StartTLS problem

Fri Mar 1 05:37:12 EST 2013

I have found how to turn off StartTLS. In config file C:\Program Files
(x86)\Internet2\Shib2IdP\conf\attribute-resolver.xml I have set it to
false. That is OK now.
Only the question is how to set cert if I want to use it.

Thanks,
Rastko

On Fri, Mar 1, 2013 at 11:20 AM, Rastko Isajev <risajev at calliduscloud.com>wrote:

> Thank you Peter for your clarifications.
>
> I have two questions.
>
> 1.) I have originally installed hibboleth with .msi file on Windows 7 64.
> LDAP, that I am using has been originaly configured to work only with one
> enabled connection handler -LDAP on port 389 that has  StartTLS disabled,
> no certificates and stuff. That was plane let say. When I have started
> Tomcat IdP app was stopped. When I have tried to start I got error from
> Shibbolets idp-process.log :
>
> [LDAP: error code 52 - StartTLS cannot be enabled on this LDAP client
> connection because the corresponding LDAP connection handler is configured
> to reject StartTLS requests.  The use of StartTLS can be enabled using the
> ds-cfg-allow-start-tls configuration attribute]
>
> , from here I see that client side (Shibboleth) is requiring TLS. Correct
> me if I am wrong. Based on your last response it should not be initiated as
> an default behavior.
>
> 2.) I have tried another solution. I have created
> certificate, installed into LDAP JKS store, set on LDAP 389 connection
> handler usage of StartTLS. Then I have added that certificate into java
> central keystore - C:\Program
> Files\Java\jdk1.6.0_37\jre\lib\security\cacerts. Then I got another error :
>
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target
>
> then I saw that in Shibboleth directory there is another one keystore,
> where probably I have to add certificate ? But I do not know password for
> keystore to open it. (it is not anything from commons such as password or
> changeit or shibks or something).
>
> Regards,
> Rastko
>
>
>
>
> On Thu, Feb 28, 2013 at 3:46 PM, Peter Schober <peter.schober at univie.ac.at
> > wrote:
>
>> * Rastko Isajev <risajev at calliduscloud.com> [2013-02-28 15:11]:
>> > I am facing with problems because of StartTLS that is mandatory when
>> > Shibboleth is calling LDAP connection handler.
>>
>> The Shibboleth software does not have such a requirement, but your DSA
>> might have.
>>
>> If your LDAP server requires the use of TLS and your IdP's JVM cannot
>> trust the certificate you need to fix one or the other:
>> Get a proper certificate onto the LDAP server or configure the IdP's
>> JVM so it has a valid trust path to the issuer of the LDAP server
>> certificate (e.g. by adding any missing CA or intermediary CA
>> certificates into the trust store).
>>
>> Either way, Shibboleth has no role in this.
>> -peter
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Kind regards,
>
>  <http://www.calliduscloud.com/>
>
>
>
>
>
>
>
>
>
>
> <https://sites.google.com/a/calliduscloud.com/callidus-signature-site/sig/Bar.jpg?attredirects=0>
>
>
>
>
>
>
> Rastko Isajev
> *Software Developer*
>
> D: +381-11-785-6561
> http://www.calliduscloud.com
>
>  <http://www.linkedin.com/company/calliduscloud> <http://twitter.com/calliduscloud>
>   <http://www.youtube.com/calliduscloudvideos> <http://www.facebook.com/callidussoftware>
>   <http://plus.google.com/u/0/s/calliduscloud> <http://www.calliduscloud.com/category/salespulseblog/>
>
>
>

-- 
Kind regards,

 <http://www.calliduscloud.com/>

<https://sites.google.com/a/calliduscloud.com/callidus-signature-site/sig/Bar.jpg?attredirects=0>

Rastko Isajev
*Software Developer*

D: +381-11-785-6561
http://www.calliduscloud.com

 <http://www.linkedin.com/company/calliduscloud>
<http://twitter.com/calliduscloud>
  <http://www.youtube.com/calliduscloudvideos>
<http://www.facebook.com/callidussoftware>
  <http://plus.google.com/u/0/s/calliduscloud>
<http://www.calliduscloud.com/category/salespulseblog/>

-- 
[image: CallidusCloud Connections]<http://www.calliduscloudconnections.com/> CallidusCloud 
Connections, Las Vegas, May 5-7, 2013, REGISTER NOW<http://www.calliduscloudconnections.com/register.html>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 472 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0014.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 620 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0015.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 286 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0002.jpe 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 545 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0016.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 472 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0017.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 447 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0018.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 7069 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0019.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 620 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0020.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 7069 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0021.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 447 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0022.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 632 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0023.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 286 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0003.jpe 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 456 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0024.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 545 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0025.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 632 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0026.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 456 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130301/39d4cf49/attachment-0027.png 