disable hostname check in OpenLDAP

[eln00b]

Fisher, Daniel wrote
> What version of the IDP are you using?

3.2.1


Waldbieser, Carl wrote
> It is the hostname verification part of the TLS connection the LDAP client
> in Shib is making to your LDAP service.

Shib to LDAP


Waldbieser, Carl wrote
> If you don't use it, how do you know you aren't being MITM'd?

Don't care.  This is just for testing purposes and it will only be turned on
when I explicitly need it.


Waldbieser, Carl wrote
> What do your LDAP client and server logs tell you?


ERROR [org.ldaptive.pool.BlockingConnectionPool:484] -
[org.ldaptive.pool.BlockingConnectionPool at 392745575::name=bind-pool,
poolConfig=[org.ldaptive.pool.PoolConfig at 2078801040::minPoolSize=3,
maxPoolSize=10, validateOnCheckIn=false, validateOnCheckOut=false,
validatePeriodically=true, validatePeriod=300], activator=null,
passivator=null,
validator=[org.ldaptive.pool.SearchValidator at 1693827550::searchRequest=[org.ldaptive.SearchRequest at 1880758347::baseDn=,
searchFilter=[org.ldaptive.SearchFilter at 1642584434::filter=(objectClass=*),
parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=0,
sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null,
sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false,
intermediateResponseHandlers=null]]
pruneStrategy=[org.ldaptive.pool.IdlePruneStrategy at 1303698105::prunePeriod=300,
idleTime=600], connectOnCreate=true,
connectionFactory=[org.ldaptive.DefaultConnectionFactory at 126163424::provider=org.ldaptive.provider.jndi.JndiProvider at 12bef12b,
config=[org.ldaptive.ConnectionConfig at 108683115::ldapUrl=ldap://127.0.0.1:389,
connectTimeout=3000, responseTimeout=-1,
sslConfig=[org.ldaptive.ssl.SslConfig at 1844460559::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 42156248,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=true,
connectionInitializer=null]], initialized=true, availableCount=0,
activeCount=0] unable to connect to the ldap
org.ldaptive.provider.ConnectionException:
javax.net.ssl.SSLPeerUnverifiedException: hostname of the server '127.0.0.1'
does not match the hostname in the server's certificate.
	at
org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory.createInternal(JndiStartTLSConnectionFactory.java:100)
Caused by: javax.net.ssl.SSLPeerUnverifiedException: hostname of the server
'127.0.0.1' does not match the hostname in the server's certificate.
	at
com.sun.jndi.ldap.ext.StartTlsResponseImpl.verify(StartTlsResponseImpl.java:447)
Caused by: java.security.cert.CertificateException: No name matching
127.0.0.1 found
	at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:221)
WARN [org.ldaptive.pool.BlockingConnectionPool:534] - unable to create
available connection




-----

el n00b - Trying to understand technology and help create documentation online wherever I get stuck.
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/disable-hostname-check-in-OpenLDAP-tp7628614p7628617.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.