<div dir="ltr">Thank you Peter for your clarifications.<div><br></div><div>I have two questions.</div><div><br></div><div>1.) I have originally installed hibboleth with .msi file on Windows 7 64. LDAP, that I am using has been originaly configured to work only with one enabled connection handler -LDAP on port 389 that has StartTLS disabled, no certificates and stuff. That was plane let say. When I have started Tomcat IdP app was stopped. When I have tried to start I got error from Shibbolets idp-process.log :</div>
<div><br></div><div>[LDAP: error code 52 - StartTLS cannot be enabled on this LDAP client connection because the corresponding LDAP connection handler is configured to reject StartTLS requests. The use of StartTLS can be enabled using the ds-cfg-allow-start-tls configuration attribute]<br>
</div><div><br></div><div style>, from here I see that client side (Shibboleth) is requiring TLS. Correct me if I am wrong. Based on your last response it should not be initiated as an default behavior.</div><div style><br>
</div><div style>2.) I have tried another solution. I have created certificate, installed into LDAP JKS store, set on LDAP 389 connection handler usage of StartTLS. Then I have added that certificate into java central keystore - C:\Program Files\Java\jdk1.6.0_37\jre\lib\security\cacerts. Then I got another error :</div>
<div style><br></div><div style>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target<br>
</div><div style><br></div><div style>then I saw that in Shibboleth directory there is another one keystore, where probably I have to add certificate ? But I do not know password for keystore to open it. (it is not anything from commons such as password or changeit or shibks or something).</div>
<div style><br></div><div style>Regards,</div><div style>Rastko</div><div style><br></div><div style><br></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Feb 28, 2013 at 3:46 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">* Rastko Isajev <<a href="mailto:risajev@calliduscloud.com" target="_blank">risajev@calliduscloud.com</a>> [2013-02-28 15:11]:<br>
<div>> I am facing with problems because of StartTLS that is mandatory when<br>
> Shibboleth is calling LDAP connection handler.<br>
<br>
</div>The Shibboleth software does not have such a requirement, but your DSA<br>
might have.<br>
<br>
If your LDAP server requires the use of TLS and your IdP's JVM cannot<br>
trust the certificate you need to fix one or the other:<br>
Get a proper certificate onto the LDAP server or configure the IdP's<br>
JVM so it has a valid trust path to the issuer of the LDAP server<br>
certificate (e.g. by adding any missing CA or intermediary CA<br>
certificates into the trust store).<br>
<br>
Either way, Shibboleth has no role in this.<br>
<span><font color="#888888">-peter<br>
</font></span><div><div>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><table style="border:currentcolor;border-collapse:collapse"><tbody><tr style="min-height:0px"><td style="padding:7px;border:1px solid rgb(255,255,255)">
<span style="color:rgb(68,68,68)">Kind regards,</span><br><br><table><tbody><tr style="min-height:0px"><td style="padding:7px;border:1px solid rgb(255,255,255)"><div style="text-align:left;display:block">
<div style="text-align:left;display:block"><a href="http://www.calliduscloud.com/" rel="nofollow" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.2&disp=emb&realattid=ac21e313bcd98ab5_0.1.1&zw&atsh=1" border="0"></a></div>
<br>
</div>
<br>
</td><td style="padding:7px;border:1px solid rgb(255,255,255)"><br>
<br>
<br>
<br>
<div style="text-align:left;display:block"><br>
</div>
<div style="text-align:left;display:block">
<div style="text-align:left;display:block"><br>
</div>
<div style="text-align:left;display:block">
<div style="text-align:left;display:block"><br>
</div>
<div style="text-align:left;display:block"><a href="https://sites.google.com/a/calliduscloud.com/callidus-signature-site/sig/Bar.jpg?attredirects=0" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.3&disp=emb&realattid=ac21e313bcd98ab5_0.1.2&zw&atsh=1" border="0"></a></div>
<br>
</div>
<br>
</div>
<br>
</td><td style="padding:7px;border:1px solid rgb(255,255,255)"><br>
<br>
