Question about LDAP connection failure

Wed Feb 21 13:28:53 UTC 2024

Hello, 

First, sorry by advance for any langague error and if this question is kind of trivial, I'm new to Shibboleth. 

My goal is to have an instance of shibboleth with a data connector on my ldap server for an internal service provider. 

I have installed and configured an IDP with Shibboleth 4.3.1 and did some functionnallities tests with a sandbow ldap server, everything was fine and the idp send all the attributes i needed. 

Then, i tried to change the ldap server and test with my ldap server on production. And when i test the connection i have an error on the ldap connection (full log in attachement): 

2024-02-21 08:40:27,476 - 192.168.2.19 - ERROR [org.ldaptive.pool.BlockingConnectionPool:461] - [org.ldaptive.pool.BlockingConnectionPool at 1289092605::name=dn-search-pool, poolConfig=[org.ldaptive.pool.PoolConfig at 2104400321::minPoolSize=3, maxPoolSize=10, validateOnCheckIn=false, validateOnCheckOut=false, validatePeriodically=true, validatePeriod=PT5M, validateTimeout=PT5S], activator=null, passivator=null, validator=[org.ldaptive.pool.SearchValidator at 1955505091::searchRequest=[org.ldaptive.SearchRequest at 1134780430::baseDn=, searchFilter=[org.ldaptive.SearchFilter at 1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=PT0S, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, referralHandler=null, intermediateResponseHandlers=null]] pruneStrategy=[org.ldaptive.pool.IdlePruneStrategy at 965952871::prunePeriod=PT5M, idleTime=PT10M], connectOnCreate=true, connectionFactory=[org.ldaptive.DefaultConnectionFactory at 1514831293::provider=org.ldaptive.provider.unboundid.UnboundIDProvider at 536347a4, config=[org.ldaptive.ConnectionConfig at 1391621808::ldapUrl=ldaps://ldap.server.fr:636, connectTimeout=PT3S, responseTimeout=PT3S, sslConfig=[org.ldaptive.ssl.SslConfig at 1902750196::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 65566ab3, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=null, connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy at 78c785f1]], initialized=true, availableCount=0, activeCount=0] unable to connect to the ldap 
org.ldaptive.provider.ConnectionException: LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server ldap.server.fr:636:  IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server ldap.server.fr/x.x.x.x:636:  SSLHandshakeException(Received fatal alert: handshake_failure), ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb'))') 

I am quite surprised by the sslConfig in the log because it says that "useSSL=false" whereas i use the "ldaps" in the ldapURL configuration: 

Log extract: " sslConfig=[org.ldaptive.ssl.SslConfig at 1902750196::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 65566ab3, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false , useStartTLS=false, connectionInitializer=null, connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy at 78c785f1]], initialized=true, availableCount=0, activeCount=0]" 

My configuration on ldap.properties and attribute-resolver: 

    * ldap.properties: 

## Connection properties ## 

BQ_BEGIN

idp.authn.LDAP.ldapURL                         = ldaps://ldap.server.fr:636 
idp.authn.LDAP.useStartTLS                     = false 
## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust 
idp.authn.LDAP.sslConfig                       = certificateTrust 
## If using certificateTrust above, set to the trusted certificate's path 
idp.authn.LDAP.trustCertificates                = %{idp.home}/credentials/ldap-server.crt 

BQ_END

    * attribute-resolver: 

BQ_BEGIN

<DataConnector id="myLDAP" xsi:type="LDAPDirectory" 
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}" 
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
principal="%{idp.attribute.resolver.LDAP.bindDN}" 
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}" 
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}" 
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}" 
exportAttributes="uid"> 
<FilterTemplate> 
<![CDATA[ 
%{idp.attribute.resolver.LDAP.searchFilter} 
]]> 
</FilterTemplate> 
</DataConnector> 

BQ_END

Did i do something wrong to specify the use of SSL? I use the wiki page for my configuration: [ https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration | https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration ] 

About the certificate, I made some check ont the two certificates and i guess the main difference is in the signature of pub key, one is encrypted using SHA1 hash and the other using SHA256: 

    * On the production ldap server: 

BQ_BEGIN

Certificate chain 
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1 
v:NotBefore: Sep 17 06:35:52 2015 GMT; NotAfter: Sep 14 06:35:52 2025 GMT 
SSL handshake has read 1559 bytes and written 397 bytes 
Verification error: self-signed certificate 

BQ_END

    * On the sandbox ldap server: 

BQ_BEGIN

a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 
v:NotBefore: Sep 29 08:38:39 2023 GMT; NotAfter: Sep 26 08:38:39 2033 GMT 
SSL handshake has read 1539 bytes and written 402 bytes 
Verification error: self-signed certificate 

BQ_END

I know that using the SHA1 hash is not a good thing, we are trying to re-sign the pubkey with a SHA256 hash (and migrate the server but this is not planified for now). I must add that we have an another instance of Shibboleth (version 3) which doesn't have this error, i don"t know if it's relevant. 

In the meantime, i would like to know if there's a way of configure my shibboleth for accepting this certificate? 

I didn't find anything on the LDAP configuration wiki page ( [ https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration | https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration ] ), i tried to look on the idp.properties and the idp.trusting.signatures options but id didn't find the right configuration. 

Many thanks by advance for your time and help, 

Best regards, 

Emilie 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240221/eb62cc35/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: error-log-idp-ldap-connection.zip
Type: application/zip
Size: 9164 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240221/eb62cc35/attachment.zip>