LC + ActiveDirectory + LDAP over SSL = doesn't work

Hi,
I installed Active Directory Certificate Services. Now I want setup LDAP over SSL. Unfortunatelly it doesn't work. I pressed "Test" and always get "Invalid username or invalid password" (
German: "Ungültiger Benutzername oder ungültiges Kennwort"). I'm pretty sure username and password are fine (it worked before I installed Active Directory Certificate Services and used LDAP without SSL).
On server.log, I got this:
2011-11-12 00:51:28,202 INFO [com.adobe.idp.um.businesslogic.synch.LdapHelper] Following stacktrace is generated due to the Test LDAP Server Configuration action
javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1]
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:134)
        at com.adobe.idp.um.businesslogic.synch.LdapHelper.createContext(LdapHelper.java:663)
        at com.adobe.idp.um.businesslogic.synch.LdapHelper.testServerConfig(LdapHelper.java:682)
        at com.adobe.idp.um.ui.config.ConfigDirectoryEditAction.testServerSettings_onClick(ConfigDirectoryEditAction.java:215)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at com.cc.framework.adapter.struts.ActionUtil.handleFormAction(Unknown Source)
        at com.cc.framework.adapter.struts.FWAction.handleFormAction(Unknown Source)
        at com.cc.framework.adapter.struts.ActionUtil.execute(Unknown Source)
        at com.cc.framework.adapter.struts.FWAction.execute(Unknown Source)
        at com.cc.framework.adapter.struts.FWAction.execute(Unknown Source)
        at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:431)
        at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:236)
        at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196)
        at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:432)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:710)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.adobe.framework.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:173)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.adobe.idp.um.auth.filter.AuthenticationFilter.doFilter(AuthenticationFilter.java:154)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.adobe.idp.um.auth.filter.PortalSSOFilter.doFilter(PortalSSOFilter.java:91)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at com.adobe.idp.um.auth.filter.CSRFFilter.doFilter(CSRFFilter.java:41)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
        at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:179)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:433)
        at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)
        at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:543)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:241)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:580)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
        at java.lang.Thread.run(Thread.java:619)
Do you have some Idea?
cu Floh

I have not done it for Netscape yet but I have done it for Novell and JNDI.. Here is the settings for Novell
// Dynamically set JSSE as a security provider
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
// Dynamically set the property that JSSE uses to identify
// the keystore that holds trusted root certificates
System.setProperty("javax.net.ssl.trustStore", m_connectionData.getLocal("KeyStore").toString());
ssf = new LDAPJSSESecureSocketFactory();
// Set the socket factory as the default for all future connections
LDAPConnection.setSocketFactory(ssf);

Similar Messages

Trying to determine if LDAP over SSL is working using LDP.exe

Hi,
I just wanted to confirm that LDAP over SSL is working properly on our domain controller. When I connect using LDP.exe on my Windows 7 computer, I get the following output:
ld = ldap_sslinit("dc1.domain.com", 636, 1);
Error 0 = ldap_set_option(hLdap, LDAP_OPT_PROTOCOL_VERSION, 3);
Error 0 = ldap_connect(hLdap, NULL);
Error 0 = ldap_get_option(hLdap,LDAP_OPT_SSL,(void*)&lv);
Host supports SSL, SSL cipher strength = 128 bits
Established connection to dc1.domain.com.
Retrieving base DSA information...
Getting 1 entries:
Dn: (RootDSE)
<unnecessary details>
It looks like it is working, but I wasn't sure if the Error 0's mean there is some sort of problem.
Also, when I run a Simple bind with my credentials, I get the following output:
res = ldap_simple_bind_s(ld, 'myuseraccount-at-domaindotcom', <unavailable>); // v.3
Authenticated as: 'DOMAIN\myuseraccount'.
Finally, when I run a Bind as currently logged on user (with Encrypt traffic after bind checked), I get the following output:
53 = ldap_set_option(ld, LDAP_OPT_ENCRYPT, 1)
res = ldap_bind_s(ld, NULL, &NtAuthIdentity, NEGOTIATE (1158)); // v.3
{NtAuthIdentity: User='NULL'; Pwd=<unavailable>; domain = 'NULL'}
Authenticated as: 'DOMAIN\myuseraccount'.
I followed all the instructions found in Microsoft article KB-321051 to get LDAP over SSL working with a valid 3rd party certificate on one of our Windows 2008 R2 domain controllers. However, when I test Active Directory Authentication on our
WatchGuard Management Server after importing the CA certificate, the test fails. In order to use Active Directory Authentication, LDAPS (LDAP over SSL) must be enabled in the Active Directory domain and I am not 100% sure that it is enabled properly.
Any advice or additional insight would be greatly appreciated.
Thanks!

