Problems connecting to 389 directory server

[Peter Schober]

* Darren Boss <darren.boss at computecanada.ca> [2017-12-05 18:06]:
> Unfortunately we can not directly implement any changes to the ldap server.
> Points two and three have already been tested and I've switched back to
> that exact configuration and it's working, but still with the CA in the
> JRE's CA bundle.

Well, with "idp.authn.LDAP.sslConfig = certificateTrust" set it should
be irrelevant what you have in the JRE's ca bundle. You can file an
issue about that, of course.

> It's a different IT team outside of our organization that controls
> the ldap replica. We can suggest changes but it's at their
> discretion to make the changes.

I'm not saying the incorrect trust chain is the very reason for what
you're experiencing, just that I'd get it fixed while you're at it.
The TLS server sending out the CA root cert does not make anything
more secure (or much sense) -- the TLS client is supposed to have the
trust anchor (e.g. the CA root) available to verify the chain
transmitted by the TLS server (which in your case is just the LDAP
server's own cert as you have no intermediate certs).

Maybe that other team can (temporarily) provide you with a different
replica that has the chain fixed, then you can test with that one.

-peter