Error in authentication with ldap server with certificate

Hi,
i have a problem in authentication with ldap server with certificate.
here i am using java API to authenticate.
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed.
I issued the new certificate which is having the up to 5 years valid time.
is java will authenticate up to one year only?
Can any body help on this issue...
Regards
Ranga

sorry i am gettting ythe same error
javax.naming.CommunicationException: simple bind failed: servername:636 exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed]
here when i am using the old certificate and changing the system date means i can get the authentication.
can you tell where we can concentrate and solve the issue..
where is the issue
1. need to check with the ldap server only
2. problem in java code only.
thanks in advance

Similar Messages

Usage of external LDAP server with Portal

Hi All,
We are in a situation to use external LDAP server with WLP 8.1. These are the
constraints we have to deal with:
1. Only read is allowed from this LDAP server.
2. This would be used for authentication purpose
If thats the case, how can we use Visitor Entitlements/Delegated Admin and Group
creation using Portal Admin tool since this will write to the configured LDAP
server.
Can somebody answer my question:
1. Can we use external LDAP server - just for authetication (I know this is possible
by using JAAS LoginModule, but I just want to get confirmed on this ) and
2. Use default and embedded LDAP server for all others like Group/Visitor Entitlements/DAs.
Any relevant pointers are also welcome.
TIA,
Prashanth Bhat.

Thanks for th ereply. Some of your answers are not clear. Can you pls eloborate
on this?? Pls see my comments below.
"Johnson" <[email protected]> wrote:
>
Phil,
Can I use embedded LDAP for production?
Thanks
Lawrence
"Phil Griffin" <BEA> wrote:
"Prashanth " <[email protected]> wrote in message
news:[email protected]..
Hi All,
We are in a situation to use external LDAP server with WLP 8.1. Theseare
the
constraints we have to deal with:
1. Only read is allowed from this LDAP server.
2. This would be used for authentication purpose
If thats the case, how can we use Visitor Entitlements/Delegated Adminand
Group
creation using Portal Admin tool since this will write to the configuredLDAP
server.
Can somebody answer my question:
1. Can we use external LDAP server - just for authetication (I knowthis
is possible
by using JAAS LoginModule, but I just want to get confirmed on this) and
>
You can add the external LDAP server just for authentication, but in
versions through
8.1 SP2 WLP will want to verify the user exists (via the UserReaderMBean)
during
the login process (this check has been removed in SP3). A work around
is to
duplicate
the user in a provider that does impl UserReaderMBean.
Prashanth : You mean to say we have to duplicate the User in embedded LDAP server
also??
>>
2. Use default and embedded LDAP server for all others like Group/VisitorEntitlements/DAs.
>
Yes, the default/embedded LDAP can still be used for DA/visitor
entitlements. In the current
release, the Portal Admin Tools can only be configured to use a single
authentication provider
while forming entitlements. In SP3, all configured providers are
listed/usable by the tools.Prashanth : How can we configure Portal Admin tool to use authentication provider
for entitlements??
>>
Any relevant pointers are also welcome.
TIA,
Prashanth Bhat.

How to use audio and mic with multipoint server with out it crashing on you

how to use audio and mic with multipoint server with out it crashing on you when i use them to make calls thru my station (zero client) at the same time it crashes on me and i need to restart the multipoint is there a setting i may have mist that enable's
them to work at the same time and if posible can i use a non USB device

Look for "Single Sign-on Using Kerberos in Java" in google or on Sun's web site. Maybe this paper will help you.
Claude

When I try to connect LDAP server with Directory certificate installed in Onboard Administrator , I get the below error message. Initiating Directory Settings diagnostic for LDAP server 10.0.0.2 port 636

