disable hostname check in OpenLDAP

[Waldbieser, Carl]

If you are just testing on a local setup and don't need to worry about TLS, then just run the directory without TLS and connect to port 389.  That would be the simplest thing to do.
Also, from your error it looks like you are using StartTLS and not ldaps://

Thanks,
Carl

----- Original Message -----
From: "eln00b" <jbru0003 at synchronoss.com>
To: users at shibboleth.net
Sent: Friday, September 30, 2016 2:05:03 PM
Subject: Re: disable hostname check in OpenLDAP

Fisher, Daniel wrote
> What version of the IDP are you using?

3.2.1


Waldbieser, Carl wrote
> It is the hostname verification part of the TLS connection the LDAP client
> in Shib is making to your LDAP service.

Shib to LDAP


Waldbieser, Carl wrote
> If you don't use it, how do you know you aren't being MITM'd?

Don't care.  This is just for testing purposes and it will only be turned on
when I explicitly need it.


Waldbieser, Carl wrote
> What do your LDAP client and server logs tell you?


ERROR [org.ldaptive.pool.BlockingConnectionPool:484] -
[org.ldaptive.pool.BlockingConnectionPool at 392745575::name=bind-pool,
poolConfig=[org.ldaptive.pool.PoolConfig at 2078801040::minPoolSize=3,
maxPoolSize=10, validateOnCheckIn=false, validateOnCheckOut=false,
validatePeriodically=true, validatePeriod=300], activator=null,
passivator=null,
validator=[org.ldaptive.pool.SearchValidator at 1693827550::searchRequest=[org.ldaptive.SearchRequest at 1880758347::baseDn=,
searchFilter=[org.ldaptive.SearchFilter at 1642584434::filter=(objectClass=*),
parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=0,
sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null,
sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false,
intermediateResponseHandlers=null]]
pruneStrategy=[org.ldaptive.pool.IdlePruneStrategy at 1303698105::prunePeriod=300,
idleTime=600], connectOnCreate=true,
connectionFactory=[org.ldaptive.DefaultConnectionFactory at 126163424::provider=org.ldaptive.provider.jndi.JndiProvider at 12bef12b,
config=[org.ldaptive.ConnectionConfig at 108683115::ldapUrl=ldap://127.0.0.1:389,
connectTimeout=3000, responseTimeout=-1,
sslConfig=[org.ldaptive.ssl.SslConfig at 1844460559::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 42156248,
trustManagers=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null], useSSL=false, useStartTLS=true,
connectionInitializer=null]], initialized=true, availableCount=0,
activeCount=0] unable to connect to the ldap
org.ldaptive.provider.ConnectionException:
javax.net.ssl.SSLPeerUnverifiedException: hostname of the server '127.0.0.1'
does not match the hostname in the server's certificate.
	at
org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory.createInternal(JndiStartTLSConnectionFactory.java:100)
Caused by: javax.net.ssl.SSLPeerUnverifiedException: hostname of the server
'127.0.0.1' does not match the hostname in the server's certificate.
	at
com.sun.jndi.ldap.ext.StartTlsResponseImpl.verify(StartTlsResponseImpl.java:447)
Caused by: java.security.cert.CertificateException: No name matching
127.0.0.1 found
	at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:221)
WARN [org.ldaptive.pool.BlockingConnectionPool:534] - unable to create
available connection




-----

el n00b - Trying to understand technology and help create documentation online wherever I get stuck.
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/disable-hostname-check-in-OpenLDAP-tp7628614p7628617.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net