<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div style="font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; ">The config below for a single server configured to trust a single imported server cert works (with needed assist from Daniel Fisher).</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; ">There seem to be at least two conceivable routes to add redundancy:</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><br></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span>(A) "stacked" login modules for multiple AD server instances:</div><div style="text-align: -webkit-auto; "><span style="background-color: rgb(255, 255, 255); text-align: left; "><span class="Apple-tab-span" style="white-space: pre; "> </span>edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><code class="java plain" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; "> ldapUrl=</code><code class="java string" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; color: rgb(0, 51, 102) !important; ">"ldap://</code><a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268" style="font-family: 'Andale Mono'; ">ad02.ua.ad.alaska.edu:3268</a><span style="font-family: 'Andale Mono'; ">"</span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span>…</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span><span style="background-color: rgb(255, 255, 255); font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 12px; line-height: 14px; text-align: left; white-space: pre-wrap; ">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span><code class="java plain" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; ">ldapUrl=</code><code class="java string" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; color: rgb(0, 51, 102) !important; ">"ldap://</code><a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268" style="font-family: 'Andale Mono'; ">ad03.ua.ad.alaska.edu:3268</a><span style="font-family: 'Andale Mono'; ">"</span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span>..., or</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><br></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span>(B) "failover" configuration with multiple server instances in a single module:</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span><span style="background-color: rgb(255, 255, 255); text-align: left; ">edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span style="background-color: rgb(255, 255, 255); text-align: left; "><span class="Apple-tab-span" style="white-space:pre"> </span></span><code class="java plain" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; ">ldapUrl=</code><code class="java string" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; color: rgb(0, 51, 102) !important; ">"ldap://</code><a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268" style="font-family: 'Andale Mono'; ">fbk-adua02.ua.ad.alaska.edu:3268</a> <code class="java string" style="font-size: 1em !important; line-height: 1.2em !important; text-align: left; white-space: pre-wrap; border-top-left-radius: 0px !important; border-top-right-radius: 0px !important; border-bottom-right-radius: 0px !important; border-bottom-left-radius: 0px !important; background-image: none !important; border: 0px !important; bottom: auto !important; float: none !important; height: auto !important; left: auto !important; margin: 0px !important; outline: 0px !important; overflow: visible !important; padding: 0px !important; position: static !important; right: auto !important; top: auto !important; vertical-align: baseline !important; width: auto !important; box-sizing: content-box !important; font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace !important; color: rgb(0, 51, 102) !important; ">ldap://</code><a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268" style="font-family: 'Andale Mono'; ">fbk-adua03.ua.ad.alaska.edu:3268</a><span style="font-family: 'Andale Mono'; ">"</span></div><div style="font-size: medium; line-height: normal; white-space: normal; "><font face="Andale Mono"> </font><span style="font-family: 'Andale Mono'; ">sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/????}"</span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; ">(B) may be infeasible unless there is some way to include reference to multiple trusted server certificates (non-obviousi to me). </div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; ">If there is such a mechanism, is (A) or (B) or some third way preferable for high availability based on redundancy?</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><span class="Apple-tab-span" style="white-space:pre"> </span></div></div></div></div>David Bantz</div><div><br></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; ">login.config fragment:</div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><br></div><div style="font-family: Helvetica; font-size: medium; line-height: normal; white-space: normal; "><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; "><div style="word-wrap: break-word; "><div><font face="Andale Mono">// UA AD Auth</font></div><div><font face="Andale Mono"> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></div><div><font face="Andale Mono"> ldapUrl="<a></a><a href="ldap://ad02.ua.ad.alaska.edu:3268">ldap://ad02.ua.ad.alaska.edu:3268</a>"</font></div><div><font face="Andale Mono"> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindCredential="••••••••••"</font></div><div><font face="Andale Mono"> subtreeSearch="true"</font></div><div><font face="Andale Mono">// Directly reference imported server certificate for TLS on 3268</font></div><div><font face="Andale Mono"> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Ad02.ua.ad.alaska.edu.pem}"</font></div><div><font face="Andale Mono"> ssl="false"</font></div><div><font face="Andale Mono"> tls="true"</font></div><div><font face="Andale Mono"> userField="sAMAccountName,uaIdentifier";</font></div></div></blockquote></div></div></div></div></div></div><br></body></html>