10.0.0.2Accepting Directory Server certificate for /CN=qtp-ldap.oaqtp.com signed by /DC=com/DC=oaqtp/CN=qtp-ldap
Skipping certificate 1 (/CN=qtp-ldap.oaqtp.com): subject issuer mismatch
Certificate of Directory Server cannot be verified with the installed LDAP certificate.
Unable to establish SSL connection with directory server.
You may need to install a certificate for your server to allow SSL connections.
It says "Subject Issuer mismatch" .. What could be the reason ?
-Shibi Keyan

Well, it sounds like the certificate name is different than what you are trying to connect to. Can you try connecting to the DNS name instead? This sounds like a DNS and Certificate Name issue.
http://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx
Kurt Hudson, Sr. Technical Writer AD DS, AD CS, PKI, Azure AD

ASA Remote Access Authentication with LDAP Server

Thank you in advance for your help.
I am configuring an ASA to authenticate with a ldap server for ipsec vpn access. My customer has 3 networks that are to be accessed by remote users. However they want to be able to say that one user can get to 2 of the networks and not the 3rd. So basically they want control over what network behind the firewall each user can access. This seems doable from my reading and I had planned to creating a group for each network that needs accessible and either do attribute maps to each group with a separate group created on the ldap server for authentication. Basically a ldap group on the ldap server that will have the users name in the group in order for access. I can restrict access via acl's or filtering to force my group to only be allowed access to a specific network. Here is the problem I am having now.
The ldap server has been created and seems to be working fine. I have created my AAA groups and servers and I have done the ldap test with a test user vpntest and a password on the ldap server. When I run the authentication test from the ADSM or command line I get a good authentication successful message. So I configured a vpn client remotely and attempted to authenticate to this group and it says there is no user by that name. Below is a paste of the debug. The second part is when I did a successful test from the ASDM or CLI and it worked great. The first part is when I attempted from the vpn client. It all looks the same from the search criteria. What am I missing here or does anyone more knowledgeable see anything that I am doing wrong. Can this be done this way or should I try radius. The customer was just adament about using ldap.
extvpnasa5510#
[243] Session Start
[243] New request Session, context 0xd5713fe0, reqType = 1
[243] Fiber started
[243] Creating LDAP context with uri=ldaps://130.18.22.44:636
[243] Connect to LDAP server: ldaps://130.18.22.44:636, status = Successful
[243] supportedLDAPVersion: value = 2
[243] supportedLDAPVersion: value = 3
[243] No Login DN configured for server 130.18.22.44
[243] Binding as administrator
[243] Performing Simple authentication for to 130.18.22.44
[243] LDAP Search:
        Base DN = [ou=employees,o=msues]
        Filter = [uid=vpntest]
        Scope   = [SUBTREE]
[243] User DN = [uid=vpntest,ou=employees,o=msues]
[243] Talking to iPlanet server 130.18.22.44
[243] No results returned for iPlanet global password policy
[243] Fiber exit Tx=386 bytes Rx=414 bytes, status=-1
[243] Session End
extvpnasa5510#
[244] Session Start
[244] New request Session, context 0xd5713fe0, reqType = 1
[244] Fiber started
[244] Creating LDAP context with uri=ldaps://130.18.22.44:636
[244] Connect to LDAP server: ldaps://130.18.22.44:636, status = Successful
[244] supportedLDAPVersion: value = 2
[244] supportedLDAPVersion: value = 3
[244] No Login DN configured for server 130.18.22.44
[244] Binding as administrator
[244] Performing Simple authentication for to 130.18.22.44
[244] LDAP Search:
        Base DN = [ou=employees,o=msues]
        Filter = [uid=vpntest]
        Scope   = [SUBTREE]
[244] User DN = [uid=vpntest,ou=employees,o=msues]
[244] Talking to iPlanet server 130.18.22.44
[244] Binding as user
[244] Performing Simple authentication for vpntest to 130.18.22.44
[244] Processing LDAP response for user vpntest
[244] Authentication successful for vpntest to 130.18.22.44
[244] Retrieved User Attributes:
[244]   sn: value = test user
[244]   givenName: value = vpn
[244]   uid: value = vpntest
[244]   cn: value = vpn test user
[244]   objectClass: value = top
[244]   objectClass: value = person
[244]   objectClass: value = organizationalPerson
[244]   objectClass: value = inetOrgPerson
[244] Fiber exit Tx=284 bytes Rx=414 bytes, status=1
[244] Session End

