Getting SSGD 4.41 to work with SSL + Client Certificate

Question

Hello everybody.
I'm running SSGD 4.41.909 on SuSE Linux Enterprise Server 10+Sp2 (x86_32bit) and I configured it to perform KERBEROS authentication against a Windows 2003R2 server.
Everything worked fine so I decided to give SSL+Client Ceritifcate a try.
I configured the Win2003R2 server as per the manual and I also:
. imported the Active Directory root CA into SSGD trustore (/opt/tarantella/bin/jre/lib/security/cacerts)
. created a new key and a CSR using the keytool
. signed the above CSR with the Active Directory CA
. imported the just signed certificate info SSGD keystore (/opt/tarantella/var/info/certs/sslkeystore)
With the keytool I'm able to verify that the keystore does actually contains a valid CLIENT certificate:
/opt/tarantella/bin/jre/bin/keytool -list \
-keystore /opt/tarantella/var/info/certs/sslkeystore \
-keypass "$(cat /opt/tarantella/var/info/key)" \
-storepass "$(cat /opt/tarantella/var/info/key)"Keystore type: JKS
Keystore provider: SUN
Your keystore contains 2 entries
testssgd, Dec 17, 2008, PrivateKeyEntry,
Certificate fingerprint (MD5): 33:3B:41:EC:A2:4C:FF:02:D7:0D:D8:2D:EB:B2:2A:2B
ssgd_client_cert, Dec 17, 2008, trustedCertEntry,
Certificate fingerprint (MD5): DE:6B:BA:28:39:6B:B2:7B:51:F5:F2:6B:41:6E:6B:C1
As you can see, the ssgd_client_cert is indeed available into the sslkeystore.
Next, I configured SSGD as follows:
Step4: LDAP Repository Details
Repository Type: (*) Active Directory
URLs: ad://zen.strhold.it
Connection Security: () Kerberos
(*) SSL
[x] Client Certificate Used
Active Directory Base Domain: zen.strhold.it
Active Directory Default Domain: zen.strhold.it
[Next]
I did not have any errors when I clicked over [Next] and the same went when I selected the [Finish] button.
I logged out of the Admin console, restarted the SSGD server and tried to login using an Active Directory VALID user but here's what I got:
Sun Secure Global Desktop Software (4.41) WARNING:
Could not find a client certificate to use to authenticate the
connection to the Active Directory server
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'
cannot be used to retrieve data from the Active Directory.
A known resolution to this warning is:
- Import a client certificate for this server into the SGD keystore.
For more information on how to do this, consult the SGD Administration
Guide.
2008/12/17 17:16:36.246     (pid 18920)     server/ad/warningerror     #1229530596247
Sun Secure Global Desktop Software (4.41) WARNING:
Failed to connect to the global catalog:
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'.
Reason:
[LDAP: error code 49 - 8009030C: LdapErr: DSID-0C09048B, comment: The server did not receive any credentials via TLS, data 0, vece]
Global catalog:
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'
cannot be used to retrieve data from the forest.
To help troubleshoot this warning,
- Verify that this global catalog is available on the network.
- Verify that SGD can resolve the global catalog's hostname via DNS.
- Verify that SGD can connect to port 3268 on the global catalog.
- Verify that this server is a global catalog for the forest.
I'm pretty sure I do have a client certificate into SSGD keystore (as demonstrated by the keytool utility).
Am I missing something or what?
Things I've already cheched:
. both the SSGD and Windows server clocks are in synch
. the DNS server (on Windows) is able to resolve the names of the boxes in both forward and reverse mode
. no firewall is operating between the boxes
Thanks,
Rob

