<div dir="ltr"><div dir="ltr">Yes 6361 is using "ldaps"; it is NOT using (is not configured for StartTLS).<div><br></div><div>ldaps://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a> establishes secure connection in legacy CAS server and in Apache DIrectory Studio.<br><br>Both of the openssl commands return the same server cert (which is in the IdP trusted store) and report establishing a valid TLS1.2 encrypted connection;<br><br></div><div><br></div><div>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>openssl s_client<span class="gmail-Apple-converted-space"> </span>-showcerts -connect <a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">CONNECTED(00000003)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">depth=0 C = US, postalCode = 99775, ST = Alaska, L = Fairbanks, street = 910 Yukon Drive, O = University of Alaska System, OU = UAS, CN = <a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify error:num=20:unable to get local issuer certificate</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify return:1</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">depth=0 C = US, postalCode = 99775, ST = Alaska, L = Fairbanks, street = 910 Yukon Drive, O = University of Alaska System, OU = UAS, CN = <a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify error:num=21:unable to verify the first certificate</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify return:1</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Certificate chain</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>0 s:/C=US/postalCode=99775/ST=Alaska/L=Fairbanks/street=910 Yukon Drive/O=University of Alaska System/OU=UAS/CN=<a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">-----BEGIN CERTIFICATE-----</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">•••</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">-----END CERTIFICATE-----</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Server certificate</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">subject=/C=US/postalCode=99775/ST=Alaska/L=Fairbanks/street=910 Yukon Drive/O=University of Alaska System/OU=UAS/CN=<a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">issuer=/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">No client certificate CA names sent</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Peer signing digest: SHA512</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Server Temp Key: ECDH, P-256, 256 bits</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">SSL handshake has read 2454 bytes and written 415 bytes</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Server public key is 2048 bit</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Secure Renegotiation IS supported</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Compression: NONE</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Expansion: NONE</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">No ALPN negotiated</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">SSL-Session:</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Protocol<span class="gmail-Apple-converted-space"> </span>: TLSv1.2</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Cipher<span class="gmail-Apple-converted-space"> </span>: ECDHE-RSA-AES128-GCM-SHA256</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Session-ID: B66CC36AB9D0BEE20C8BBC39DD5CD2415CF945D9A9C985F3A22DD976BF7FACDE</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Session-ID-ctx:<span class="gmail-Apple-converted-space"> </span></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Master-Key: 47BE18926CB47F42E42510B90A08EEAD5B7004312ACA9060AD82F1447D698267F650BD5E2529CF81A584817375F3CEB2</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Key-Arg <span class="gmail-Apple-converted-space"> </span>: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Krb5 Principal: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>PSK identity: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>PSK identity hint: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>TLS session ticket lifetime hint: 300 (seconds)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>TLS session ticket:</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">•••</span></p>
<p class="gmail-p2" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85);min-height:17px"><span style="font-variant-ligatures:no-common-ligatures"> Start Time: 1591147289</span><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Timeout <span class="gmail-Apple-converted-space"> </span>: 300 (sec)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Verify return code: 21 (unable to verify the first certificate)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">read:errno=0</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p></div></div><div>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">openssl s_client<span class="gmail-Apple-converted-space"> </span>-showcerts -connect <a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a><span class="gmail-Apple-converted-space"> </span>-CAfile /opt/shibboleth-idp-D/credentials/UAADrootCAs-P-Q-D-T-InC.pem</span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><br></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">CONNECTED(00000003)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify return:1</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">depth=1 C = US, ST = MI, L = Ann Arbor, O = Internet2, OU = InCommon, CN = InCommon RSA Server CA</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify return:1</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">depth=0 C = US, postalCode = 99775, ST = Alaska, L = Fairbanks, street = 910 Yukon Drive, O = University of Alaska System, OU = UAS, CN = <a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">verify return:1</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Certificate