Hi Larry,
You can map AD group memberships to specific group policies on the ASA, you can find that configuration here:
- http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91831-mappingsvctovpn.html
Let me know if further assistance is required!
Please proceed to rate and mark as correct the helpful Post!
David Castro,
Regards,

Problems getting Web server to connect with LDAP server.

Have 4.1.8 iplanet Web and 4.13 LDAP running on Win2000 sp2. Both are working fine separately, i.e. 'have good anonymous LDAP://URL responses, and 'have working application CGI responses from web server. 'Have previously had same setup running on another server. However, with this install on win2000 cannot get Global settings LDAP feature to work ~ getting " An error occured while contacting th LDAP server. A connection to the the directory server could not be opened. Have checked DNS settings, etc. All seems to be in order. Any suggetions?

Hi,
What edition of Win 2K are you using (Pro/Server/Ad Server). The problem could be your DNS settings only.Ensure which machine is your DNS Server is running,is it on NT? if so change it to win 2K server.
Delete your LDAP machines A record from DNS server and add it again. This will solve your problem.
Refer the URL :
http://knowledgebase.iplanet.com/ikb/kb/articles/5135.html

Error: "Cannot access the web server" with BlazeDS Turnkey

Help! I'm new to Flex and BlazeDS and Eclipse. I was trying to setup a Flex Project using a BlazeDS/Tomcat server running from Eclipse on Windows XP per the example in flexbandit.com/archives/55#comment-269 and in (www.infoq.com/articles/blazeds-intro).   I am NOT using the Eclipse Flex plug-in. I'm using Flex Builder for the Flex code.
Here's what I've done:
I installed BlazeDS and tested http://localhost:8400 - That worked.
I setup Tomcat in Eclipse. - That seemed to work.
I created a Dynamic Web Project in Eclipse - That seemed to work.
I created the bare-bones BlazeDS Configuration under the Eclipse project and then created a basic HelloWorld java class.
I added the destination in the “remoting-config.xml” file found in the c:/projects/workspace/ReportGenTool/WebContent/WEB-INF/flex” directory:
<destination id="HelloWorld">   <properties> <source>HelloWorld</source> </properties> </destination>
When I started the application server by clicking on the server's green play button in Eclipse and then tried to open localhost:8400/ReportGenTool, I got the 404 error : The requested source (/ReportGenTool/) is not available which according to the instructions is fine.
Next I created a Flex Project, but when I try to validate the new Flex project configuration, it gives me an error "Cannot access the web server. The server may not be running, or the web root folder or root URL may be invalid."
When I validated the server was running after setting up the BlazeDs Turnkey, I saw the BlazeDS page.
Now when I bring up http://localhost:8400 I get:
      Directory Listing for /
      Apache Tomcat/6.0.14
My eclipse project is named ReportGenTool and I've overwritten the WebContent directory with the META-INF and WEB-INF directories from the BlazeDS installation (C:\blazeds\tomcat\webapps\blazeds). According to Eclipse the server is running.
My Flex project is named ReportGenTool and is located in another directory away from the Eclipse project directory.
     My root folder is: C:\Projects\workspace\ReportGenTool\WebContent
     Root URL: is http://localhost:8400/ReportGenTool/
     Context root is: /ReportGenTool/
Any idea what might be wrong? What didn't I configure that needs to be configured?
Thanks in advance.

