<div dir="ltr"><div>Tested with Oracle's JDK, same issue.<br><br></div>Might there be an issue with the files under credentials all being symbolic links. I'm running this under Kubernetes and all the files there are being loaded from a configmap so they are all symbolic links to files under ..data/file. It doesn't seem to be an issue with the signing crt/keys or the sealer but could it be for the certificateTrust files?<br></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Dec 6, 2017 at 10:52 AM Darren Boss <<a href="mailto:darren.boss@computecanada.ca">darren.boss@computecanada.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>I've got things running in DEBUG mode now and I'm super confused why my deployments are using the jvm truststore.<br><br></div>If I see this message on startup:<br>2017-12-06 15:34:01,962 - WARN [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector:168] - Data Connector 'ccLDAP': Use of default JVM trust store will be removed in the next major version of this software; replacement is trustFile attribute<br><br></div>does this mean for sure that the IdP is using the JVM trust store? I see this message on my production and dev deployments as well but I didn't have to add the CA to the JRE since we are using certificates already signed by a CA that exists in the default CA bundle.</div><div><br></div><div>I am using<br></div><div>idp.authn.LDAP.sslConfig = certificateTrust</div><div><br></div><div>So why is the JVM trust store being used?</div><div><br></div><div>Additionally I can now see even after adding the CA to the JRE trust store with ldaptive debugging turned on that while the authn succeeds, attribute retrieval doesn't because it's not using ssl on attribute retrieval even though I've got:</div><div>idp.authn.LDAP.useSSL = true </div><div><br></div><div>and the ldap server string starts with ldaps://. What the heck is going on? I normally despise html email but here is does come in handy for highlighting some of the things that pop out to me in the logs.<br></div><div><br></div><div>2017-12-06 15:41:55,321 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@732416381::baseDn=<redacted>, searchFilter=[org.ldaptive.SearchFilter@1496570425::filter=(cn=<redacted>), parameters={}], returnAttributes=[], searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1716672035::config=[org.ldaptive.ConnectionConfig@86506638::ldapUrl=ldaps://<redacted>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig@1639958975::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@2c7106d9, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], <b>useSSL=false</b>, <b>useStartTLS=false</b>, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@43648489::metadata=[ldapUrl=ldaps://<redacted>, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, com.sun.jndi.ldap.read.timeout=3000}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1552295831::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy@4ee3d023, controlProcessor=org.ldaptive.provider.ControlProcessor@3a747492, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=<b>[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS]</b>, sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@68138b78]<br>2017-12-06 15:41:55,325 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response@88388466::result=[org.ldaptive.SearchResult@4303153::entries=[], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.SearchRequest@732416381::baseDn=<redacted>, searchFilter=[org.ldaptive.SearchFilter@1496570425::filter=(cn=<redacted>), parameters={}], returnAttributes=[], searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1716672035::config=[org.ldaptive.ConnectionConfig@86506638::ldapUrl=ldaps://<redacted>, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig@1639958975::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@2c7106d9, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], <b>useSSL=false, useStartTLS=false</b>, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@43648489::metadata=[ldapUrl=ldaps://<redacted>, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, com.sun.jndi.ldap.read.timeout=3000}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1552295831::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy@4ee3d023, controlProcessor=org.ldaptive.provider.ControlProcessor@3a747492, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=<b>[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS]</b>, sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@68138b78]</div><div><br></div><div>Should I ditch Zulu and rebuild my containers with Oracle's Java?