Some ideas:
DNS Name: KB-321051 says that you need the DNS name in either Subject CN or Subject Alternative Name. Which one did you use? Windows clients are fine with an empty CN and only the SAN populated (there the "either or" statement in the article)
but third-party tools often look for the DNS name in the Subject CN.
Even if the WatchGuard Server runs on Windows it might use its own certificate checking logic.
DC certificate(s): Does the DC have more than this certificate? If yes I'd run a network trace to check which one the machine is actually sending in the SSL handshake.
Chaining issues at your LDAP client / the WatchGuard Management Server:
Very often such issues are related to the fact that the certificate chain is not validated properly. Some typical issues:
It is not clear whether the client uses the Windows certificate store (even if it runs on a Windows server).
Tools / systems / PKI clients can only deal with a single root CA, not with a hierarchy.
You need to import both Root and intermediate CAs as the client cannot fetch the intermediates from AIA URLs.
The client cannot access CRL URLs because of firewalls rules or missing access (e.g.: A CRL URL in AD is used but the client does not have an AD user in whose context it would try to fetch the CRL).
The client has issues with blanks or special characters in CDP or AIA URLs.
Having a quick look at
WatchGuard documentation it seems to me that they are using their own certificate stores you need to import CA certificates to. And they only mention a "Root CA" so if your PKI has two levels you might need to import both CAs to the so-called Root store.
Elke

Ldap over ssl in windows 2008 r2

hi
i wanted to configure ldap over ssl and i have created security template along with apropriate persmission however when i want to add it my domain 2008 R2 computer it gives me error.
""the permision on the certificate template do not allow the current user to enrol for this type of certificate""
""you do not have perssmion to view this type of certificate""
kindly advise me.
greenman

On Sun, 23 Feb 2014 08:23:40 +0000, GreeMann wrote:
I believe my main problem is that I can not issue any template I have tried other template but I get the same permission error I have tried different account I get the same permission error, is there any way that we can change the default template permission.?
You have not followed the instructions I gave. As I've said in previous
posts, the way you've got this template configured is never going to work
as it is configured to build the subject information from AD and one of the
attributes being included in the Subject Alternative Name is the DNS. Since
you're using a user account to request the certificate when it attempts to
build the subject alternative name it is trying to add the user's DNS name.
A user account does not have a DNS name.
I would suggest that you delete any custom templates you've already created
and start over again. As per one of my previous posts:
http://technet.microsoft.com/en-us/library/ff625722%28v=ws.10%29.aspx
Follow the instructions in the Using the Certificate Enrollment wizard with
an enterprise CA section.
If you don't follow the instructions I've given you, I can't help you.
Paul Adare - FIM CM MVP
Of all the things I've lost, I miss my mind the most.

LDAP over SSL

A hosted service wants to authenticate against our AD. They recommend using LDAPS.
What is best practice? Install a public certificate on a DC.
For instance on DC1.contoso.com. Then would I open up 443 on the firewall to that DC and allow from that IP? How would that affect other local LAN clients authenticating to that DC?

A hosted service wants to authenticate against our AD. They recommend using LDAPS.
What is best practice? Install a public certificate on a DC.
For instance on DC1.contoso.com. Then would I open up 443 on the firewall to that DC and allow from that IP? How would that affect other local LAN clients authenticating to that DC?
If its hosted services & if its supports ADAM/AD LDS, then its much safe to use them instead of RWDC or RODC. Enabling LDAP over SSL enhances the security of the information how information is transmitted when client tries to contact DC for the information(authentication/authorization).
Normally w/o LDAPs being configured in the environment, when client queries a DC in the domain, the information is transmitted in the plain text which ca be read by the hacker using tools available for free. The reason is simple the information on transit
is not encrypted, but enabling LDAP over SSL prevent the unencrypted queries & provide more security.
You can't simple implement LDAP over SSP, but it needs PKI infrastructure, planning & designing which is comprehensively listed into the document URL posted by Justin. You can also use ldap over SSL using AD LDS.
http://blogs.technet.com/b/pki/archive/2011/06/02/implementing-ldaps-ldap-over-ssl.aspx
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Failed to use LDAP over SSL MUTUAL AUTHENTICATION with some Directory enable SSL.