This is not working because your router has a direct to your web server that is not through the outside interface which is needed for nat to occur, for this to work you need to setup a loopback interface as nat outside and policy route traffic to there for your server traffic
Bu if your server is internal why do you need nat at all? Can you not use bind with views that might be simpler
M
Sent from Cisco Technical Support iPad App

HELP: Can not connect LDAP server with 64bit ldap csdk5.08 on Solaris10

We are using 64bit ldap csdk5.08 on SunOS5.10. But it doesn't work.
We wrote a simple client program that connects using ldap_simple_bind_s() function. When I run the code it gives an error saying 'Can't connect to the LDAP server - Connection refused' .
At the same time using snoop to capture network packages on the ldap server , it shows no package received at all.
But if we use 32bit ldap library, the program works well and no error is raised.
And the 64bit ldap tool ldapsearch also works well, it can search data from the server successfully.
The sample code:
==================================================
#include <ldap.h>
#include <stdio.h>
int
main( int argc, char **argv )
     LDAP *ld;
     int rc;
     /* Get a handle to an LDAP connection. */
     if ( (ld = ldap_init( "150.236.42.53", 38902)) == NULL )
          perror( "ldap_init" );
          return( 1 );
     /* Bind anonymously to the LDAP server. */
     rc = ldap_simple_bind_s( ld, NULL, NULL );
     if ( rc != LDAP_SUCCESS )
          ldap_perror(ld, "ldap_simple_bind_s:");
     return( 1 );
}

This looks like a mismatch between C-sdk libraries and Solaris native libraries.
Are you sure your program loads the correct libraries ?
Ludovic.

Issues with LDAP Server | Solaris 8

Hi All,
In my project we are using Solaris 8 as LDAP server for authentication. Some folders owner and group is assigned to LDAP user by default. I think it should be root and others.
Please find the below example:
*8 drwxr-xr-x 42 gip_admin set_investors_author 3584 Jan 24 00:01 .
*8 drwxr-xr-x 42 gip_admin set_investors_author 3584 Jan 24 00:01 ..
6 -rw-rw-r-- 1 gip_admin ampm_retail_english_author 2062 Jan 22 14:03 archive
2 drwxr-xr-x 2 root nobody 512 Aug 6 2003 cdrom
2 drwx--l--- 3 gip_admin set_investors_author 512 Dec 9 07:33 data
2 drwxr-x--- 2 root other 512 Nov 12 16:20 data1
Can you please help me to solve this issue.....
Thanks in Advance
Manju

Hi,
Its is not mounted on NFS. It is local disk only.
Its is Solaris 8 server.
# ls -lan
drwxr-xr-x 18 0 0 1536 Dec 11 05:00 .
drwxr-xr-x 46 91550 94293 2560 Jan 11 10:37 ..
-rw-rw-rw- 1 0 1 524204 Aug 2 2006 110951-06.jar
drwxr-xr-x 2 0 1 512 Dec 11 05:01 Backup_files
-rw------- 1 0 1 17 Apr 22 2005 DBVERSION
drwxrwxr-x 2 101 2000 512 Oct 18 2004 DD
drwxr-xr-x 2 0 1 512 Sep 19 2006 J2SEPatch-13092006
#cat /etc/passwd
root:x:0:1:Super-User:/:/usr/bin/bash
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
sys:x:3:3::/:
adm:x:4:4:Admin:/var/adm:
lp:x:71:8:Line Printer Admin:/usr/spool/lp:
uucp:x:5:5:uucp Admin:/usr/lib/uucp:
nuucp:x:9:9:uucp Admin:/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:Nobody:/:
noaccess:x:60002:60002:No Access User:/:
nobody4:x:65534:65534:SunOS 4.x Nobody:/:
basant:x:1001:10::/apps/basant:/bin/sh
tis:x:1003:1::/apps/tis/:/usr/bin/bash
ldap:x:1004:100::/home/ldap:/bin/sh
iwui:x:100001:60001:Interwoven TeamSite UI Daemons User:/apps/iw-home:/bin/sh
oracle:x:1002:101: Oracle user:/apps/oracle:/bin/sh
vadmin:x:100002:1::/apps/vadmin/:/bin/sh
sshd:x:100003:2003:sshd privsep:/var/empty:/bin/false
temp:x:111112:1::/home/temp:/bin/sh
verity:x:111113:1::/apps/verity/:/usr/bin/bash
test1:x:12312311:1::/home/test1:/bin/sh
hai:x:12312312:1::/home/hai:/bin/sh
#cat /etc/group
[root@sun5-/opt]# cat /etc/group
root::0:root,tomcat
other::1:bpeditor,lpg_admin,lpg_author,lpg_publisher
bin::2:root,bin,daemon
sys::3:root,bin,sys,adm
adm::4:root,adm,daemon
uucp::5:root,uucp
mail::6:root
tty::7:root,tty,adm
lp::8:root,lp,adm
nuucp::9:root,nuucp
staff::10:
daemon::12:root,daemon
sysadmin::14:
nobody::60001:
noaccess::60002:
nogroup::65534:
iplanet::100:
dba::101:
sshd::2003:
apps::94356:
testa::12312323:
oat_users_test::12312325:
Thanks

