<div dir="ltr">Mea Culpa<br><br>My legacy JAAS config was modeled on this v2 documentation:<br><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass</a><br><br>Seems I have several places with the older v2 vocabulary; I don't know why it has apparently been working for StartTLS and for ldap (unencrypted) connections, but I will update all the modules.<br><br><div class="gmail-codeContent gmail-panelContent gmail-pdl" style="margin:0px;padding:0px;background-image:initial;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;color:rgb(51,51,51);font-size:14px;line-height:20px;overflow:hidden;border-bottom-left-radius:3px;border-bottom-right-radius:3px;font-family:-apple-system,system-ui,"Segoe UI",Roboto,Oxygen,Ubuntu,"Fira Sans","Droid Sans","Helvetica Neue",sans-serif"><div style="margin:0px;padding:0px"></div></div><div>David Bantz</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 3, 2020 at 8:16 AM IAM David Bantz <<a href="mailto:dabantz@alaska.edu">dabantz@alaska.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Mike Grady correctly noted my use of very old (v2) names in my JAAS config.<br><br>The following appears to work (ssl-> useSSL, tls->useStartTLS, sslSocketFactory->credetnialConfig; cf. bottom of <a href="https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration</a>)<br>I'm testing with random credentials, so await final verification by real users.<br><div><br></div><div>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>// UA Authenticator is proxy to AD allows some expired accounts to authenticate</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>org.ldaptive.jaas.LdapLoginModule sufficient</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>ldapUrl="ldaps://<a href="http://cas-auth-t.alaska.edu:6361" target="_blank">cas-auth-t.alaska.edu:6361</a>"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>baseDn="dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>bindDn="CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>bindCredential="$C@c99@cT"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>subtreeSearch="true"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>credentialConfig="{trustCertificates=file:/opt/shibboleth-idp-D/credentials/UAADrootCAs-P-Q-D-T-InC.pem}"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>useSSL="true"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>useStartTLS="false"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>connectTimeout="3000"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>resultTimeout="3000"</span></p>
<p style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span style="font-variant-ligatures:no-common-ligatures"><span> </span>;</span></p></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 3, 2020 at 7:52 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">You can crank up logging, but at the end of the day, the error means what it says. Having been spelunking a whole lot of trust chain issues since Saturday, I can tell you that when it's not working there's always a reason, even when you're banging your head against it.<br>
<br>
Of course if you can connect over ldap://and you're getting a real error anyway, I'd be more worried about resolving that since it's just going to happen again once you manage to connect with ldaps://<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
</blockquote></div>