nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

LDAP + SSL

binerf

Hello,

I'm trying to configure Alfresco's (4.0b) authentication against an openldap service.
This openldap listens on port 636 with SSL.
So, I've configured the ldap-authentication.properties by adding:

ldap.authentication.java.naming.provider.url=ldaps://ldap_server:636
‍‍‍

I've added the ldap SSL certificate in keystore file:

/opt/alfresco-4.0.b/java/bin/keytool -import -alias ldap_server -keystore /etc/java/keystore -file certificate.crt‍

Then I'm prompted for a password.
I typed "changeit".

Then I've modified /opt/alfresco-4.0.b/tomcat/scripts/ctl.sh:

     export JAVA_OPTS="-XX:MaxPermSize=512m -Xms128m -Xmx768m -Dalfresco.home=/opt/alfresco-4.0.b -Dcom.sun.management.jmxremote -Dsun.security.ssl.allowUnsafeRenegotiation=true -Djavax.net.ssl.trustStore=/etc/java/keystore"
‍‍‍

but I still get an error when I try to login Alfresco web interface.

On ldap server site, we got this error:

closed (TLS negotiation failure)‍

So, I assume that my Alfresco is able to contact the ldap server but gets an error when it tries to open a TLS connexion.

What I'm wrong please ?

Thank you in advance for your help.

Find more posts tagged with

Comments

binerf

Hi all,

Do you think that anything is missing in the command line:

$ ps -ef|grep java
root      3934     1  2 Feb19 ?        00:57:12 /opt/alfresco-4.0.b/java/bin/java -Djava.util.logging.config.file=/opt/alfresco-4.0.b/tomcat/conf/logging.properties -XX:MaxPermSize=512m -Xms128m -Xmx768m -Dalfresco.home=/opt/alfresco-4.0.b -Dcom.sun.management.jmxremote -Dsun.security.ssl.allowUnsafeRenegotiation=true -Djavax.net.ssl.trustStore=/etc/java/keystore -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.sun.management.jmxremote.port=6789 -Dcom.sun.management.jmxremote.host=127.0.0.1 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.access.file=/opt/alfresco-4.0.b/tomcat/conf/jmxremote.access -Dcom.sun.management.jmxremote.password.file=/opt/alfresco-4.0.b/tomcat/conf/jmxremote.passwd -Djava.endorsed.dirs=/opt/alfresco-4.0.b/tomcat/endorsed -classpath /opt/alfresco-4.0.b/tomcat/bin/bootstrap.jar -Dcatalina.base=/opt/alfresco-4.0.b/tomcat -Dcatalina.home=/opt/alfresco-4.0.b/tomcat -Djava.io.tmpdir=/opt/alfresco-4.0.b/tomcat/temp org.apache.catalina.startup.Bootstrap start
‍‍‍

How I can debug my error please ? On Alfresco server side ?

Many thanks for your help.

binerf

Hi All,

To update my issue, I found a java class to debug my issue.(http://confluence.atlassian.com/display/JIRA/Connecting+to+SSL+services#ConnectingtoSSLservices-Debugging)

Then I try without mention the keystore:

[user@client]$ java SSLPoke ldap_service.domain.com 636
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:294)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:200)
        at sun.security.validator.Validator.validate(Validator.java:218)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
        at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1014)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:124)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:623)
        at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
        at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:73)
        at SSLPoke.main(SSLPoke.java:31)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:289)
        … 15 more
[user@client]$
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Then I execute this command with my keystore:

[user@client]$ java -Djavax.net.ssl.trustStore=/etc/java/keystore SSLPoke ldap_service.domain.com 636
Successfully connected
[user@client]$
‍‍‍‍‍

