Getting Errors with LDAP Data Connector

[Peter Schober]

Peter Schober via users <users at shibboleth.net> [2024-03-01 17:10 CET]:
> IIRC the IDP had support for OS- or JVM-supplied trust stores and
> removed that so that you won't be bitten by somewhat arbitrary CAs
> appearing and possibly disappearing from that trust store

Not the case, sorry. Quoting from the docs:

> We have tentative plans to deprecate the “jvmTrust” option, which has
> already been removed from the attribute resolution side of the
> software, as it is bad practice and has been a source of serious
> security flaws.
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration

So at worst you'd be undoing any potential benefits of such a
(potential, future) change by again referencing an OS-supplied trust
store. YMMV.

> idp.authn.LDAP.trustCertificates.  = /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt

Could that dot at the end of the property name somehow mess that up?

-peter