<div dir="ltr">Try setting idp.authn.LDAP.useSSL=false .  That property has been depreciated (false is the default) in lieu of explicitly signaling TLS via ldaps://<div><br></div><div>LDAP code 91 implies you were able to make a network connection to the server but unable to negotiate a session.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 15, 2022 at 6:37 AM Aisha Al Fudhaili <<a href="mailto:aisha@omren.om">aisha@omren.om</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Yes. <br>
I tried <br>
idp.authn.LDAP.ldapURL = ldaps://<a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a> idp.authn.LDAP.useStartTLS = false idp.authn.LDAP.useSSL = true  with no luck. I receive same error<br>
-----Original Message-----<br>
From: users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> On Behalf Of Jarno Huuskonen<br>
Sent: Monday, August 15, 2022 2:26 PM<br>
To: <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
Subject: Re: shibboleth idp with google<br>
<br>
Hello,<br>
<br>
On Mon, 2022-08-15 at 09:25 +0000, Aisha Al Fudhaili wrote:<br>
> “DEBUG [org.ldaptive.provider.unboundid.UnboundIDConnectionFactory:90] <br>
> - Error connecting to LDAP URL: ldap://<a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a><br>
> org.ldaptive.provider.ConnectionException: LDAPException(resultCode=91 <br>
> (connect error), errorMessage='An error occurred while attempting to <br>
> connect to server <a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a>:<br>
> IOException(LDAPException(resultCode=91 (connect error), <br>
> errorMessage='An error occurred while attempting to establish a <br>
> connection to server<br>
> <a href="http://ldap.google.com/216.239.32.58:636" rel="noreferrer" target="_blank">ldap.google.com/216.239.32.58:636</a>:  ConnectException(Connection timed out:<br>
> connect), ldapSDKVersion=4.0.14,<br>
> revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb'))')<br>
<br>
> ## Connection properties ##<br>
> idp.authn.LDAP.ldapURL                          =<br>
> ldap://<a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a><br>
> idp.authn.LDAP.useStartTLS                     = true<br>
<br>
You'll probably want:<br>
idp.authn.LDAP.ldapURL = ldaps://<a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a> idp.authn.LDAP.useStartTLS = false idp.authn.LDAP.useSSL = true #OR #idp.authn.LDAP.ldapURL = ldap://<a href="http://ldap.google.com:389" rel="noreferrer" target="_blank">ldap.google.com:389</a> #idp.authn.LDAP.useStartTLS = true #idp.authn.LDAP.useSSL = false<br>
<br>
port 636 is usually ldaps not ldap+startls.<br>
<br>
But check that your firewall allows connection to <a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a> for example with openssl:<br>
openssl s_client -connect <a href="http://ldap.google.com:636" rel="noreferrer" target="_blank">ldap.google.com:636</a><br>
<br>
> idp.authn.LDAP.trustCertificates                =<br>
%{idp.home}/credentials/ldap-client.p12<br>
<br>
Are you trying to use client certificate authentication to <a href="http://ldap.google.com" rel="noreferrer" target="_blank">ldap.google.com</a> ?<br>
<br>
<br>
These might help you:<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration</a><br>
<a href="https://www.unicon.net/insights/blogs/ldap-tlsssl-config-shibboleth-idp-explained" rel="noreferrer" target="_blank">https://www.unicon.net/insights/blogs/ldap-tlsssl-config-shibboleth-idp-explained</a><br>
<br>
-Jarno<br>
<br>
--<br>
Jarno Huuskonen<br>
--<br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>