<div dir="ltr"><div dir="ltr"><div>in jaas.config:</div><div><br></div><div>  org.ldaptive.jaas.LdapLoginModule sufficient</div><div>    ldapUrl="ldap://<a href="http://fbk-adua01.ua.ad.alaska.edu:3268">fbk-adua01.ua.ad.alaska.edu:3268</a> ldap://<a href="http://fbk-adua02.ua.ad.alaska.edu:3268">fbk-adua02.ua.ad.alaska.edu:3268</a>"</div><div>    baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"</div><div>    bindDn="cn=uashib...,dc=alaska,dc=edu"</div><div>    bindCredential="•••••••••"</div><div>    subtreeSearch="true"</div><div>    sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/credentials/UA_AD_CA.pem}"</div><div>    ssl="false"</div><div>    tls="true"</div><div>    userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</div><div>    connectTimeout="3000"</div><div>    resultTimeout="3000"</div><div>    ;</div><div><br></div><div>successfully authenticates users;</div><div>I can also connect to the ldap (AD) servers via StartTLS with those credentials </div><div>in a directory browser (Apache Directory Studio)</div><div><br></div><div>BUT in attribute-resolver.xml</div><div><br></div><div>    <DataConnector id="uaADLDAP" xsi:type="LDAPDirectory" </div><div>      useStartTLS="true"</div><div>      ldapURL="ldap://<a href="http://fbk-adua01.ua.ad.alaska.edu:389">fbk-adua01.ua.ad.alaska.edu:389</a> ldap://<a href="http://fbk-adua02.ua.ad.alaska.edu:389">fbk-adua02.ua.ad.alaska.edu:389</a>" baseDN="dc=ua,dc=ad,dc=alaska,dc=edu"</div><div>      principal="cn=uashib...dc=alaska,dc=edu" principalCredential="••••••••••"></div><div>        <FailoverDataConnector ref="FailoverADConnector" /></div><div>        <FilterTemplate></div><div>            <![CDATA[ (|(sAMAccountName=$resolutionContext.principal)(uaIdentifier=$resolutionContext.principal)) ]]></div><div>        </FilterTemplate></div><div>        <StartTLSTrustCredential id="UA_AD_CA_Certificate"</div><div>          xsi:type="sec:X509ResourceBacked"></div><div>            <sec:Certificate>/opt/shibboleth-idp/credentials/UA_AD_CA.pem</sec:Certificate></div><div>        </StartTLSTrustCredential></div><div>     </DataConnector></div><div><br></div><div>fails connection attempt with log snippet:</div><div>DEBUG [10.5.0.58] org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory:105 >  Error connecting to LDAP URL: ldap://<a href="http://fbk-adua01.ua.ad.alaska.edu:389">fbk-adua01.ua.ad.alaska.edu:389</a></div><div>org.ldaptive.provider.ConnectionException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target</div><div><br></div><div>[debug error message is repeated for the second URL in this connector, then failover connector succeeds]</div><div><br></div><div>identical behavior in IdP 3.2 or 3.4 instance<br><br>David Bantz</div><div>U Alaska</div></div></div>