<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I hit this issue a few weeks ago, I tried switching off SSL hostname checks but ended up having to switch to plain ldap as the IdP (or the vt ldap library) assumed that the cert offered on AD server 1 should also be trusted on AD server 2 and rejects the cert offered by AD server 2.<div>I should have logged a bug but didn't.</div><div>Glenn</div><div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><a href="http://www.edugate.ie">Edugate</a> Operations</div><div><a href="http://www.heanet.ie">HEAnet Limited</a>, Ireland's Education and Research Network - </div><div>1st Floor, 5 George's Dock, IFSC, Dublin 1</div><div>Registered in Ireland, no 275301 tel: +353-1-6609040 fax: +353-1-6603666</div></div></div></span></span>
</div>
<br><div><div>On 25 Jun 2013, at 00:01, David Bantz wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Wed, 24 Apr 2013, at 10:45 , Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">If you're using LDAP for authentication you would configure the JAAS module as well:</div><div style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">sslSocketFactory="{trustCertificates=file:/path/to/my/trust.crt}"</div></blockquote></div><br><div>Using failover redundancy like</div><div><br></div><div><span style="font-family: monospace; font-size: 11.199999809265137px; background-color: rgb(255, 255, 255); ">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</span> </div><div><span style="background-color: rgb(255, 255, 255); font-family: monospace; font-size: 11.199999809265137px; ">ldapUrl="<a href="ldap://adua01.ua.ad.alaska.edu:3269">ldap://adua01.ua.ad.alaska.edu:3269</a> <a href="ldap://adua02.ua.ad.alaska.edu:3269">ldap://adua02.ua.ad.alaska.edu:3269</a>"</span></div><div><font face="monospace"><span style="font-size: 11px;">…</span></font></div><div><span style="background-color: rgb(255, 255, 255); font-family: monospace; font-size: 11.199999809265137px; "><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: monospace; font-size: 11.199999809265137px; ">can I - if so how would I - indicate different certificates for each server?</span></div><div><span style="background-color: rgb(255, 255, 255); font-family: monospace; font-size: 11.199999809265137px; "><br></span></div><div><span style="background-color: rgb(255, 255, 255); font-family: monospace; font-size: 11.199999809265137px; ">David Bantz</span></div></div>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></body></html>