chain</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>0 s:/C=US/postalCode=99775/ST=Alaska/L=Fairbanks/street=910 Yukon Drive/O=University of Alaska System/OU=UAS/CN=<a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>i:/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">-----BEGIN CERTIFICATE-----</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">••••</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">-----END CERTIFICATE-----</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Server certificate</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">subject=/C=US/postalCode=99775/ST=Alaska/L=Fairbanks/street=910 Yukon Drive/O=University of Alaska System/OU=UAS/CN=<a href="http://cas-auth-t.alaska.edu">cas-auth-t.alaska.edu</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">issuer=/C=US/ST=MI/L=Ann Arbor/O=Internet2/OU=InCommon/CN=InCommon RSA Server CA</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">No client certificate CA names sent</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Peer signing digest: SHA512</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Server Temp Key: ECDH, P-256, 256 bits</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">SSL handshake has read 2454 bytes and written 415 bytes</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Server public key is 2048 bit</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Secure Renegotiation IS supported</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Compression: NONE</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">Expansion: NONE</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">No ALPN negotiated</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">SSL-Session:</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Protocol<span class="gmail-Apple-converted-space"> </span>: TLSv1.2</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Cipher<span class="gmail-Apple-converted-space"> </span>: ECDHE-RSA-AES128-GCM-SHA256</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Session-ID: 37F7114BA64FE4A2117DEE1E684D1735C11B49F6A9EDE654A7449438E3F6D3DB</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Session-ID-ctx:<span class="gmail-Apple-converted-space"> </span></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Master-Key: 2B5A57D5CF9222EE0EEB349E25F8FF86A53A8DBD7EF36BFD5EA5592050CE5F01DB4AABC4B263D9EF553A185D36A8657E</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Key-Arg <span class="gmail-Apple-converted-space"> </span>: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Krb5 Principal: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>PSK identity: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>PSK identity hint: None</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>TLS session ticket lifetime hint: 300 (seconds)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>TLS session ticket:</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> ••••</span></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Start Time: 1591147790</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Timeout <span class="gmail-Apple-converted-space"> </span>: 300 (sec)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>Verify return code: 0 (ok)</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">---</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">read:errno=0</span></p></div><div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 2, 2020 at 4:54 PM Michael A Grady <<a href="mailto:mgrady@unicon.net">mgrady@unicon.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow-wrap: break-word;">Well, is port 6361 an SSL/TLS port or not? I'd a gree, if you say SSL is true, that should be ldaps, not just ldap, and you need to be sure that iis presenting an appropriate set of certs (LDAP server cert and any needed intermediates) that are needed. But if it isn;'t actually an SSL/TLS port, and isn't actually presenting a set of certs, then I would expect that refusal of connection.<div><br></div><div>Do an:</div><div><br></div><div> openssl s_client -showcerts -connect <a href="http://cas-auth-t.alaska.edu:6361" target="_blank">cas-auth-t.alaska.edu:6361</a></div><div><br></div><div>and see waht you get back. And if that returns certs, then wherever you think you have the accepted Root certs, you could do that same command but add:</div><div><br></div><div> openssl s_client -showcerts -connect <a href="http://cas-auth-t.alaska.edu:6361" target="_blank">cas-auth-t.alaska.edu:6361</a> -CAfile /path/to/Root/certfile<br><div><br></div><div>and see if you get a verfiy at the end of it.</div><div><br></div><div>I haven't worked on JAAS config like that in a long time, so nothing else off the top of my head. Is this "new JAAS config", or was this exact same JAAS config working before in the IdP? I'd have to do some researech on the first error and JAAS/ldaptive before I could help more, and I'm not going to take the time to do that until you have a chance to respond on the above.<br><div><br><blockquote type="cite"><div>On Jun 2, 2020, at 7:35 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>> wrote:</div><br><div><div dir="ltr">I'm using JAAS to take advantage of the "sufficient" logic to fail over to a proxy to allow expired accounts to authenticate.