Help with the server's certificate

Hi everyone!
I have been using the curve for a while and my blackberry is connected to 2 different emails. It has been working fine. This morning, the screen won't display messages coming from one email account. So I went to the wizard account set up and tried to put in my email address as I had at the very beginning but when opening it won't open the connection because "the server's certificate has expired" Any idea what that means and how I can fix it? Appreciate your help!

Did you use wi-fi connection before, if so, refer to http://www.blackberry.com/btsc/KB15204
If someone give you helpful hints, please click on Kudos.
If you issue is resolved, mark Accept Solution next to the resolution post.
Feel free to search www.blackberry.com/btsc to find your answers.

Can't get Google CAL to work with iCAL "Server with a secure communication unavailable"

I can't add my google account to iCal...
Error message:
"Server with a secure communication unavailable"
"Your calendar acct isn't on a server that can receive your calendar information securely.."
I have had this work just fine in the past, had to remove my accounts a while back, decided to add them back, and this error keeps popping up...
Can anyone help??
Googled and Searched this forum with no success. Found some suggestions but nothing worked.
Thanks,

I have used the CalDAV option from the pop list and the server option is : https://www.google.com/calendar/dav/[email protected]/user , replace with your email the underlined
I've found this here .

Problems with Treo 680 hotsync with exchange server with Outlook conduits

I have a Treo 680 set to sync with my companies exhange server for e-mail and calendar.
When the phone is docked, it will not perform any synching if I try to use the Hotsync feature. It says that it syncs and doesn't give any errors during the Hotsync, but it doesn't actually sync anything.
The phone will sync wirelessly, though, and after several tries. If I go to sync calendar, it gives an error:
"There was a problem syncing events. There was a problem synchronizing with the server. Please select the Sync button to try again."
When I try to sync again it gives another message:
"There was a problem syncing with the Exchange ActiveSync server. Your next sync will take a little longer than usual. Do you want to sync now?"
And if I select "Yes" it will sync wirelessly. It receives all the items and does sync the calendar, but gives an error message:
"There was a problem syncing events." and if I click the details it says:
"AirSAMStateMachine.c 1814 6 Server rejected device Add Status:6"
But, it does appear to have synced all the calendar items correctly.
Likewise, if I go to sync e-mails it does the same thing with the error details:
"AirSAMStateMachine.c 3873 4 Sync key invalid, cmd: 4,status: 4"
And again, it will update the e-mails. Also, if I set it to auto-sync e-mails, it will receive e-mails as soon as they arrive, but will always give that error message afterwards.
Any thoughts?
Post relates to: Treo 680 (AT&T)

No, that didn't work. Although Hotsync says it is using Outlook for syncing Calendar, Tasks, etc., nothing is actually sent to the phone. I have to do it wirelessly, which does sync but it gives those errors and takes a few tries.
Post relates to: Treo 680 (AT&T)
Edit:
Upon doing a hard reset and reinstalling everything, it works now. Thanks.
Message Edited by ksoth on 01-27-2009 02:29 PM

Config transparent Proxy with LDAP authen with L4 switch?

