<div dir="ltr">On Mon, Jul 29, 2013 at 8:16 PM, David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><br></div><div><i>With the following in login.config to use and trust a private-CA certificate:</i></div>
<div><br></div><div><div><font face="Andale Mono">// UA AD Auth</font></div><div><font face="Andale Mono"> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></div><div><font face="Andale Mono">// ldapUrl="<a>ldap://fbk-adua01.ua.ad.alaska.edu:3269</a> </font></div>
<div><font face="Andale Mono"> ldapUrl="<a>ldap://fbk-adua02.ua.ad.alaska.edu:3269</a>"</font></div><div><font face="Andale Mono"> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"</font></div>
<div><font face="Andale Mono"> bindCredential="••••••••••"</font></div><div><font face="Andale Mono"> subtreeSearch="true"</font></div><div><font face="Andale Mono">// Directly reference imported server certificate </font></div>
<div><font face="Andale Mono"> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"</font></div><div><font face="Andale Mono"> ssl="true"</font></div>
<div><font face="Andale Mono"> tls="false"</font></div><div><font face="Andale Mono"> userField="sAMAccountName,uaIdentifier";</font></div></div></div></blockquote><div><br></div><div>Try using port 3268 with ssl="false" and tls="true". Using a custom SSL socket factory with LDAPS is going to require a more complicated configuration than what you have here.</div>
<div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div>