<div><br></div><div>Using this configuration in JAAS.config for the proxy connection</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>// UA Authenticator is proxy to AD allows some expired accounts to authenticate</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>org.ldaptive.jaas.LdapLoginModule sufficient</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>ldapUrl="ldap://<a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>baseDn="dc=ur,dc=addev,dc=alaska,dc=edu"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>bindDn="CN=•••••,ou=...,dc=ua,dc=adt,dc=alaska,dc=edu"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>bindCredential="••••••••••"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>subtreeSearch="true"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>sslSocketFactory="{trustCertificates=file:/.../•••.pem}"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>ssl="true"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>tls="false"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>connectTimeout="3000"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>resultTimeout="3000"</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>;</span></div></blockquote><div><br></div><div> I see the following error when attempting to use this fail-over:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><b> DEBUG [10.25.250.26] org.ldaptive.provider.jndi.NamingExceptionUtils:358 > naming exception class javax.naming.ServiceUnavailableException is ambiguous, maps to multiple result codes: [BUSY, UNAVAILABLE]</b></blockquote><div>(Larger log snippet surrounding this error is below)<br></div></div><div><br></div><div>Folks here quickly say "that should be ldaps:// not ldap://" but the examples in Shib wiki use ldap:// with ssl="true"; if I do use ldaps:// in the configuration above, the connection is refused outright:<br><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>DEBUG [137.229.6.124] org.ldaptive.provider.jndi.JndiConnectionFactory:105 ><span> </span>Error connecting to LDAP URL: ldaps://<a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a></span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">org.ldaptive.provider.ConnectionException: javax.naming.CommunicationException: <a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a> [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: </span><span style="font-variant-ligatures:no-common-ligatures;color:rgb(215,211,183);background-color:rgba(59,35,34,0.85)">PKIX</span><span style="font-variant-ligatures:no-common-ligatures"> path building failed: sun.security.provider.certpath.SunCertPathBuilderExceptio</span></div><div style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">n: unable to find valid certification path to requested target]</span></div></blockquote><div><br></div><div> Any pointers, hints, interpretation appreciated!</div></div><div><br></div><div>David Bantz</div><div><br></div><div>----<br><br>Here's the larger snippet:<br>14:05:42:455 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:104 > Retrieved authenticator from factory: [org.ldaptive.auth.Authenticator@1889354517::dnResolver=[org.ldaptive.auth.SearchDnResolver@849231888::factory=[org.ldaptive.DefaultConnectionFactory@1944062102::provider=org.ldaptive.provider.jndi.JndiProvider@2b1f07a, config=[org.ldaptive.ConnectionConfig@414093010::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1483789079::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]]], baseDn=dc=ur,dc=addev,dc=alaska,dc=edu, userFilter=(|(sAMAccountName={user})(uaIdentifier={user})), userFilterParameters=null, allowMultipleDns=false, subtreeSearch=true, derefAliases=null, followReferrals=false], authenticationHandler=[org.ldaptive.auth.BindAuthenticationHandler@724026423::factory=[org.ldaptive.DefaultConnectionFactory@639157001::provider=org.ldaptive.provider.jndi.JndiProvider@4aac1106, config=[org.ldaptive.ConnectionConfig@345672495::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@17429495::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]]], saslConfig=null, controls=null], entryResolver=null, authenticationResponseHandlers=null]<br><br>14:05:42:455 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:108 > Retrieved authentication request from factory: [org.ldaptive.auth.AuthenticationRequest@1634297940::user=null, retAttrs=[1.1], controls=null]<br><br>14:05:42:458 DEBUG [10.25.250.26] org.ldaptive.BindOperation:138 > execute request=[org.ldaptive.BindRequest@1273459038::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@199510270::config=[org.ldaptive.ConnectionConfig@414093010::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1483789079::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1169982526::metadata=[ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1866297109::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@2f383546, controlProcessor=org.ldaptive.provider.ControlProcessor@1f209e2d, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@362a968f]<br><br>14:05:42:462 DEBUG [10.25.250.26] org.ldaptive.provider.jndi.NamingExceptionUtils:358 > naming exception class javax.naming.ServiceUnavailableException is ambiguous, maps to multiple result codes: [BUSY, UNAVAILABLE]<br><br>14:05:42:462 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:178 > Error occurred attempting authentication<br>org.ldaptive.OperationException: javax.naming.ServiceUnavailableException: <a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>; socket closed<br> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:67)<br>Caused by: javax.naming.ServiceUnavailableException: <a href="http://cas-auth-t.alaska.edu:6361/" target="_blank">cas-auth-t.alaska.edu:6361</a>; socket closed<br> at com.sun.jndi.ldap.Connection.readReply(Connection.java:454)<br></div></div>
<br><div> <br></div>
<hr><p>This email has been scanned for spam and viruses by Proofpoint Essentials. Click <a href="https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1591144600-3AcyHyG9DPZW&r_address=mgrady%40unicon.net&report=1" target="_blank">here</a> to report this email as spam.</p>
<br>-- <br>For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></div></blockquote></div><br><div>
<div style="color:rgb(0,0,0);font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div style="color:rgb(0,0,0);font-family:Helvetica;font-size:14px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><br></div><br>
</div>
<br></div></div></div>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>