<div dir="ltr">On Wed, Jun 26, 2013 at 1:24 AM, David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><div>
<div>On Tue, 25 Jun 2013, at 18:37 , Daniel Fisher <<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>> wrote:</div><br><blockquote type="cite"><div dir="ltr">On Tue, Jun 25, 2013 at 1:15 PM, David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br>
</div></blockquote><br></div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="word-wrap:break-word"><div>... in our IdP I do already have a non-AD LDAP in parallel to the AD authenticator with both as "sufficient." The non-AD LDAP is an 8-node cluster, but the AD instances are not clustered, so I have to specify individual servers, which I've been doing with </div>
<div><div>
<div><span><font face="Andale Mono">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></span></div><div><span><font face="Andale Mono"> ldapUrl="<a>ldap://ad01.ua.ad.alaska.edu:3269</a> <a>ldap://ad02.ua.ad.alaska.edu:3269</a>"</font></span></div>
</div><div style="font-size:11px"> <span style="white-space:pre-wrap"> </span> ...</div></div></div></blockquote><div><div><br></div><div>I'm still unclear on your configuration. You're specifying failover hosts in the ldapUrl parameter and you're putting trust material for only the first host in a file that is specified with <span style="font-family:Helvetica;text-align:-webkit-auto">sslSocketFactory="{</span><span style="font-family:Helvetica;text-align:-webkit-auto">trustCertificates=file:/path/</span><span style="font-family:Helvetica;text-align:-webkit-auto">to/my/trust.crt}" ? Is that correct?</span></div>
</div></div></div></div></blockquote><div><br></div>My existing production config is failover in the ldapUrl parameter without any sslSocketFactory statement, relying on certificate signed by known CA (Comodo) for the AD server(s). The AD server group going forward will use only the certificates from the MS (private) CA, so I need a revised configuration that will utilize those new certificates issued by the private CA. So far, I have a revised configuration in test mode for a single server with sslSociketFactory trusting a certificate. But of course I would like failover server(s) as well as trust of imported certificates. </div>
<div><br></div></div></blockquote><div><br></div><div style>So you should be able to put *all* your trust material in the trust.crt file for this to work, however I notice that you are using the GC port 3269. Can you switch to port 3268 and use startTLS?</div>
<div style>The SSL socket factory configuration for LDAPS is a bit more involved.</div><div><br></div><div>--Daniel Fisher</div><div><br></div>
</div></div></div>