Getting Errors with LDAP Data Connector

[Christopher Bland]

Hi All,

I am building a new v5 IDP from scratch.  When I add a Data Connector for our AD servers I keep getting errors.  My Data Connector looks like this

    <DataConnector id="fduLDAP" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>
            <ConnectionPool
            minPoolSize="%{idp.pool.LDAP.minSize:3}"
            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}" />
    </DataConnector>

I am getting "Error creating bean with name 'fduLDAP': Cannot create inner bean '(inner bean)#1afea182". Our DCs have an InCommon signed cert so I am trying to make use of the OS CA store.

2024-02-28 14:39:43,251 -  - ERROR [net.shibboleth.shared.service.AbstractReloadableService:179] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.shared.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml], class path resource [net/shibboleth/idp/conf/attribute-resolver-system.xml]]
        at net.shibboleth.shared.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:385)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fduLDAP': Cannot create inner bean '(inner bean)#1afea182' of type [org.ldaptive.PooledConnectionFactory] while setting bean property 'connectionFactory'
        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBeanValue(BeanDefinitionValueResolver.java:421)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#1afea182': Cannot create inner bean '(inner bean)#7e3ccedb' of type [org.ldaptive.ConnectionConfig] while setting bean property 'connectionConfig'
        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBeanValue(BeanDefinitionValueResolver.java:421)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#7e3ccedb': Cannot create inner bean '(inner bean)#20e1ce62' of type [org.ldaptive.ssl.SslConfig] while setting bean property 'sslConfig'
        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBeanValue(BeanDefinitionValueResolver.java:421)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#20e1ce62': Cannot create inner bean '(inner bean)#329cdafa' of type [net.shibboleth.idp.attribute.resolver.spring.dc.ldap.impl.CredentialConfigFactoryBean] while setting bean property 'credentialConfig'
        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBeanValue(BeanDefinitionValueResolver.java:421)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#329cdafa': Cannot create inner bean '(inner bean)#1f953e51' of type [org.opensaml.spring.credential.BasicX509CredentialFactoryBean] while setting bean property 'trustCredential'
        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBeanValue(BeanDefinitionValueResolver.java:421)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#1f953e51': IO error
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1770)
Caused by: org.cryptacular.StreamException: IO error
        at org.cryptacular.util.CertUtil.readCertificateChain(CertUtil.java:328)
Caused by: java.io.IOException: extra data at the end
        at java.base/sun.security.util.DerValue.<init>(DerValue.java:428)



My ldap.properties look like

idp.authn.LDAP.authenticator                 = adAuthenticator
idp.authn.LDAP.ldapURL                          = ldaps://adserver1.fdu.edu:3269
idp.authn.LDAP.useStartTLS                    = false
idp.authn.LDAP.connectionStrategy      = ACTIVE_PASSIVE
idp.authn.LDAP.sslConfig                         = certificateTrust
idp.authn.LDAP.trustCertificates.           = /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
idp.authn.LDAP.returnAttributes            = *
idp.authn.LDAP.baseDN                           = dc=fdu,dc=edu
idp.authn.LDAP.subtreeSearch               = true
idp.attribute.resolver.LDAP.searchFilter=(uid=$resolutionContext.principal)
idp.authn.LDAP.bindDN                           = service_account_DN
idp.authn.LDAP.dnFormat                       = undefined
idp.attribute.resolver.LDAP.exportAttributes    = sAMAccountName userPrincipalName givenName sn
idp.pool.LDAP.minSize                             = 3
idp.pool.LDAP.maxSize                            = 10
idp.pool.LDAP.validateOnCheckout      = false
idp.pool.LDAP.validatePeriodically        = true
idp.pool.LDAP.validatePeriod                 = PT5M
idp.pool.LDAP.validateDN                       =
idp.pool.LDAP.validateFilter                   = (objectClass=*)
idp.pool.LDAP.prunePeriod                    = PT5M
idp.pool.LDAP.idleTime                           = PT10M
idp.pool.LDAP.blockWaitTime                = PT3S


-Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240228/bdeedae4/attachment.htm>