Maybe Alfresco Java doesn't care about the keystore file /etc/java/keystore… but I've added -Djavax.net.ssl.trustStore option in /opt/alfresco-4.0.b/tomcat/scripts/ctl.sh script and ps gives:

root     24814     1  9 11:18 pts/0    00:02:50 /opt/alfresco-4.0.b/java/bin/java -Djava.util.logging.config.file=/opt/alfresco-4.0.b/tomcat/conf/logging.properties -XX:MaxPermSize=512m -Xms128m -Xmx768m -Dalfresco.home=/opt/alfresco-4.0.b -Dcom.sun.management.jmxremote -Dsun.security.ssl.allowUnsafeRenegotiation=true -Djavax.net.ssl.trustStore=/etc/java/keystore -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dcom.sun.management.jmxremote.port=6789 -Dcom.sun.management.jmxremote.host=127.0.0.1 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=true -Dcom.sun.management.jmxremote.access.file=/opt/alfresco-4.0.b/tomcat/conf/jmxremote.access -Dcom.sun.management.jmxremote.password.file=/opt/alfresco-4.0.b/tomcat/conf/jmxremote.passwd -Djava.endorsed.dirs=/opt/alfresco-4.0.b/tomcat/endorsed -classpath /opt/alfresco-4.0.b/tomcat/bin/bootstrap.jar -Dcatalina.base=/opt/alfresco-4.0.b/tomcat -Dcatalina.home=/opt/alfresco-4.0.b/tomcat -Djava.io.tmpdir=/opt/alfresco-4.0.b/tomcat/temp org.apache.catalina.startup.Bootstrap start
‍‍‍

No idea ?

binerf

Okay all, I figured out.

Stupid guy am I.

In ldap-authentication.properties file, I've just changed

ldap.authentication.java.naming.security.authentication=digest-md5
‍‍

ldap.authentication.java.naming.security.authentication=simple
‍‍

and it works !!!

Sorry for bothering you but the error on ldap server is not very helpful (closed (TLS negotiation failure)).

ashwini

Hello ,
Could you please share your configuration details with me. I am trying it but getting exception in log file as below :

16 Jul, 2012 4:54:58 PM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Failed to load keystore type pkcs12 with path /etc/java/keystore due to DerInputStream.getLength(): lengthTag=109, too big.
java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
   at sun.security.util.DerInputStream.getLength(DerInputStream.java:544)
   at sun.security.util.DerValue.init(DerValue.java:347)
   at sun.security.util.DerValue.<init>(DerValue.java:303)
   at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1200)
   at java.security.KeyStore.load(KeyStore.java:1185)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:350)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getTrustStore(JSSESocketFactory.java:320)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getTrustManagers(JSSESocketFactory.java:513)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:419)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
   at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
   at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
   at org.apache.catalina.connector.Connector.initialize(Connector.java:1014)
   at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
   at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
   at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
   at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
16 Jul, 2012 4:54:58 PM org.apache.coyote.http11.Http11Protocol init
SEVERE: Error initializing endpoint
java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
   at sun.security.util.DerInputStream.getLength(DerInputStream.java:544)
   at sun.security.util.DerValue.init(DerValue.java:347)
   at sun.security.util.DerValue.<init>(DerValue.java:303)
   at com.sun.net.ssl.internal.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1200)
   at java.security.KeyStore.load(KeyStore.java:1185)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:350)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getTrustStore(JSSESocketFactory.java:320)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getTrustManagers(JSSESocketFactory.java:513)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:419)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
   at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
   at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
   at org.apache.catalina.connector.Connector.initialize(Connector.java:1014)
   at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
   at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
   at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
   at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
16 Jul, 2012 4:54:58 PM org.apache.catalina.startup.Catalina load
SEVERE: Catalina.start
LifecycleException:  Protocol handler initialization failed: java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
   at org.apache.catalina.connector.Connector.initialize(Connector.java:1016)
   at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
   at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
   at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
   at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
16 Jul, 2012 4:54:58 PM org.apache.catalina.startup.Catalina load‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Thank you so much !!!

Ashwini