<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Tue, 25 Jun 2013, at 18:37 , Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">On Tue, Jun 25, 2013 at 1:15 PM, David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br></div></blockquote><br><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; "><div style="word-wrap:break-word"><div>... in our IdP I do already have a non-AD LDAP in parallel to the AD authenticator with both as "sufficient." The non-AD LDAP is an 8-node cluster, but the AD instances are not clustered, so I have to specify individual servers, which I've been doing with </div><div>
<div><span style=""><font face="Andale Mono">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></span></div><div><span style=""><font face="Andale Mono"> ldapUrl="<a>ldap://ad01.ua.ad.alaska.edu:3269</a> <a>ldap://ad02.ua.ad.alaska.edu:3269</a>"</font></span></div>
</div><div style="font-size:11px"> <span style="white-space:pre-wrap"> </span> ...</div></div></blockquote><div><br></div><div style="">I'm still unclear on your configuration. You're specifying failover hosts in the ldapUrl parameter and you're putting trust material for only the first host in a file that is specified with <span style="font-family:Helvetica;text-align:-webkit-auto">sslSocketFactory="{</span><span style="font-family:Helvetica;text-align:-webkit-auto">trustCertificates=file:/path/</span><span style="font-family:Helvetica;text-align:-webkit-auto">to/my/trust.crt}" ? Is that correct?</span></div></div></div></div></blockquote><div><br></div>My existing production config is failover in the ldapUrl parameter without any sslSocketFactory statement, relying on certificate signed by known CA (Comodo) for the AD server(s). The AD server group going forward will use only the certificates from the MS (private) CA, so I need a revised configuration that will utilize those new certificates issued by the private CA. So far, I have a revised configuration in test mode for a single server with sslSociketFactory trusting a certificate. But of course I would like failover server(s) as well as trust of imported certificates. </div><div><br></div><div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">
<div style=""><span style="font-family:Helvetica;text-align:-webkit-auto"><br></span></div><div style=""><span style="font-family:Helvetica;text-align:-webkit-auto">--Daniel Fisher</span></div></div></div></div></blockquote></div><br></body></html>