How to config policy based routing on L4 switch if wsa run in transparent mode with LDAP authentication?
Async OS: 5.1.0-420
Thank you,
Thanapol

Ezekiel,
I wanted to add some clarification to your comments:
1) Network TAP connected to T1/T2.
This will work good. You will need to tap one direction of traffic to the T1 port and the other direction in to the T2 interface.
2) L4 switch connected to P1.
This will NOT work. Further explaination below. What you can do is use a switch that supports port spanning / port mirroring. You'll need to send a COPY of all traffic going to gateway to the T1 interface.
The L4TM will need to be in 'duplex' mode - Configurable in the GUI.
3) WCCP v2 connected to P1.
WCCP cannot be used at all with the L4TM, because WCCP doesn't 'copy' the traffic, it redirects it.
L4TM information
The L4TM can be thought of as a completely seperate appliance that operates primarily via the t1 / t2 interfaces.
The L4TM is a sniffer application, meaning that you cannot redirect traffic to it (such as L4 switching PBR or WCCP), but you can send a copy of traffic to it (port mirroring or physical tap).
If you are blocking with the L4TM, the WSA will use M1/P1 to send the TCP RST packets. This is the ONLY use for the M1/P1 interfaces that the L4TM will use.
The P1 interface is intended to be used for Web proxy traffic and the L4TM does not listen on this interface.

How to determine the error code, returned from LDAP server

I use the next code for connect to LDAP server:
        try{
            ctx = new InitialLdapContext(env, null);
             //if connection successfull ...
        } catch (NamingException){
             //if error occured ...
        }Is it possible to determine the numeric error code, returned from server?

I was just working on using openldap, binding to it and checking for expired passwords and locked accounts and it looks like that an AuthenticationException is thrown in these circumstances and the ctx is null so it is not possible process connection response controls. But you can look at operation attributes if you have password policy enabled and you are looking for these type of errors

C# error when connecting to ldap server that does not exist

When using Novell.Directory.Ldap.dll and making a connect to an ldap
server which does not exists i'm getting the following error:
Connection.freeWriteSemaphore(-2): semaphore not owned by any thread
Im using this to connect: conn.Connect(ldapHost, ldapPort);
This error is not catched by LdapException. Can anyone tell me if this is
a bug or do I have to do something different.

Hi. I'm using version 2.1.11 of the NDK for CSharp. I'm getting this
same error message:
Code:
Connection.freeWriteSemaphore(-2): semaphore not owned by any thread
at Novell.Directory.Ldap.Connection.freeWriteSemaphor e(Int32 msgId)
at Novell.Directory.Ldap.Connection.connect(String host, Int32 port, Int32 semaphoreId)
at Novell.Directory.Ldap.LdapConnection.Connect(Strin g host, Int32 port)
at TestLDAP.Program.Main(String[] args) in D:\Documents and Settings\tjbuege\my documents\visual studio 2010\Projects\TestLDAP\TestLDAP\Program.cs:line 20
This occurs when I try to bind to a server that does not exist. Here
is my sample source code that generates that error:
Code:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using Novell.Directory.Ldap;
namespace TestLDAP
class Program
static void Main(string[] args)
LdapConnection conn = null;
string host = "server.does.not.exist.com";
int port = 389;
try
conn = new LdapConnection();
conn.Connect(host, port);
catch (Exception ex)
Console.WriteLine(ex.Message);
Console.WriteLine(ex.StackTrace);
if (conn != null)
conn.Disconnect();
Is there a fix for this? It makes this library useless for me.
Thanks,
Tim
tjbuege
tjbuege's Profile: http://forums.novell.com/member.php?userid=108957
View this thread: http://forums.novell.com/showthread.php?t=365082

Error in authentication with ldap server with certificate

Similar Messages

Maybe you are looking for