<br></div></div><div dir="ltr"><br><div class="gmail_quote"><div dir="ltr">On Wed, Dec 6, 2017 at 10:33 AM Daniel Fisher <<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Tue, Dec 5, 2017 at 12:05 PM, Darren Boss <span dir="ltr"><<a href="mailto:darren.boss@computecanada.ca" target="_blank">darren.boss@computecanada.ca</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Unfortunately we can not directly implement any changes to the ldap server. Points two and three have already been tested and I've switched back to that exact configuration and it's working, but still with the CA in the JRE's CA bundle.<br></div></div></div></blockquote><br></div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">Put org.ldaptive in DEBUG and you'll be able to see what's happening.</div></div></div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><br></div><div class="gmail_quote">--Daniel Fisher</div><div class="gmail_quote"><br></div></div></div>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div></div><div dir="ltr"></div><div dir="ltr">-- <br></div><div class="m_2008159210224458172gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><p style="margin-bottom:0in;line-height:100%"><font color="#ff0000"><font face="arial, sans-serif"><font style="font-size:10pt" size="2"><b>Darren
Boss</b></font></font></font></p><font style="font-size:10pt" size="2"><i>Senior Programmer/Analyst</i></font><font style="font-size:10pt" size="2"><i><br>Programmeur-analyste principal</i></font><font style="font-size:10pt" size="2"><i><br><a href="mailto:darren.boss@computecanada.ca" target="_blank">darren.boss@computecanada.ca</a></i></font><font style="font-size:10pt" size="2"><i><br>(o)
<a href="tel:(416)%20228-1234" value="+14162281234" target="_blank">416.228.1234</a> x </i></font><font color="#000000"><font style="font-size:10pt" size="2">230<br></font></font></div><font color="#000000"><font style="font-size:10pt" size="2"><i>(c) <a href="tel:(919)%20525-0083" value="+19195250083" target="_blank">919.525.0083</a></i><br></font></font><div><font color="#000000"><font size="2"><br><span style="color:rgb(0,0,0);font-size:12.8px" class="m_2008159210224458172gmail_msg">155 University Ave, Suite 302 Toronto, ON M5H 3B7</span><font class="m_2008159210224458172gmail_msg" size="2"><br style="color:rgb(0,0,0)" class="m_2008159210224458172gmail_msg"><span style="color:rgb(0,0,0)" class="m_2008159210224458172gmail_msg"><a href="http://www.computecanada.ca" class="m_2008159210224458172gmail_msg" target="_blank">www.computecanada.ca</a> / <a href="http://www.calculcanada.ca" class="m_2008159210224458172gmail_msg" target="_blank">www.calculcanada.ca</a> </span><br style="color:rgb(0,0,0)" class="m_2008159210224458172gmail_msg"><span style="color:rgb(0,0,0)" class="m_2008159210224458172gmail_msg">@ComputeCanada </span></font><br style="color:rgb(0,0,0);font-size:medium" class="m_2008159210224458172gmail_msg"><img style="color:rgb(0,0,0);font-size:medium" class="m_2008159210224458172gmail_msg" src="http://www.computecanada.ca/wp-includes/images/email_sig/cc_logo.jpg" width="200" height="120"><br></font></font></div></div></div></blockquote></div><div dir="ltr">-- <br></div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><p style="margin-bottom:0in;line-height:100%"><font color="#ff0000"><font face="arial, sans-serif"><font style="font-size:10pt" size="2"><b>Darren
Boss</b></font></font></font></p><font style="font-size:10pt" size="2"><i>Senior Programmer/Analyst</i></font><font style="font-size:10pt" size="2"><i><br>Programmeur-analyste principal</i></font><font style="font-size:10pt" size="2"><i><br><a href="mailto:darren.boss@computecanada.ca">darren.boss@computecanada.ca</a></i></font><font style="font-size:10pt" size="2"><i><br>(o)
416.228.1234 x </i></font><font color="#000000"><font style="font-size:10pt" size="2">230<br></font></font></div><font color="#000000"><font style="font-size:10pt" size="2"><i>(c) 919.525.0083</i><br></font></font><div><font color="#000000"><font size="2"><br><span style="color:rgb(0,0,0);font-size:12.8px" class="gmail_msg">155 University Ave, Suite 302 Toronto, ON M5H 3B7</span><font class="gmail_msg" size="2"><br style="color:rgb(0,0,0)" class="gmail_msg"><span style="color:rgb(0,0,0)" class="gmail_msg"><a href="http://www.computecanada.ca" class="gmail_msg" target="_blank">www.computecanada.ca</a> / <a href="http://www.calculcanada.ca" class="gmail_msg" target="_blank">www.calculcanada.ca</a> </span><br style="color:rgb(0,0,0)" class="gmail_msg"><span style="color:rgb(0,0,0)" class="gmail_msg">@ComputeCanada </span></font><br style="color:rgb(0,0,0);font-size:medium" class="gmail_msg"><img style="color: rgb(0, 0, 0); font-size: medium;" class="gmail_msg" src="http://www.computecanada.ca/wp-includes/images/email_sig/cc_logo.jpg" width="200" height="120"><br></font></font></div></div></div>