Active Directory ldaps authentication

[Peter Schober]

* Mr. Christopher Bland <chris at fdu.edu> [2015-09-02 03:45]:
> I have created a new cert on my AD server with the DNS name as the
> subject (shows up as
> CN=ADServer1.addomain.fdu.edu<http://ADServer1.addomain.fdu.edu>)
> and the Subject Alternative Name is the DNS and SPN names.  I have
> multiple DCs configured in a round robin DNS.  What seems to be
> happening is when the cert is being verified JAAS tries to validate
> the hostname against all of the servers in the SAN (including each
> member of the round robin up to the first 3 responses) and then
> fails even though it finds a match.

I have no explanation for the specific error you're seeing, but would
still like to comment on your "PKI" deployment choices.

If you're using DNS in a round-robin fashion that means clients will
attempt to resolve the same FQDN (say, ldap.example.org) and each time
they will get a different IP address back from the resolver, right?
(A very poor form of load distribution, btw, which will happily
continue to route clients to unreachable servers until DNS is changed
and propagated and clients have finally let go of cached DNS records,
etc.)
Anyway, in such a scenario each client would access the same FQDN
(ldap.example.org), independent of any other names that server might
have, internally or in DNS (e.g. ldap-server1.example.org). From that
follows that this name would need to be in those certificates, none of
the "internal" or "machine" names -- unless you intend clients to
access those via TLS using the internal names, too?

If I ask my resolver for the IP address for ldap.example.org and it
gives me 192.168.0.1, the I expect the service listening on that IP
address to present a certificate with the name ldap.example.org.
A single name, possibly even sharing the same key pair across all
machines participating in that shared service name / DNS record.
Which sounds like would take away any guesswork which hostname should
go where, I'd imagine?
-peter