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine
09:37:24.716 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request
09:37:24.716 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] - Completing user authentication process
09:37:24.717 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] - Validating authentication was performed successfully
09:37:24.717 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696] - Updating session information for principal dabantz
09:37:24.718 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:700] - Creating shibboleth session for principal dabantz
09:37:24.734 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:806] - Adding IdP session cookie to HTTP response
09:37:24.735 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:715] - Recording authentication and service information in Shibboleth session for principal: dabantz
09:37:24.738 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:560] - User dabantz authenticated with method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
09:37:24.739 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161] - Returning control to profile handler

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130730/9436d828/attachment-0001.html 