ldap IdP data connector issue

[IAM David Bantz]

in jaas.config:

  org.ldaptive.jaas.LdapLoginModule sufficient
    ldapUrl="ldap://fbk-adua01.ua.ad.alaska.edu:3268 ldap://
fbk-adua02.ua.ad.alaska.edu:3268"
    baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
    bindDn="cn=uashib...,dc=alaska,dc=edu"
    bindCredential="•••••••••"
    subtreeSearch="true"

sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/credentials/UA_AD_CA.pem}"
    ssl="false"
    tls="true"
    userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"
    connectTimeout="3000"
    resultTimeout="3000"
    ;

successfully authenticates users;
I can also connect to the ldap (AD) servers via StartTLS with those
credentials
in a directory browser (Apache Directory Studio)

BUT in attribute-resolver.xml

    <DataConnector id="uaADLDAP" xsi:type="LDAPDirectory"
      useStartTLS="true"
      ldapURL="ldap://fbk-adua01.ua.ad.alaska.edu:389 ldap://
fbk-adua02.ua.ad.alaska.edu:389" baseDN="dc=ua,dc=ad,dc=alaska,dc=edu"
      principal="cn=uashib...dc=alaska,dc=edu"
principalCredential="••••••••••">
        <FailoverDataConnector ref="FailoverADConnector" />
        <FilterTemplate>
            <![CDATA[
(|(sAMAccountName=$resolutionContext.principal)(uaIdentifier=$resolutionContext.principal))
]]>
        </FilterTemplate>
        <StartTLSTrustCredential id="UA_AD_CA_Certificate"
          xsi:type="sec:X509ResourceBacked">

<sec:Certificate>/opt/shibboleth-idp/credentials/UA_AD_CA.pem</sec:Certificate>
        </StartTLSTrustCredential>
     </DataConnector>

fails connection attempt with log snippet:
DEBUG [10.5.0.58]
org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory:105 >  Error
connecting to LDAP URL: ldap://fbk-adua01.ua.ad.alaska.edu:389
org.ldaptive.provider.ConnectionException:
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target

[debug error message is repeated for the second URL in this connector, then
failover connector succeeds]

identical behavior in IdP 3.2 or 3.4 instance

David Bantz
U Alaska
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190325/8e62a7b3/attachment.html>