DEBUG logs for the edu.vt.middleware.ldap package would also be helpful.<br><br><div class="gmail_quote">On Mon, Feb 27, 2012 at 4:14 PM, Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@shibboleth.net">lajoie@shibboleth.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Can you provide the cert? Is there a load balancer performing<br>
SSL-offloading involved at all?<br>
<div class="HOEnZb"><div class="h5"><br>
On 2/27/12 4:01 PM, Juan Quintanilla wrote:<br>
> Hi,<br>
><br>
> I'm getting a similar error with connection to ldap. We use a wild card cert *.<a href="http://fiu.edu" target="_blank">fiu.edu</a> and the message we receive is:<br>
><br>
> 15:14:00.487 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unabled to connect to the ldap<br>
> javax.naming.CommunicationException: simple bind failed: <a href="http://fiuldap1.fiu.edu:636" target="_blank">fiuldap1.fiu.edu:636</a><br>
><br>
> Caused by: java.security.cert.CertificateException: Hostname '[<a href="http://fiuldap1.fiu.edu" target="_blank">fiuldap1.fiu.edu</a>]' does not match the hostname in the server's certificate<br>
><br>
> Any ideas?<br>
><br>
> Thanks!<br>
> ___________________<br>
> Juan Quintanilla<br>
> UTS - Enterprise Group<br>
> <a href="tel:305-348-6573" value="+13053486573">305-348-6573</a><br>
> <a href="mailto:jquin014@fiu.edu">jquin014@fiu.edu</a><br>
> ________________________________________<br>
> From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] on behalf of Mark Cairney [<a href="mailto:mark.cairney@ed.ac.uk">mark.cairney@ed.ac.uk</a>]<br>
> Sent: Monday, February 27, 2012 10:49 AM<br>
> To: Shib Users<br>
> Subject: Re: Security Advisory 20120227<br>
><br>
> OK I've amended my config to point at one of the individual servers which does match the *.<a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a> pattern and that seems to be working.<br>
><br>
> <a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a> is a round-robin DNS between 2 servers. We do have another identical round-robin DNS which does match the pattern- using this instead would be the simplest solution.<br>
><br>
> Thanks,<br>
><br>
> Mark<br>
><br>
> On 27 Feb 2012, at 15:38, Cantor, Scott wrote:<br>
><br>
>> On 2/27/12 10:28 AM, "Mark Cairney" <<a href="mailto:mark.cairney@ed.ac.uk">mark.cairney@ed.ac.uk</a>> wrote:<br>
>>><br>
>>> 15:22:25.776 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109]<br>
>>> - unabled to connect to the ldap<br>
>>> javax.naming.CommunicationException: hostname of the server<br>
>>> '<a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a>' does not match the hostname in the server's<br>
>>> certificate.<br>
>><br>
>> That doesn't match the wildcard you have here:<br>
>><br>
>>> Owner: EMAILADDRESS=<a href="mailto:ext6033@ed.ac.uk">ext6033@ed.ac.uk</a>, CN=*.<a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a>,<br>
>>> OU=Information Services, O=University of Edinburgh, L=Edinburgh,<br>
>>> ST=Scotland, C=GB<br>
>><br>
>> That would be a bug to accept it.<br>
>><br>
>>> Is this expected behaviour and are you aware of any workarounds? This<br>
>>> setup was working fine with Shibboleth 2.3.5..<br>
>><br>
>> That's because the library in 2.3.5 didn't verify it at all.<br>
>><br>
>> I believe Daniel allowed for an override of the hostname verification via<br>
>> a custom class. I don't know if there's a class built-in that literally<br>
>> disables the check.<br>
>><br>
>> -- Scott<br>
>><br>
>> --<br>
>> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>><br>
><br>
> /*********************************<br>
> Mark Cairney<br>
> ITI UNIX Section<br>
> Information Services<br>
> University of Edinburgh<br>
><br>
> Tel: 0131 650 6565<br>
> Email: <a href="mailto:mark.cairney@ed.ac.uk">mark.cairney@ed.ac.uk</a><br>
><br>
> *********************************/<br>
><br>
><br>
> --<br>
> The University of Edinburgh is a charitable body, registered in<br>
> Scotland, with registration number SC005336.<br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>