<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">Hello, </div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">First, sorry by advance for any langague error and if this question is kind of trivial, I'm new to Shibboleth.</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">My goal is to have an instance of shibboleth with a data connector on my ldap server for an internal service provider.</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">I have installed and configured an IDP with Shibboleth 4.3.1 and did some functionnallities tests with a sandbow ldap server, everything was fine and the idp send all the attributes i needed.</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><br></div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000">Then, i tried to change the ldap server and test with my ldap server on production. And when i test the connection i have an error on the ldap connection (full log in attachement):</div><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><blockquote><pre style="font-size:12pt">2024-02-21 08:40:27,476 - 192.168.2.19 - ERROR [org.ldaptive.pool.BlockingConnectionPool:461] - [org.ldaptive.pool.BlockingConnectionPool@1289092605::name=dn-search-pool, poolConfig=[org.ldaptive.pool.PoolConfig@2104400321::minPoolSize=3, maxPoolSize=10, validateOnCheckIn=false, validateOnCheckOut=false, validatePeriodically=true, validatePeriod=PT5M, validateTimeout=PT5S], activator=null, passivator=null, validator=[org.ldaptive.pool.SearchValidator@1955505091::searchRequest=[org.ldaptive.SearchRequest@1134780430::baseDn=, searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[1.1], searchScope=OBJECT, timeLimit=PT0S, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, referralHandler=null, intermediateResponseHandlers=null]] pruneStrategy=[org.ldaptive.pool.IdlePruneStrategy@965952871::prunePeriod=PT5M, idleTime=PT10M], connectOnCreate=true, connectionFactory=[org.ldaptive.DefaultConnectionFactory@1514831293::provider=org.ldaptive.provider.unboundid.UnboundIDProvider@536347a4, config=[org.ldaptive.ConnectionConfig@1391621808::ldapUrl=ldaps://ldap.server.fr:636, connectTimeout=PT3S, responseTimeout=PT3S, sslConfig=[org.ldaptive.ssl.SslConfig@1902750196::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@65566ab3, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=null, connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy@78c785f1]], initialized=true, availableCount=0, activeCount=0] unable to connect to the ldap<br>org.ldaptive.provider.ConnectionException: LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server ldap.server.fr:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server ldap.server.fr/x.x.x.x:636: SSLHandshakeException(Received fatal alert: handshake_failure), ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb'))')<br><br></pre></blockquote></div></div></div><div>I am quite surprised by the sslConfig in the log because it says that "useSSL=false" whereas i use the "ldaps" in the ldapURL configuration:</div><br><div>Log extract: "<span style="font-size:12pt">sslConfig=[org.ldaptive.ssl.SslConfig@1902750196::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig@65566ab3, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null],<strong> useSSL=false</strong>, useStartTLS=false, connectionInitializer=null, connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy@78c785f1]], initialized=true, availableCount=0, activeCount=0]"</span></div><div><span style="font-size:12pt"><br></span></div><div><span style="font-size:12pt">My configuration on ldap.properties and attribute-resolver:</span></div><ul><li><span style="font-size:12pt">ldap.properties:</span></li></ul><div><div>## Connection properties ##</div><blockquote><pre>idp.authn.LDAP.ldapURL = ldaps://ldap.server.fr:636<br>idp.authn.LDAP.useStartTLS = false<br><span style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt">## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<br></span>idp.authn.LDAP.sslConfig = certificateTrust<br>## If using certificateTrust above, set to the trusted certificate's path<br>idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt</pre></blockquote><ul><li>attribute-resolver:</li></ul><blockquote><pre><span style="font-size:12pt;font-family:'arial' , 'helvetica' , sans-serif"><DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br></span> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br> exportAttributes="uid"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br></DataConnector></pre></blockquote></div><div><span style="font-size:12pt">Did i do something wrong to specify the use of SSL? I use the wiki page for my configuration: </span><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration" rel="nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration</a></div><br><div>About the certificate, <span style="font-size:12pt"></span>I made some check ont the two certificates and i guess the main difference is in the signature of pub key, one is encrypted using SHA1 hash and the other using SHA256: </div><ul><li>On the production ldap server:</li></ul><div><blockquote><pre>Certificate chain<br><strong> a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA1</strong><br> v:NotBefore: Sep 17 06:35:52 2015 GMT; NotAfter: Sep 14 06:35:52 2025 GMT<br>SSL handshake has read 1559 bytes and written 397 bytes<br>Verification error: self-signed certificate<br><br></pre></blockquote></div><ul><li>On the sandbox ldap server:</li></ul><div><blockquote><pre> <strong> a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256</strong><br> v:NotBefore: Sep 29 08:38:39 2023 GMT; NotAfter: Sep 26 08:38:39 2033 GMT<br>SSL handshake has read 1539 bytes and written 402 bytes<br>Verification error: self-signed certificate</pre></blockquote><p><br>I know that using the SHA1 hash is not a good thing, we are trying to re-sign the pubkey with a SHA256 hash (and migrate the server but this is not planified for now). I must add that we have an another instance of Shibboleth (version 3) which doesn't have this error, i don"t know if it's relevant.</p><p>In the meantime, i would like to know if there's a way of configure my shibboleth for accepting this certificate? <br></p><p>I didn't find anything on the LDAP configuration wiki page (<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration" rel="nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration</a>), i tried to look on the idp.properties and the idp.trusting.signatures options but id didn't find the right configuration.</p><p>Many thanks by advance for your time and help, </p><p>Best regards, </p><p>Emilie</p><p><br></p><p><br></p><p><br></p></div></div></div></div><br></div></div></body></html>