idp3: Path does not chain with any of the trust anchors

[Peter Schober]

* TISSOT Jacques <jacques.tissot at unifr.ch> [2015-11-11 10:21]:
> But basically, I don't understand the difference between certificateTrust and keystoreTrust:
> 
> "certificateTrust: Uses the idp.authn.LDAP.trustCertificates property to load a resource containing the trust anchors (such as a file of PEM-format certificates)"
> "keyStoreTrust : Uses the idp.authn.LDAP.trustStore property to load a keystore containing the trust anchors"
> 
> Q (which): which certificate should I use against the ldap servers:
> Root_CA, Sub_CA, Sub_CA chained ? And should I store also the
> server-side certificates issued to the ldap servers?

If you want PKIX you'd store all keys need to validate the TLS
connection in "a file of PEM-format certificates". E.g. if the TLS
server is properly configured it would send the complete certificate
chain (including the server certificate itself) except the root CA.
In that case you'd only put the root CA cert in your file.

> Q (where): where do I store the(se) certificate(s) ? In the
> /opt/shibboleth-idp/credentials/ directory as pem files or imported
> in the /opt/shibboleth-idp/credentials/cacerts keystore?

You can probably reference them with a full path, so whatver you find
suitable. I'd use the credentials directory, with proper (i.e.,
read-only for the JVM/Servlet container) permissions.
-peter