<br>
<span style="color:rgb(102,102,102);font-family:Arial;font-size:13px;font-weight:bold;vertical-align:baseline">Rastko
Isajev</span><br>
<span style="color:rgb(102,102,102);font-family:Arial;font-size:13px;vertical-align:baseline"><i>Software
Developer</i></span><br>
<br>
<span style="color:rgb(102,102,102);font-family:Arial;font-size:13px;vertical-align:baseline">D:
<a value="+381117856561">+381-11-785-6561</a></span><br>
<a href="http://www.calliduscloud.com/" rel="nofollow" target="_blank"><span style="color:rgb(17,85,204);font-family:Arial;font-size:13px;vertical-align:baseline">http://www.calliduscloud.com</span></a><br>
<br>
<a style="line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px" href="http://www.linkedin.com/company/calliduscloud" rel="nofollow" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.6&disp=emb&realattid=ac21e313bcd98ab5_0.1.3&zw&atsh=1" border="0"></a><span style="color:rgb(68,68,68);line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px"> </span><a style="line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px" href="http://twitter.com/calliduscloud" rel="nofollow" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.4&disp=emb&realattid=ac21e313bcd98ab5_0.1.4&zw&atsh=1" border="0"></a><span style="color:rgb(68,68,68);line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px"> </span><a style="line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px" href="http://www.youtube.com/calliduscloudvideos" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.1&disp=emb&realattid=ac21e313bcd98ab5_0.1.5&zw&atsh=1" border="0"></a><span style="color:rgb(68,68,68);line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px"> </span><a style="line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px" href="http://www.facebook.com/callidussoftware" rel="nofollow" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.8&disp=emb&realattid=ac21e313bcd98ab5_0.1.6&zw&atsh=1" border="0"></a><span style="color:rgb(68,68,68);line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px"> </span><a style="line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px" href="http://plus.google.com/u/0/s/calliduscloud" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.5&disp=emb&realattid=ac21e313bcd98ab5_0.1.7&zw&atsh=1" border="0"></a><span style="color:rgb(68,68,68);line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px"> </span><a style="line-height:21px;font-family:Arial,Verdana,sans-serif;font-size:13px" href="http://www.calliduscloud.com/category/salespulseblog/" rel="nofollow" target="_blank"><img src="https://mail.google.com/mail/?ui=2&ik=5d68bdc2ea&view=att&th=13d2563d39d72832&attid=0.7&disp=emb&realattid=ac21e313bcd98ab5_0.1.8&zw&atsh=1" border="0"></a></td>
</tr></tbody></table><br></td>
<td style="padding:7px;border:1px solid rgb(255,255,255)"><br></td>
<td style="padding:7px;border:1px solid rgb(255,255,255)"><br></td></tr></tbody></table></div>
</div></div>
<br>
<a href="http://www.calliduscloudconnections.com/" rel="nofollow" style="color:rgb(0,51,204);text-decoration:underline;background-image:none;background-color:rgb(255,255,255);border-bottom-style:none;font-family:Arial,Verdana,sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:21px;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-repeat:initial initial" target="_blank"><img alt="CallidusCloud Connections" src="https://sites.google.com/a/calliduscloud.com/callidus-signature-site/_/rsrc/1355957960088/c3-signature-addition/c3_sig_2.png" style="border:0px;padding:0px" border="0"></a><span style="color:rgb(68,68,68);font-family:Arial,Verdana,sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:21px;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);display:inline!important;float:none"> CallidusCloud Connections, Las Vegas, May 5-7, 2013,<span> </span></span><font style="font-family:Arial,Verdana,sans-serif;font-size:13px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:21px;text-align:left;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255)" color="#ff9900"><a href="http://www.calliduscloudconnections.com/register.html" rel="nofollow" style="color:rgb(0,51,204);text-decoration:underline" target="_blank">REGISTER NOW</a></font>