IdP for Username/Password Authentication LDAPS (with AD) issues

[Youssef GHORBAL]

Hello,

	I want to do Username/Password Authentication using LDAPS (against an AD) with an IdP 2.4
	I’m following this documentation :
	https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
	This particular example :

Example config using failover and certificates issued by private CA 
ShibUserPassAuth {
// UA AD Auth
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="ldap://adua01.ua.edu:3268 ldap://adua032.ua.edu:3268"
      baseDn="dc=ad,dc=ua,dc=edu"
      bindDn="cn=uashib,ou=service,dc=ad,dc=ua,dc=edu"
      bindCredential="••••••••••"
      subtreeSearch="true"
// Directly reference imported certificate for CA used to create/sign server certs 
      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/UA_AD_CA.pem}"
      ssl="false"
      tls="true"
      userField="sAMAccountName,uaIdentifier";

};

	The only diffrence is I do SSL instead of StartTLS, I have the login.config set according to the documentation and I’m struggling to have java trust the AD CA. My conf looks like :

ShibUserPassAuth {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldaps://tom.corp.pasteur.fr:636 ldaps://jerry.corp.pasteur.fr:636"
      connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"
      timeout="1000"
      bindDn="CN=sys_shib,OU=Systemes,OU=Ressources,DC=corp,DC=pasteur,DC=fr"
      bindCredential=“xxxxxxxxx"
      baseDn="dc=corp,dc=pasteur,dc=fr"
      subtreeSearch="true"
      userFilter="sAMAccountName={0}"
      ssl="true"
      sslSocketFactory="{trustCertificates=file:/opt/active_directory_ca/corp.pasteur.fr.pem}";

	
	Issue 1 : (it took me some hours to find out)
	---------

	When the pem file (/opt/shibboleth-idp/trustedservercerts/UA_AD_CA.pem in the example) have a trailing empty newline. I keep getting this error message in the logs :
[…]
Caused by: java.security.cert.CertificateException: Could not parse certificate: java.io.IOException: DerInputStream.getLength(): lengthTag=127, too big.
[…]
	It’s a silly problem, but worth noting, if somebody stuck on it in the future.

	openssl does not care and works happely with the same file….

	Issue 2 :
	---------
	
	Now I have the classic :
[…]
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
[…]

	I’m pretty sure that the CA is correct using openssl :

#> c_rehash /opt/active_directory_ca/
#> openssl s_client -CApath /opt/active_directory_ca/ -connect tom.corp.pasteur.fr:636

[…]
   Verify return code: 0 (ok)
[…]

	What am I missing ? In the idp-process.log, I can’t seem to find any clue whether the CA file (sslSocketFactory) is taken into account or ignored for some other obscure reason.
	How can I push investigations deeper (I currently @ DEBUG level)

	Any help would be appreciated.

Youssef