<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://3729/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Etan,
<div><br>
</div>
<div><a href="http://shibboleth.net/community/advisories/secadv_20120227.txt">http://shibboleth.net/community/advisories/secadv_20120227.txt</a></div>
<div><br>
</div>
<div>Ignoring the mismatch is not as good a solution as getting a valid certificate issued with subjectAltNames and I'm not sure it's supported. Details on how matching is performed:</div>
<div><br>
</div>
<div><a href="http://www.ldaptive.org/docs/guide/connections">http://www.ldaptive.org/docs/guide/connections</a></div>
<div><br>
</div>
<div>Thanks,</div>
<div>Nate.</div>
<div><br>
<div>
<div>On Jun 6, 2013, at 15:02 , Etan Weintraub wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Hi all-<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
I need some help. This currently works in our test and production environments, but I’m trying to set up our new test environment (going to IdP v2.4.0) and I can’t get this piece to work or remember how I got it to work on the old systems. We use Active Directory
for our backend LDAP servers that we access in the attribute-resolver.xml. We have a shared server name of “wintest.johnshopkins.edu”, that is essentially a DNS round robin for the servers. Each individual server has its own certificate with its own hostname
on it (i.e. wintestserver1.wintest.adtest.jhu.edu). Whenever I start Tomcat, I get an error in the idp-process.log that contains the string “java.security.cert.CertificateException: Hostname '[wintest.johnshopkins.edu]' does not match the hostname in the server's
certificate” (there is a bunch more to the error as far as java errors, but this is I believe the key part).<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Anyone know how to ignore the hostname mismatch for LDAPS connections in attribute-resolver.xml?<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
-Etan E. Weintraub<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Sr. Systems Engineer<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Directory Architecture<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
IT@Johns Hopkins<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Johns Hopkins at Mt. Washington<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
5801 Smith Ave.<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Suite 3110B<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Baltimore, MD 21209<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Phone: 410-735-7945<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
E-mail:<span class="Apple-converted-space"> </span><a href="mailto:eweintra@jhmi.edu" style="color: rgb(5, 99, 193); text-decoration: underline; "><span style="color: windowtext; ">eweintra@jhmi.edu</span></a><o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
</div>
--<br>
To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: rgb(5, 99, 193); text-decoration: underline; ">users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</body>
</html>