<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-US" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal">We haven’t yet completed our move to Shib 3.2.1 on Windows and I found that after an AD (our attribute store) cert renewal I got the following error with the old version while 3.2.1 still worked:</p><p class="MsoNormal"> </p><p class="MsoNormal"><span style="font-family:"Courier New"">16:16:58.336 - ERROR [edu.vt.middleware.ldap.pool.DefaultLdapFactory:109] - unabled to connect to the ldap</span></p><p class="MsoNormal"><span style="font-family:"Courier New"">javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 ]</span></p><p class="MsoNormal"> </p><p class="MsoNormal">Given that the new cert was signed with SHA-2, that seems to be the likely culprit although I’m not exactly sure where I should be looking. The old Linux version is using Tomcat standalone as the container and is running better than Java 1.4.2 which I understand is the floor for SHA-2 support.</p><p class="MsoNormal"> </p><p class="MsoNormal">Despite Java being “OK” is there an IdP limitation as to when a SHA-2 signed cert on an LDAP server used for attribute retrieval is workable?</p><p class="MsoNormal">Thanks for any pointers.</p><p class="MsoNormal"> </p><p class="MsoNormal">--Dave</p><p class="MsoNormal"> </p></div></body></html>