IdP for Username/Password Authentication LDAPS (with AD) issues

[Daniel Fisher]

On Tue, Mar 22, 2016 at 3:39 PM, Youssef GHORBAL <youssef.ghorbal at pasteur.fr
> wrote:

> ShibUserPassAuth {
>    edu.vt.middleware.ldap.jaas.LdapLoginModule required
>       ldapUrl="ldaps://tom.corp.pasteur.fr:636 ldaps://
> jerry.corp.pasteur.fr:636"
>
> connectionHandler="edu.vt.middleware.ldap.handler.DefaultConnectionHandler{{connectionStrategy=ACTIVE_PASSIVE}}"
>       timeout="1000"
>
> bindDn="CN=sys_shib,OU=Systemes,OU=Ressources,DC=corp,DC=pasteur,DC=fr"
>       bindCredential=“xxxxxxxxx"
>       baseDn="dc=corp,dc=pasteur,dc=fr"
>       subtreeSearch="true"
>       userFilter="sAMAccountName={0}"
>       ssl="true"
>
> sslSocketFactory="{trustCertificates=file:/opt/active_directory_ca/corp.pasteur.fr.pem}";
>
>
>         What am I missing ? In the idp-process.log, I can’t seem to find
> any clue whether the CA file (sslSocketFactory) is taken into account or
> ignored for some other obscure reason.
>         How can I push investigations deeper (I currently @ DEBUG level)
>
>         Any help would be appreciated.


Put the 'edu.vt.middleware.ldap' package in DEBUG and look for a message
about loading your certificate.

As a last resort, you can start your JVM with -Djavax.net.debug=ssl. That
will be very noisy, but you could track down the handshake to your AD
instance and see how the trust manager is being initialized.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160323/ed626e77/attachment.html>