<div dir="ltr">I ended up getting it to work but I did have to import the CA of the cert in der format into the JRE keystore in order to get it to connect and I'm NOT using jvmTrust in my ldap.properties file. This seems to contradict what I've read in the documentation and on the mailing list.<br></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Dec 4, 2017 at 12:58 PM Darren Boss <<a href="mailto:darren.boss@computecanada.ca">darren.boss@computecanada.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I have experience using OpenLDAP for authentication and attribute resolution, it's what our Compute Canada IdP uses and I've had no issues establishing TLS connection.<br><br></div>For this installation we are attempting to setup an IdP for a platform using our infrastructure and they use 389 Directory Server (<a href="http://directory.fedoraproject.org/" target="_blank">http://directory.fedoraproject.org/</a>). Again, I'm setting it up for both authentication and attribute resolution. On startup, here is a snipit of the relevant error message.<br><br>2017-12-02 16:52:51,564 - ERROR [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator:152] - Connection factory validation failed <br>org.ldaptive.provider.ConnectionException: javax.naming.CommunicationException: <redacted>:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.Validato<br>rException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]<br><br></div>More of the log messages available at:<br><div><div><br><a href="https://pastebin.com/huZK9FUB" target="_blank">https://pastebin.com/huZK9FUB</a><br></div></div></div><div dir="ltr">-- <br></div><div class="m_-7639558470803502787gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><p style="margin-bottom:0in;line-height:100%"><font color="#ff0000"><font face="arial, sans-serif"><font style="font-size:10pt" size="2"><b>Darren
Boss</b></font></font></font></p><font style="font-size:10pt" size="2"><i>Senior Programmer/Analyst</i></font><font style="font-size:10pt" size="2"><i><br>Programmeur-analyste principal</i></font><font style="font-size:10pt" size="2"><i><br><a href="mailto:darren.boss@computecanada.ca" target="_blank">darren.boss@computecanada.ca</a></i></font><font style="font-size:10pt" size="2"><i><br>(o)
<a href="tel:(416)%20228-1234" value="+14162281234" target="_blank">416.228.1234</a> x </i></font><font color="#000000"><font style="font-size:10pt" size="2">230<br></font></font></div><font color="#000000"><font style="font-size:10pt" size="2"><i>(c) <a href="tel:(919)%20525-0083" value="+19195250083" target="_blank">919.525.0083</a></i><br></font></font><div><font color="#000000"><font size="2"><br><span style="color:rgb(0,0,0);font-size:12.8px" class="m_-7639558470803502787gmail_msg">155 University Ave, Suite 302 Toronto, ON M5H 3B7</span><font class="m_-7639558470803502787gmail_msg" size="2"><br style="color:rgb(0,0,0)" class="m_-7639558470803502787gmail_msg"><span style="color:rgb(0,0,0)" class="m_-7639558470803502787gmail_msg"><a href="http://www.computecanada.ca" class="m_-7639558470803502787gmail_msg" target="_blank">www.computecanada.ca</a> / <a href="http://www.calculcanada.ca" class="m_-7639558470803502787gmail_msg" target="_blank">www.calculcanada.ca</a> </span><br style="color:rgb(0,0,0)" class="m_-7639558470803502787gmail_msg"><span style="color:rgb(0,0,0)" class="m_-7639558470803502787gmail_msg">@ComputeCanada </span></font><br style="color:rgb(0,0,0);font-size:medium" class="m_-7639558470803502787gmail_msg"><img style="color:rgb(0,0,0);font-size:medium" class="m_-7639558470803502787gmail_msg" src="http://www.computecanada.ca/wp-includes/images/email_sig/cc_logo.jpg" width="200" height="120"><br></font></font></div></div></div></blockquote></div><div dir="ltr">-- <br></div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><p style="margin-bottom:0in;line-height:100%"><font color="#ff0000"><font face="arial, sans-serif"><font style="font-size:10pt" size="2"><b>Darren
Boss</b></font></font></font></p><font style="font-size:10pt" size="2"><i>Senior Programmer/Analyst</i></font><font style="font-size:10pt" size="2"><i><br>Programmeur-analyste principal</i></font><font style="font-size:10pt" size="2"><i><br><a href="mailto:darren.boss@computecanada.ca">darren.boss@computecanada.ca</a></i></font><font style="font-size:10pt" size="2"><i><br>(o)
416.228.1234 x </i></font><font color="#000000"><font style="font-size:10pt" size="2">230<br></font></font></div><font color="#000000"><font style="font-size:10pt" size="2"><i>(c) 919.525.0083</i><br></font></font><div><font color="#000000"><font size="2"><br><span style="color:rgb(0,0,0);font-size:12.8px" class="gmail_msg">155 University Ave, Suite 302 Toronto, ON M5H 3B7</span><font class="gmail_msg" size="2"><br style="color:rgb(0,0,0)" class="gmail_msg"><span style="color:rgb(0,0,0)" class="gmail_msg"><a href="http://www.computecanada.ca" class="gmail_msg" target="_blank">www.computecanada.ca</a> / <a href="http://www.calculcanada.ca" class="gmail_msg" target="_blank">www.calculcanada.ca</a> </span><br style="color:rgb(0,0,0)" class="gmail_msg"><span style="color:rgb(0,0,0)" class="gmail_msg">@ComputeCanada </span></font><br style="color:rgb(0,0,0);font-size:medium" class="gmail_msg"><img style="color: rgb(0, 0, 0); font-size: medium;" class="gmail_msg" src="http://www.computecanada.ca/wp-includes/images/email_sig/cc_logo.jpg" width="200" height="120"><br></font></font></div></div></div>