Answer 1

Hi DD.
Thanks again for your time and patience!
Well, today I restarted the SSGD box (it's a virtual machine) and issued the:
    keytool -list -keystore sslkeystore -storepass "$(cat /opt/tarantella/var/info/key)" -keypass "$(cat /opt/tarantella/var/info/key)"command. Much to my surprise, this time I got the following output:
Your keystore contains 1 entry
+testssgd, Dec 19, 2008, trustedCertEntry,+
Certificate fingerprint (MD5): 37:0D:8B:17:71:95:E6:D1:19:ED:D4:93:DE:5E:E7:35
As you can see, now the certificate is recognized as "trustedCertEntry* instead of the previous PrivateKeyEntry. If you step back to my previous post, you should be able to tell that the MD5 is the same one I got for the PrivateKeyEntry.
+testssgd, Dec 19, 2008, PrivateKeyEntry,+
+Certificate fingerprint (MD5): 37:0D:8B:17:71:95:E6:D1:19:ED:D4:93:DE:5E:E7:35+
By issuing the suggested:
{code}keytool -v -list -keystore sslkeystore -alias testssgd{code}
command I got the following output (snipped):
+Alias name: testssgd+
+Creation date: Dec 19, 2008+
+Entry type: trustedCertEntry+
+Owner: CN=ssgd.zen.strhold.it, OU=Strhold Evolution Division, O=Strhold, L=Reggio Emilia, ST=Italy, C=IT+
+Issuer: CN=ADroot, DC=zen, DC=strhold, DC=it+
+Serial number: 1568abe4000000000006+
+Valid from: Fri Dec 19 17:45:52 CET 2008 until: Sun Dec 19 17:45:52 CET 2010+
+Certificate fingerprints:+
+     MD5: 37:0D:8B:17:71:95:E6:D1:19:ED:D4:93:DE:5E:E7:35+
+     SHA1: 00:8F:59:04:51:49:A6:73:8C:B5:6D:74:C6:90:30:32:24:DE:6D:EA+
+     Signature algorithm name: SHA1withRSA+
+     Version: 3+
As you can see, the Issuer is ADRoot (CN=ADroot, DC=zen, DC=strhold, DC=it).
The error messages did not change (
Attempted login for [email protected]
using disambiguation attributes {}.
2008/12/22 13:37:10.306     (pid 3764)     server/kerberos/info     #1229949430306
Kerberos attempting to log in rzini in to ZEN.STRHOLD.IT
2008/12/22 13:37:10.647     (pid 3764)     server/kerberos/moreinfo     #1229949430647
Kerberos succeeded in authenticating [email protected] to ZEN.STRHOLD.IT
2008/12/22 13:37:10.711     (pid 3764)     server/ldap/info     #1229949430711
LDAP config is: "ad://zen.strhold.it"
2008/12/22 13:37:10.716     (pid 3764)     server/ldap/info     #1229949430716
LDAP server user was changed for scope "forest" to ""
2008/12/22 13:37:10.796     (pid 3764)     server/ldap/moreinfo     #1229949430796
NSLookup succeeded: "win2003r2.zen.strhold.it." returned 192.168.68.1
2008/12/22 13:37:10.801     (pid 3764)     server/ldap/moreinfo     #1229949430801
Service lookup succeeded: "_gc._tcp.zen.strhold.it." returned 192.168.68.1:3268
2008/12/22 13:37:11.316     (pid 3764)     server/ad/warningerror     #1229949431315
Sun Secure Global Desktop Software (4.41) WARNING:
Could not find a client certificate to use to authenticate the
connection to the Active Directory server
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'
cannot be used to retrieve data from the Active Directory.
A known resolution to this warning is:
- Import a client certificate for this server into the SGD keystore.
For more information on how to do this, consult the SGD Administration
Guide.
2008/12/22 13:37:11.321     (pid 3764)     server/ad/warningerror     #1229949431321
Sun Secure Global Desktop Software (4.41) WARNING:
Failed to connect to the global catalog:
'Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up'.
Reason:
[LDAP: error code 49 - 8009030C: LdapErr: DSID-0C09048B, comment: The server did not receive any credentials via TLS, data 0, vece]
[snip]
Discovery results:
Looking up Global Catalog DNS name: _gc._tcp.zen.strhold.it. - HIT
Looking for GC on server: Active Directory:win2003r2.zen.strhold.it:/192.168.68.1:3268:Up - ERROR
The Active Directory login authority and LDAP generation will not work as
SGD could not find a contactable global catalog.
2008/12/22 13:37:11.329     (pid 3764)     server/ldap/error     #1229949431329
Sun Secure Global Desktop Software (4.41) ERROR:
LDAP call failed: null lookupLink-.../_ldapmulti/forest/("DC=ZEN,DC=STRHOLD,DC=IT") 587ms javax.naming.NameNotFoundException: Failed to lookup a Global Catalog server
A call to LDAP failed. This might mean LDAP users cannot log in.
I can provide you with the Java exception which was reported but I cannot include it with this message due to the restriction in size we have when posting.
Thanks again,
Rob