Grouper Users - Open Discussion List

[Al Lilianstrom <>]

New to grouper. Running 2.5.41 in one container. Postgres and Shibboleth in 
separate containers. ADLDS over plain LDAP for the subject database.

All good.

Adding a AD domain over SSL to grouper. Trying to use the domain name for the 
connection as we do with other apps.

From grouper-loader.properties

ldap.fsLdap.configFileFromClasspath = ldap.fsLdap.properties
ldap.fsLdap.user = CN=dirm,OU=FSA,DC=fs,DC=fnal,DC=gov
ldap.fsLdap.pass = NotIt

ldap.fsLdap.properties

org.ldaptive.ldapUrl=ldaps://fs.fnal.gov/
org.ldaptive.useStartTLS=false
org.ldaptive.useSSL=true
org.ldaptive.credentialConfig=org.ldaptive.ssl.KeyStoreCredentialConfig{{trustStore=file:/opt/grouper/grouperWebapp/WEB-INF/classes/fs.ks}{trustStorePassword=NotIt}}

Getting the following error in the web interface when testing the connection 
(under Miscellaneous | External systems)

CertificateException: Hostname '[fs.fnal.gov]' does not match the hostname in 
the server's certificate ''

The domain name is in the certificate as a Subject Alternative Name

DNS Name=DC1.fs.fnal.gov
DNS Name=fs.fnal.gov
DNS Name=FS

If I disable SSL the test is successful. Or if I switch to a single DC.

org.ldaptive.ldapUrl=ldaps://dc1.fs.fnal.gov/
org.ldaptive.useStartTLS=false
org.ldaptive.useSSL=true
org.ldaptive.credentialConfig=org.ldaptive.ssl.KeyStoreCredentialConfig{{trustStore=file:/opt/grouper/grouperWebapp/WEB-INF/classes/fs.ks}{trustStorePassword=NotIt}}

Any thoughts on getting this to work?


--
Al Lilianstrom
Authentication Services

Fermi National Accelerator Laboratory
www.fnal.gov