<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I am trying to setup a new installation of Shibboleth v3.3.3.1.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have the shibboleth idP setup and working to authenticate users to our Active Directory using the TestShib site. However, after doing a packet capture on the network I can see that the user name and password is being sent in clear text
between the shibboleth server and the domain controller. This is happening with both the bind user and the user authenticating via shibboleth.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have enabled startTLS, I can see the TLS traffic is being used for most of the traffic between the servers but when user account information is being passed its in clear text. I have attempted to use useSSL but receive an error anytime
I restart the shibboleth service and shibboleth with not start. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is the current code I’m using in the ldap.properties file for useStartTLS (usernames and passwords are in clear text):<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.authenticator= bindSearchAuthenticator<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">## Connection properties ##<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.ldapURL= ldap://DC.starkstate.net<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.useStartTLS = true<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.useSSL = false<o:p></o:p></p>
<p class="MsoNormal"># Time in milliseconds that connects will block<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.connectTimeout = PT3S<o:p></o:p></p>
<p class="MsoNormal"># Time in milliseconds to wait for responses<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.responseTimeout = PT3S<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.sslConfig = certificateTrust<o:p></o:p></p>
<p class="MsoNormal">## If using certificateTrust above, set to the trusted certificate's path<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.trustCertificates= %{idp.home}/credentials/ldap-server.crt<o:p></o:p></p>
<p class="MsoNormal">## If using keyStoreTrust above, set to the truststore path<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.trustStore= %{idp.home}/credentials/ldap-server.truststore<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is the code I’ve used in the ldap.properties file for useSSL (Shibboleth will not start with these settings):<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.authenticator= bindSearchAuthenticator<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">## Connection properties ##<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.ldapURL= ldaps://DC.starkstate.net:636<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.useStartTLS = false<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.useSSL = true<o:p></o:p></p>
<p class="MsoNormal"># Time in milliseconds that connects will block<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.connectTimeout = PT3S<o:p></o:p></p>
<p class="MsoNormal"># Time in milliseconds to wait for responses<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.responseTimeout = PT3S<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.sslConfig = certificateTrust<o:p></o:p></p>
<p class="MsoNormal">## If using certificateTrust above, set to the trusted certificate's path<o:p></o:p></p>
<p class="MsoNormal">idp.authn.LDAP.trustCertificates= %{idp.home}/credentials/ldap-server.crt<o:p></o:p></p>
<p class="MsoNormal">## If using keyStoreTrust above, set to the truststore path<o:p></o:p></p>
<p class="MsoNormal">#idp.authn.LDAP.trustStore= %{idp.home}/credentials/ldap-server.truststore<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Error when starting shibboleth with these settings, Error repeats 5-6 times:<o:p></o:p></p>
<p class="MsoNormal">2018-09-12 15:59:21,055 - ERROR [org.ldaptive.pool.BlockingConnectionPool:509] - [org.ldaptive.pool.BlockingConnectionPool@503319063::name=resolver-pool, poolConfig=[org.ldaptive.pool.PoolConfig@2010733041::minPoolSize=3, maxPoolSize=10,
validateOnCheckIn=false, validateOnCheckOut=false, validatePeriodically=true, validatePeriod=300, validateTimeout=5000], activator=null, passivator=null, validator=[org.ldaptive.pool.SearchValidator@298424794::searchRequest=[org.ldaptive.SearchRequest@1951037998::baseDn=,
searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=0, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null]] pruneStrategy=[org.ldaptive.pool.IdlePruneStrategy@2006168925::prunePeriod=300, idleTime=600], connectOnCreate=true, connectionFactory=[org.ldaptive.DefaultConnectionFactory@717874492::provider=org.ldaptive.provider.jndi.JndiProvider@4ac7856f,
config=[org.ldaptive.ConnectionConfig@1911725457::ldapUrl=ldaps://dc.starkstate.net:636, connectTimeout=3000, responseTimeout=3000, sslConfig=[org.ldaptive.ssl.SslConfig@1631826609::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2@a63643e, trustManagers=null,
hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1126780571::bindDn=CN=shibboleth,OU=Specific
purpose logon accounts,DC=starkstate,DC=net, bindSaslConfig=null, bindControls=null]]], initialized=false, availableCount=0, activeCount=0] unable to connect to the ldap<o:p></o:p></p>
<p class="MsoNormal">org.ldaptive.provider.ConnectionException: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090E44, comment: TLS or SSL already in effect, data 0, v1772 ]; remaining name ''<o:p></o:p></p>
<p class="MsoNormal"> at org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory.createInternal(JndiStartTLSConnectionFactory.java:95)<o:p></o:p></p>
<p class="MsoNormal">Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090E44, comment: TLS or SSL already in effect, data 0, v1772 ]<o:p></o:p></p>
<p class="MsoNormal"> at java.naming/com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Mike Rochford<o:p></o:p></p>
<p class="MsoNormal">IT Manager<o:p></o:p></p>
<p class="MsoNormal">Stark State College<o:p></o:p></p>
<p class="MsoNormal"><a href="mailto:mrochford@starkstate.edu">mrochford@starkstate.edu</a><o:p></o:p></p>
<p class="MsoNormal">330-494-6170 x 4244<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>