<div dir="ltr">I'm using JAAS to take advantage of the "sufficient" logic to fail over to a proxy to allow expired accounts to authenticate.<div><br></div><div>Using this configuration in JAAS.config for the proxy connection</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>// UA Authenticator is proxy to AD allows some expired accounts to authenticate</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>org.ldaptive.jaas.LdapLoginModule sufficient</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>ldapUrl="ldap://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>baseDn="dc=ur,dc=addev,dc=alaska,dc=edu"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>bindDn="CN=•••••,ou=...,dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>bindCredential="••••••••••"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>subtreeSearch="true"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>sslSocketFactory="{trustCertificates=file:/.../•••.pem}"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>ssl="true"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>tls="false"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>connectTimeout="3000"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>resultTimeout="3000"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>;</span></p></blockquote><div><br></div><div> I see the following error when attempting to use this fail-over:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><b> DEBUG [10.25.250.26] org.ldaptive.provider.jndi.NamingExceptionUtils:358 > naming exception class javax.naming.ServiceUnavailableException is ambiguous, maps to multiple result codes: [BUSY, UNAVAILABLE]</b></blockquote><div>(Larger log snippet surrounding this error is below)<br></div></div><div><br></div><div>Folks here quickly say "that should be ldaps:// not ldap://" but the examples in Shib wiki use ldap:// with ssl="true"; if I do use ldaps:// in the configuration above, the connection is refused outright:<br><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>DEBUG [137.229.6.124] org.ldaptive.provider.jndi.JndiConnectionFactory:105 ><span class="gmail-Apple-converted-space"> </span>Error connecting to LDAP URL: ldaps://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a></span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">org.ldaptive.provider.ConnectionException: javax.naming.CommunicationException: <a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a> [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: </span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures;color:rgb(215,211,183);background-color:rgba(59,35,34,0.85)">PKIX</span><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"> path building failed: sun.security.provider.certpath.SunCertPathBuilderExceptio</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">n: unable to find valid certification path to requested target]</span></p></blockquote><div><br></div><div> Any pointers, hints, interpretation appreciated!</div></div><div><br></div><div>David Bantz</div><div><br></div><div>----<br><br>Here's the larger snippet:<br>14:05:42:455 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:104 > Retrieved authenticator from factory: [org.ldaptive.auth.Authenticator@1889354517::dnResolver=[org.ldaptive.auth.SearchDnResolver@849231888::factory=[org.ldaptive.DefaultConnectionFactory@1944062102::provider=org.ldaptive.provider.jndi.JndiProvider@2b1f07a, config=[org.ldaptive.ConnectionConfig@414093010::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1483789079::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]]], baseDn=dc=ur,dc=addev,dc=alaska,dc=edu, userFilter=(|(sAMAccountName={user})(uaIdentifier={user})), userFilterParameters=null, allowMultipleDns=false, subtreeSearch=true, derefAliases=null, followReferrals=false], authenticationHandler=[org.ldaptive.auth.BindAuthenticationHandler@724026423::factory=[org.ldaptive.DefaultConnectionFactory@639157001::provider=org.ldaptive.provider.jndi.JndiProvider@4aac1106, config=[org.ldaptive.ConnectionConfig@345672495::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@17429495::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]]], saslConfig=null, controls=null], entryResolver=null, authenticationResponseHandlers=null]<br><br>14:05:42:455 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:108 > Retrieved authentication request from factory: [org.ldaptive.auth.AuthenticationRequest@1634297940::user=null, retAttrs=[1.1], controls=null]<br><br>14:05:42:458 DEBUG [10.25.250.26] org.ldaptive.BindOperation:138 > execute request=[org.ldaptive.BindRequest@1273459038::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@199510270::config=[org.ldaptive.ConnectionConfig@414093010::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1483789079::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1169982526::metadata=[ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1866297109::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@2f383546, controlProcessor=org.ldaptive.provider.ControlProcessor@1f209e2d, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@362a968f]<br><br>14:05:42:462 DEBUG [10.25.250.26] org.ldaptive.provider.jndi.NamingExceptionUtils:358 > naming exception class javax.naming.ServiceUnavailableException is ambiguous, maps to multiple result codes: [BUSY, UNAVAILABLE]<br><br>14:05:42:462 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:178 > Error occurred attempting authentication<br>org.ldaptive.OperationException: javax.naming.ServiceUnavailableException: <a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>; socket closed<br> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:67)<br>Caused by: javax.naming.ServiceUnavailableException: <a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>; socket closed<br> at com.sun.jndi.ldap.Connection.readReply(Connection.java:454)<br></div></div>