<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Bingo! <div><br></div><div>For the record, using TLS on port 3268 rather than SSL on port 3269 successfully established encrypted communication with the AD server using the imported private-CA-issued certificate (config fragment & log output below).</div><div><br></div><div>If this seems worth documenting in the wiki as a sample config, which page would you recommend I add it to?</div><div><br></div><div><div>Thank you!</div><div><br></div><div>David Bantz</div><div><br></div><div><br><div><div>On Tue, 30 Jul 2013, at 08:41 , Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:</div><div><div dir="ltr"><blockquote type="cite">...<div class="gmail_extra"><div class="gmail_quote"><div>Try using port 3268 with ssl="false" and tls="true". Using a custom SSL socket factory with LDAPS is going to require a more complicated configuration than what you have here.</div>
</div></div></blockquote><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div><br></div><div><br></div></div></div></div><br></div></div><div>login.config fragment:</div><div><br></div><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; "><div style="word-wrap: break-word; "><div><font face="Andale Mono">// UA AD Auth</font></div><div><font face="Andale Mono"> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient</font></div><div><font face="Andale Mono"> ldapUrl="<a>ldap://fbk-adua02.ua.ad.alaska.edu:3268</a>"</font></div><div><font face="Andale Mono"> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"</font></div><div><font face="Andale Mono"> bindCredential="••••••••••"</font></div><div><font face="Andale Mono"> subtreeSearch="true"</font></div><div><font face="Andale Mono">// Directly reference imported server certificate for TLS on 3268</font></div><div><font face="Andale Mono"> sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem}"</font></div><div><font face="Andale Mono"> ssl="false"</font></div><div><font face="Andale Mono"> tls="true"</font></div><div><font face="Andale Mono"> userField="sAMAccountName,uaIdentifier";</font></div></div></blockquote></div></div></div><div><br></div><div>debug-level idp-process.log fragment during authN:</div><div><br></div><div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.859 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:170] - Attempting to authenticate user dabantz</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.877 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:180] - useFirstPass = false</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.877 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:181] - tryFirstPass = false</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.878 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:182] - storePass = false</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.878 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:183] - clearPass = false</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.879 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:184] - setLdapPrincipal = true</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.879 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:185] - setLdapDnPrincipal = false</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.879 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:186] - setLdapCredential = true</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.880 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:187] - defaultRole = []</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.880 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:188] - principalGroupName = null</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.881 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:189] - roleGroupName = null</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:23.881 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:77] - userRoleAttribute = []</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.063 - DEBUG [edu.vt.middleware.ldap.ssl.X509CertificatesCredentialReader:76] - Successfully loaded file:/opt/shibboleth-idp/trustedservercerts/Fbk-Adua02.ua.ad.alaska.edu.pem</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.072 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83] - Created authenticator: edu.vt.middleware.ldap.auth.AuthenticatorConfig@1037797730::env={java.naming.provider.url=<a href="ldap://fbk-adua02.ua.ad.alaska.edu:3268">ldap://fbk-adua02.ua.ad.alaska.edu:3268</a>, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.075 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.076 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.076 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.077 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = (|(sAMAccountName={0})(uaIdentifier={0}))</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.077 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [dabantz]</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.077 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls@6db0d235</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.078 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@73b8cdd5]</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.078 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:130] - Bind with the following parameters:</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.079 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:131] - authtype = simple</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.079 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:132] - dn = cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.080 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:139] - credential = <suppressed></font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.406 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:130] - Bind with the following parameters:</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.407 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:131] - authtype = simple</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.408 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:132] - dn = CN=dabantz,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.408 - DEBUG [edu.vt.middleware.ldap.handler.TlsConnectionHandler:139] - credential = <suppressed></font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.656 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:176] - Authentication succeeded for dn: CN=dabantz,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.674 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:108] - Looking up DN using userField</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.675 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the following parameters:</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.675 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = dc=ua,dc=ad,dc=alaska,dc=edu</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.676 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = (|(sAMAccountName={0})(uaIdentifier={0}))</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.676 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs = [dabantz]</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.677 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls = javax.naming.directory.SearchControls@52ed3bff</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.677 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@73b8cdd5]</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.711 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] - Committed the following principals: [dabantz[]]</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.712 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] - Committed the following roles: []</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.712 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:178] - Successfully authenticated user dabantz</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.715 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.716 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.716 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] - Completing user authentication process</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.717 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] - Validating authentication was performed successfully</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.717 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696] - Updating session information for principal dabantz</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.718 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:700] - Creating shibboleth session for principal dabantz</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.734 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:806] - Adding IdP session cookie to HTTP response</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.735 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:715] - Recording authentication and service information in Shibboleth session for principal: dabantz</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.738 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:560] - User dabantz authenticated with method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</font></div><div style="margin: 0px; font-size: 10px; "><font face="Andale Mono">09:37:24.739 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:161] - Returning control to profile handler</font></div></div></div></div></div><div><font face="Andale Mono"><br></font></div></body></html>