IdP 3.1.0.1 TLS problems

[Cantor, Scott]

On 4/9/15, 12:53 PM, "Dave Bartholomew" <Dave.Bartholomew at csueastbay.edu> wrote:
>
>When I started the IdP, I got following:
>Data Connector 'myLDAP': Invalid connector configuration
>hostname of the server 'ldapserver.school.edu' does not match the hostname
>in the server's certificate
>No subject alternative DNS name matching ldapserver.school.edu found.
>
>The ldapserver.school.edu cert does have itself listed as a SAN (and CN),
>but the <hostname>.school.edu cert doesn't have ldapserver.school.edu
>listed as a SAN.

Well, what matters is what it presents to the LDAP client, not what's in your configuration.

>So, I figured I'd delete the <hostname>.school.edu cert to see what
>happens after which I got the following error:

Deleting it from what?

>I would expect the IdP to use the idp.authn.LDAP.ldapURL in its
>certificate checking, but am I missing some other dependencies?

The name it tries to match to the cert is what's in the URL, yes.

Also bear in mind that a cert with a SAN in it would cause strictly written clients to ignore the CN.

-- Scott