<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Well, is port 6361 an SSL/TLS port or not? I'd a gree, if you say SSL is true, that should be ldaps, not just ldap, and you need to be sure that iis presenting an appropriate set of certs (LDAP server cert and any needed intermediates) that are needed. But if it isn;'t actually an SSL/TLS port, and isn't actually presenting a set of certs, then I would expect that refusal of connection.<div class=""><br class=""></div><div class="">Do an:</div><div class=""><br class=""></div><div class=""> openssl s_client -showcerts -connect <a href="http://cas-auth-t.alaska.edu:6361" class="">cas-auth-t.alaska.edu:6361</a></div><div class=""><br class=""></div><div class="">and see waht you get back. And if that returns certs, then wherever you think you have the accepted Root certs, you could do that same command but add:</div><div class=""><br class=""></div><div class=""> openssl s_client -showcerts -connect <a href="http://cas-auth-t.alaska.edu:6361" class="">cas-auth-t.alaska.edu:6361</a> -CAfile /path/to/Root/certfile<br class=""><div class=""><br class=""></div><div class="">and see if you get a verfiy at the end of it.</div><div class=""><br class=""></div><div class="">I haven't worked on JAAS config like that in a long time, so nothing else off the top of my head. Is this "new JAAS config", or was this exact same JAAS config working before in the IdP? I'd have to do some researech on the first error and JAAS/ldaptive before I could help more, and I'm not going to take the time to do that until you have a chance to respond on the above.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jun 2, 2020, at 7:35 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" class="">dabantz@alaska.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I'm using JAAS to take advantage of the "sufficient" logic to fail over to a proxy to allow expired accounts to authenticate.<div class=""><br class=""></div><div class="">Using this configuration in JAAS.config for the proxy connection</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>// UA Authenticator is proxy to AD allows some expired accounts to authenticate</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>org.ldaptive.jaas.LdapLoginModule sufficient</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>ldapUrl="ldap://<a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>baseDn="dc=ur,dc=addev,dc=alaska,dc=edu"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>bindDn="CN=•••••,ou=...,dc=ua,dc=adt,dc=alaska,dc=edu"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>bindCredential="••••••••••"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>subtreeSearch="true"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>sslSocketFactory="{trustCertificates=file:/.../•••.pem}"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>ssl="true"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>tls="false"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>connectTimeout="3000"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>resultTimeout="3000"</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>;</span></div></blockquote><div class=""><br class=""></div><div class=""> I see the following error when attempting to use this fail-over:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><b class=""> DEBUG [10.25.250.26] org.ldaptive.provider.jndi.NamingExceptionUtils:358 > naming exception class javax.naming.ServiceUnavailableException is ambiguous, maps to multiple result codes: [BUSY, UNAVAILABLE]</b></blockquote><div class="">(Larger log snippet surrounding this error is below)<br class=""></div></div><div class=""><br class=""></div><div class="">Folks here quickly say "that should be ldaps:// not ldap://" but the examples in Shib wiki use ldap:// with ssl="true"; if I do use ldaps:// in the configuration above, the connection is refused outright:<br class=""><br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>DEBUG [137.229.6.124] org.ldaptive.provider.jndi.JndiConnectionFactory:105 ><span class="gmail-Apple-converted-space"> </span>Error connecting to LDAP URL: ldaps://<a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a></span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">org.ldaptive.provider.ConnectionException: javax.naming.CommunicationException: <a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a> [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: </span><span class="gmail-s2" style="font-variant-ligatures:no-common-ligatures;color:rgb(215,211,183);background-color:rgba(59,35,34,0.85)">PKIX</span><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"> path building failed: sun.security.provider.certpath.SunCertPathBuilderExceptio</span></div><div style="margin: 0px; font-variant-numeric: normal; font-variant-east-asian: normal; font-stretch: normal; font-size: 14px; line-height: normal; font-family: Courier; color: rgb(59, 35, 34); background-color: rgba(215, 211, 183, 0.85);" class=""><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures">n: unable to find valid certification path to requested target]</span></div></blockquote><div class=""><br class=""></div><div class=""> Any pointers, hints, interpretation appreciated!</div></div><div class=""><br class=""></div><div class="">David Bantz</div><div class=""><br class=""></div><div class="">----<br class=""><br class="">Here's the larger snippet:<br class="">14:05:42:455 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:104 > Retrieved authenticator from factory: [org.ldaptive.auth.Authenticator@1889354517::dnResolver=[org.ldaptive.auth.SearchDnResolver@849231888::factory=[org.ldaptive.DefaultConnectionFactory@1944062102::provider=org.ldaptive.provider.jndi.JndiProvider@2b1f07a, config=[org.ldaptive.ConnectionConfig@414093010::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1483789079::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]]], baseDn=dc=ur,dc=addev,dc=alaska,dc=edu, userFilter=(|(sAMAccountName={user})(uaIdentifier={user})), userFilterParameters=null, allowMultipleDns=false, subtreeSearch=true, derefAliases=null, followReferrals=false], authenticationHandler=[org.ldaptive.auth.BindAuthenticationHandler@724026423::factory=[org.ldaptive.DefaultConnectionFactory@639157001::provider=org.ldaptive.provider.jndi.JndiProvider@4aac1106, config=[org.ldaptive.ConnectionConfig@345672495::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@17429495::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]]], saslConfig=null, controls=null], entryResolver=null, authenticationResponseHandlers=null]<br class=""><br class="">14:05:42:455 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:108 > Retrieved authentication request from factory: [org.ldaptive.auth.AuthenticationRequest@1634297940::user=null, retAttrs=[1.1], controls=null]<br class=""><br class="">14:05:42:458 DEBUG [10.25.250.26] org.ldaptive.BindOperation:138 > execute request=[org.ldaptive.BindRequest@1273459038::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@199510270::config=[org.ldaptive.ConnectionConfig@414093010::ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>, connectTimeout=3000, responseTimeout=-1, sslConfig=null, useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@1483789079::bindDn=CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1169982526::metadata=[ldapUrl=ldap://<a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1866297109::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@2f383546, controlProcessor=org.ldaptive.provider.ControlProcessor@1f209e2d, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@362a968f]<br class=""><br class="">14:05:42:462 DEBUG [10.25.250.26] org.ldaptive.provider.jndi.NamingExceptionUtils:358 > naming exception class javax.naming.ServiceUnavailableException is ambiguous, maps to multiple result codes: [BUSY, UNAVAILABLE]<br class=""><br class="">14:05:42:462 DEBUG [10.25.250.26] org.ldaptive.jaas.LdapLoginModule:178 > Error occurred attempting authentication<br class="">org.ldaptive.OperationException: javax.naming.ServiceUnavailableException: <a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>; socket closed<br class=""> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:67)<br class="">Caused by: javax.naming.ServiceUnavailableException: <a href="http://cas-auth-t.alaska.edu:6361/" class="">cas-auth-t.alaska.edu:6361</a>; socket closed<br class=""> at com.sun.jndi.ldap.Connection.readReply(Connection.java:454)<br class=""></div></div>
<br class=""><div class=""> <br class="webkit-block-placeholder"></div>
<hr class=""><p class="">This email has been scanned for spam and viruses by Proofpoint Essentials. Click <a href="https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1591144600-3AcyHyG9DPZW&r_address=mgrady%40unicon.net&report=1" class="">here</a> to report this email as spam.</p>
<br class="">-- <br class="">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""></div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></div></body></html>