<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Book Antiqua;color: #000000;font-size: 12pt;">
Hi,<br>
<br>
There is no load balancer performing the SSL-offloading on the shibboleth server Below is the cert.<br>
<br>
Owner: CN=*.fiu.edu, OU=Comodo PremiumSSL Wildcard, OU=Hosted by Florida International University, OU=Florida International University, O=Division of Information Technology, STREET=11200 SW 8th St, L=Miami, ST=FL, OID.2.5.4.17=33199, C=US<br>
<br>
<div>Also found some extra information when I turned on Debug for ldap:<br>
16:25:56.858 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:123] - hostname = fiuldap1.fiu.edu<br>
16:25:56.859 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:124] - cert = CN=rhldapc03.fiu.edu, OU=Division of Information Technology, O=Florida International University, L=Miami, ST=Alabama, C=US<br>
16:25:56.871 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:197] - verifyDNS using subjectAltNames = []<br>
16:25:56.872 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:214] - verifyDNS using CN = [rhldapc03.fiu.edu]<br>
16:25:56.904 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: ldaps://fiuldap1.fiu.edu<br>
<br>
<div><font face="Book Antiqua">___________________<br>
</font><font face="book antiqua">Juan Quintanilla</font></div>
<div><font face="book antiqua">UTS - Enterprise Group</font></div>
<div><font face="book antiqua">305-348-6573</font></div>
<div><font face="book antiqua"><a href="mailto:jquin014@fiu.edu">jquin014@fiu.edu</a></font></div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF112210"><font color="#000000" face="Tahoma" size="2"><b>From:</b> users-bounces@shibboleth.net [users-bounces@shibboleth.net] on behalf of Daniel Fisher [dfisher@vt.edu]<br>
<b>Sent:</b> Monday, February 27, 2012 4:18 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Security Advisory 20120227<br>
</font><br>
</div>
<div></div>
<div>DEBUG logs for the edu.vt.middleware.ldap package would also be helpful.<br>
<br>
<div class="gmail_quote">On Mon, Feb 27, 2012 at 4:14 PM, Chad La Joie <span dir="ltr">
<<a href="mailto:lajoie@shibboleth.net" target="_blank">lajoie@shibboleth.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Can you provide the cert? Is there a load balancer performing<br>
SSL-offloading involved at all?<br>
<div class="HOEnZb">
<div class="h5"><br>
On 2/27/12 4:01 PM, Juan Quintanilla wrote:<br>
> Hi,<br>
><br>
> I'm getting a similar error with connection to ldap. We use a wild card cert *.<a href="http://fiu.edu" target="_blank">fiu.edu</a> and the message we receive is:<br>
><br>
> 15:14:00.487 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unabled to connect to the ldap<br>
> javax.naming.CommunicationException: simple bind failed: <a href="http://fiuldap1.fiu.edu:636" target="_blank">
fiuldap1.fiu.edu:636</a><br>
><br>
> Caused by: java.security.cert.CertificateException: Hostname '[<a href="http://fiuldap1.fiu.edu" target="_blank">fiuldap1.fiu.edu</a>]' does not match the hostname in the server's certificate<br>
><br>
> Any ideas?<br>
><br>
> Thanks!<br>
> ___________________<br>
> Juan Quintanilla<br>
> UTS - Enterprise Group<br>
> <a href="tel:305-348-6573" value="+13053486573" target="_blank">305-348-6573</a><br>
> <a href="mailto:jquin014@fiu.edu" target="_blank">jquin014@fiu.edu</a><br>
> ________________________________________<br>
> From: <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>] on behalf of Mark Cairney [<a href="mailto:mark.cairney@ed.ac.uk" target="_blank">mark.cairney@ed.ac.uk</a>]<br>
> Sent: Monday, February 27, 2012 10:49 AM<br>
> To: Shib Users<br>
> Subject: Re: Security Advisory 20120227<br>
><br>
> OK I've amended my config to point at one of the individual servers which does match the *.<a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a> pattern and that seems to be working.<br>
><br>
> <a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a> is a round-robin DNS between 2 servers. We do have another identical round-robin DNS which does match the pattern- using this instead would be the simplest solution.<br>
><br>
> Thanks,<br>
><br>
> Mark<br>
><br>
> On 27 Feb 2012, at 15:38, Cantor, Scott wrote:<br>
><br>
>> On 2/27/12 10:28 AM, "Mark Cairney" <<a href="mailto:mark.cairney@ed.ac.uk" target="_blank">mark.cairney@ed.ac.uk</a>> wrote:<br>
>>><br>
>>> 15:22:25.776 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109]<br>
>>> - unabled to connect to the ldap<br>
>>> javax.naming.CommunicationException: hostname of the server<br>
>>> '<a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a>' does not match the hostname in the server's<br>
>>> certificate.<br>
>><br>
>> That doesn't match the wildcard you have here:<br>
>><br>
>>> Owner: EMAILADDRESS=<a href="mailto:ext6033@ed.ac.uk" target="_blank">ext6033@ed.ac.uk</a>, CN=*.<a href="http://authorise-test.is.ed.ac.uk" target="_blank">authorise-test.is.ed.ac.uk</a>,<br>
>>> OU=Information Services, O=University of Edinburgh, L=Edinburgh,<br>
>>> ST=Scotland, C=GB<br>
>><br>
>> That would be a bug to accept it.<br>
>><br>
>>> Is this expected behaviour and are you aware of any workarounds? This<br>
>>> setup was working fine with Shibboleth 2.3.5..<br>
>><br>
>> That's because the library in 2.3.5 didn't verify it at all.<br>
>><br>
>> I believe Daniel allowed for an override of the hostname verification via<br>
>> a custom class. I don't know if there's a class built-in that literally<br>
>> disables the check.<br>
>><br>
>> -- Scott<br>
>><br>
>> --<br>
>> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
>><br>
><br>
> /*********************************<br>
> Mark Cairney<br>
> ITI UNIX Section<br>
> Information Services<br>
> University of Edinburgh<br>
><br>
> Tel: 0131 650 6565<br>
> Email: <a href="mailto:mark.cairney@ed.ac.uk" target="_blank">mark.cairney@ed.ac.uk</a><br>
><br>
> *********************************/<br>
><br>
><br>
> --<br>
> The University of Edinburgh is a charitable body, registered in<br>
> Scotland, with registration number SC005336.<br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>