Getting Errors with LDAP Data Connector

[Peter Schober]

Christopher Bland via users <users at shibboleth.net> [2024-02-28 20:49 CET]:
> I am getting "Error creating bean with name 'fduLDAP': Cannot create
> inner bean '(inner bean)#1afea182". Our DCs have an InCommon signed
> cert so I am trying to make use of the OS CA store.

IIRC the IDP had support for OS- or JVM-supplied trust stores and
removed that so that you won't be bitten by somewhat arbitrary CAs
appearing and possibly disappearing from that trust store, when you
(likely) know very well from what CA(s) your LDAP servers get their
certs issued.
So maybe point to a local file that only contains the trust anchors
for actually used CAs, instead?

> Caused by: org.cryptacular.StreamException: IO error
>         at org.cryptacular.util.CertUtil.readCertificateChain(CertUtil.java:328)
> Caused by: java.io.IOException: extra data at the end
>         at java.base/sun.security.util.DerValue.<init>(DerValue.java:428)

Well, sounds like the referenced file
/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
is not of the expected format?
Can you try implementing the above suggestion and see whether that
also fixes the error above?

-peter