<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"><span style="font-family:Arial,Helvetica,sans-serif">On Wed, Jun 3, 2020 at 11:47 AM IAM David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:</span><br></div></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">And to be clear, the jaas.config for this lone "ldaps" source is ldaps with tls=false and ssl=true; did not see explicit mention of the ssl=true component, so I've tried with ssl=false as well, receiving same logged error on attempted connection:<br>





<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">DEBUG [137.229.6.122] org.ldaptive.provider.jndi.JndiConnectionFactory:105 ><span>  </span>Error connecting to LDAP URL: ldaps://<a href="http://cas-auth-t.alaska.edu:6361" target="_blank">cas-auth-t.alaska.edu:6361</a></span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures">org.ldaptive.provider.ConnectionException: javax.naming.CommunicationException: <a href="http://cas-auth-t.alaska.edu:6361" target="_blank">cas-auth-t.alaska.edu:6361</a> [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]</span></p><br>





<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>// UA Authenticator is proxy to AD allows some expired accounts to authenticate</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>  </span>org.ldaptive.jaas.LdapLoginModule sufficient</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>ldapUrl="ldaps://<a href="http://cas-auth-t.alaska.edu:6361" target="_blank">cas-auth-t.alaska.edu:6361</a>"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>baseDn="dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>bindDn="CN=...,ou=...,dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>bindCredential="•••••••••••"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>subtreeSearch="true"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp-D/credentials/UAADrootCAs-P-Q-D-T-InC.pem}"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>ssl="true"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>tls="false"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>connectTimeout="3000"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>resultTimeout="3000"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span>    </span>;</span></p></div><br></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">Change 'sslSocketFactory' to 'credentialConfig' and see if that works. Can you point me to the documentation you're using? I should give it a once over.</div><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">--Daniel Fisher</div><div class="gmail_default" style="font-family:verdana,sans-serif"></div></div></div>