<div dir="ltr">Mike Grady correctly noted my use of very old (v2) names in my JAAS config.<br><br>The following appears to work (ssl-> useSSL, tls->useStartTLS, sslSocketFactory->credetnialConfig; cf. bottom of <a href="https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration</a>)<br>I'm testing with random credentials, so await final verification by real users.<br><div><br></div><div>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>// UA Authenticator is proxy to AD allows some expired accounts to authenticate</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>org.ldaptive.jaas.LdapLoginModule sufficient</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>ldapUrl="ldaps://<a href="http://cas-auth-t.alaska.edu:6361">cas-auth-t.alaska.edu:6361</a>"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>baseDn="dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>bindDn="CN=cas c. casacct,ou=sw_service accts,ou=sw,dc=ua,dc=adt,dc=alaska,dc=edu"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>bindCredential="$C@c99@cT"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>subtreeSearch="true"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>credentialConfig="{trustCertificates=file:/opt/shibboleth-idp-D/credentials/UAADrootCAs-P-Q-D-T-InC.pem}"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>useSSL="true"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>useStartTLS="false"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>userFilter="(|(sAMAccountName={user})(uaIdentifier={user}))"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>connectTimeout="3000"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>resultTimeout="3000"</span></p>
<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:14px;line-height:normal;font-family:Courier;color:rgb(59,35,34);background-color:rgba(215,211,183,0.85)"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><span class="gmail-Apple-converted-space"> </span>;</span></p></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jun 3, 2020 at 7:52 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">You can crank up logging, but at the end of the day, the error means what it says. Having been spelunking a whole lot of trust chain issues since Saturday, I can tell you that when it's not working there's always a reason, even when you're banging your head against it.<br>
<br>
Of course if you can connect over ldap://and you're getting a real error anyway, I'd be more worried about resolving that since it's just going to happen again once you manage to connect with ldaps://<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>