IdP for Username/Password Authentication LDAPS (with AD) issues

[Peter Schober]

* Youssef  GHORBAL <youssef.ghorbal at pasteur.fr> [2016-03-22 20:40]:
> ShibUserPassAuth {
>    edu.vt.middleware.ldap.jaas.LdapLoginModule required
>       ldapUrl="ldaps://tom.corp.pasteur.fr:636 ldaps://jerry.corp.pasteur.fr:636"
>       connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"
>       timeout="1000"
>       bindDn="CN=sys_shib,OU=Systemes,OU=Ressources,DC=corp,DC=pasteur,DC=fr"
>       bindCredential=“xxxxxxxxx"
>       baseDn="dc=corp,dc=pasteur,dc=fr"
>       subtreeSearch="true"
>       userFilter="sAMAccountName={0}"
>       ssl="true"
>       sslSocketFactory="{trustCertificates=file:/opt/active_directory_ca/corp.pasteur.fr.pem}";
[...]
> 	I’m pretty sure that the CA is correct using openssl :
> 
> #> c_rehash /opt/active_directory_ca/
> #> openssl s_client -CApath /opt/active_directory_ca/ -connect tom.corp.pasteur.fr:636

Those two methods are not equivalent, though: In the JAAS config you
provide a certificate file, in the s_client example you provide a
certificate path. So for this comparison to make sense you'd have to
supply the same file via s_client -CAfile /opt/active_directory_ca/corp.pasteur.fr.pem
(That might still work, of course.)
-peter