<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div><i>With the following in login.config to use and trust a private-CA certificate:</i></div><div><br></div><div><div><font face="Andale Mono">// UA AD Auth</font></div><div><font face="Andale Mono"> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></div><div><font face="Andale Mono">// ldapUrl="<a href="ldap://fbk-adua01.ua.ad.alaska.edu:3269">ldap://fbk-adua01.ua.ad.alaska.edu:3269</a> </font></div><div><font face="Andale Mono"> ldapUrl="<a href="ldap://fbk-adua02.ua.ad.alaska.edu:3269">ldap://fbk-adua02.ua.ad.alaska.edu:3269</a>"</font></div><div><font face="Andale Mono"> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindCredential="••••••••••"</font></div><div><font face="Andale Mono"> subtreeSearch="true"</font></div><div><font face="Andale Mono">// Directly reference imported server certificate </font></div><div><font face="Andale Mono"> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"</font></div><div><font face="Andale Mono"> ssl="true"</font></div><div><font face="Andale Mono"> tls="false"</font></div><div><font face="Andale Mono"> userField="sAMAccountName,uaIdentifier";</font></div></div><div><br></div><div><i>Logs indicate the certificate file is loaded during authN:</i></div><div><br></div><div><div><font face="Andale Mono">15:44:59.767 - DEBUG [edu.vt.middleware.ldap.ssl.X509CertificatesCredentialReader:76] - Successfully loaded file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem</font></div><div><font face="Andale Mono">15:44:59.768 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] - Created authenticator: edu.vt.middleware.ldap.auth.AuthenticatorConfig@559102764::env={java.naming.provider.url=<a href="ldap://fbk-adua02.ua.ad.alaska.edu:3269">ldap://fbk-adua02.ua.ad.alaska.edu:3269</a>, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl, java.naming.ldap.factory.socket=edu.vt.middleware.ldap.ssl.TLSSocketFactory}</font></div><div><font face="Andale Mono">15:44:59.768 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField</font></div><div><font face="Andale Mono">15:44:59.769 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:</font></div><div><font face="Andale Mono">15:44:59.769 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div><font face="Andale Mono">15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = (|(sAMAccountName={0})(uaIdentifier={0}))</font></div><div><font face="Andale Mono">15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [dabantz]</font></div><div><font face="Andale Mono">15:44:59.770 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls@5f51d6cb</font></div><div><font face="Andale Mono">15:44:59.771 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@75ecda50]</font></div><div><br></div><div><i>but the bind fails with "unable to find valid certification path to requested target:"</i></div><div><br></div><div><font face="Andale Mono">15:44:59.771 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:</font></div><div><font face="Andale Mono">15:44:59.772 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype = simple</font></div><div><font face="Andale Mono">15:44:59.772 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn = cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div><font face="Andale Mono">15:44:59.772 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential = <suppressed></font></div><div><font face="Andale Mono">15:45:00.361 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error connecting to LDAP URL: <a href="ldap://fbk-adua02.ua.ad.alaska.edu:3269">ldap://fbk-adua02.ua.ad.alaska.edu:3269</a></font></div><div><font face="Andale Mono">javax.naming.CommunicationException: simple bind failed: fbk-adua02.<a href="http://ua.ad.alaska.edu">ua.ad.alaska.edu</a>:3269</font></div></div><div><font face="Andale Mono">…</font></div><div><div><font face="Andale Mono">Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</font></div></div><div><font face="Andale Mono">…</font></div><div><div><font face="Andale Mono">Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</font></div><div><font face="Andale Mono">…</font></div><div><font face="Andale Mono">Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</font></div></div><div><br></div><div><i>What are the possible sources of this failure other than having been provided the wrong certificate for the server? Do I ALSO need to import the issuing CA certificate? Use a different certificate file format? …</i></div><div><i><br></i></div><div><i>Thanks in advance,</i></div><div><i><br></i></div><div><i>David Bantz</i></div><div><i>U Alaska</i></div></body></html>