In iPlanet Web Server, Enterprise Edition Administration's guide, chapter 5: secure your web server - Using SSL and TLS protocol specifying that the Administrator server camn communicate LDAP over SSL with some Directory enable SSL.
Is there any way to configure iplanet Administration server to talk ldap/ssl in mutual authentication mode with some directory?

Hi,
Sorry, I could not understand what your are trying to do with iWS.
Could you please berifly explain your question. So that I can help you.
Regards,
Dakshin.
Developer Technical Support
Sun Microsystems
http://www.sun.com/developers/support.

LDAP over SSL gives an error when testing connection in RPD

Hello all,
I got something strange. When I configure OBIEE to use an LDAP server (ADSI) it just works fine.
Now when I change the port number and check SSL and I check the connection again it says:
[53016] The IBM LDAP SSL (Secure Socket Layer) client library initialization failed: Reason: Bad keyfile password
But now when I log on to OBIEE with an AD user it just works...
Anyone with the same problem/issue?

On Sun, 23 Feb 2014 08:23:40 +0000, GreeMann wrote:
I believe my main problem is that I can not issue any template I have tried other template but I get the same permission error I have tried different account I get the same permission error, is there any way that we can change the default template permission.?
You have not followed the instructions I gave. As I've said in previous
posts, the way you've got this template configured is never going to work
as it is configured to build the subject information from AD and one of the
attributes being included in the Subject Alternative Name is the DNS. Since
you're using a user account to request the certificate when it attempts to
build the subject alternative name it is trying to add the user's DNS name.
A user account does not have a DNS name.
I would suggest that you delete any custom templates you've already created
and start over again. As per one of my previous posts:
http://technet.microsoft.com/en-us/library/ff625722%28v=ws.10%29.aspx
Follow the instructions in the Using the Certificate Enrollment wizard with
an enterprise CA section.
If you don't follow the instructions I've given you, I can't help you.
Paul Adare - FIM CM MVP
Of all the things I've lost, I miss my mind the most.

LDAP over SSL for Solaris 9 / Solaris 10

I have successfully configured Solaris-10 clients to use Windows 2003 R2 Active Directory for LDAP authentication over SSL. However, my production environment is still running on Solaris-9. I am able to make Kerberos and ldapsearch working on Solaris-9, but I am still NOT able to use PuTTY to make authentication with AD.
I reviewed all my steps that I configured on Solaris-10, but somewhat I could not make it work on Solaris-9. If anybody sucessfully deployed on Solaris-9, please advices! Any helps greatly appreciated.
Here are what I got so far on Solaris-9
=======================================================
KERBEROS
=======================================================
#getent passwd aduser
aduser:1000:1000:aduser:/export/home/aduser:/bin/sh
#kinit [email protected]
Password for [email protected]:
#klist
Ticket cache: /tmp/krb5cc_0
Default principal: [email protected]
Valid starting Expires Service principal
Fri Jan 04 17:22:34 2008 Sat Jan 05 03:22:34 2008 krbtgt/[email protected]
renew until Fri Jan 11 17:22:34 2008
=======================================================
LDAPSEARCH / SSL
=======================================================
#ldapsearch -v -h sundc1.consoto.com -p 636 -Z -P /var/ldap/cert8.db -D cn=administrator,cn=users,dc=consoto,dc=com -w - -b "dc=consoto,dc=com" -v -s base "objectclass=*"
Enter bind password:
ldapsearch: started Fri Jan 4 17:23:52 2008
LDAP Library Information -
Highest supported protocol version: 3
LDAP API revision: 2005
API vendor name: Sun Microsystems Inc.
Vendor-specific version: 5.08
LDAP API Extensions:
SERVER_SIDE_SORT (revision 1)
VIRTUAL_LIST_VIEW (revision 1)
PERSISTENT_SEARCH (revision 1)
PROXY_AUTHORIZATION (revision 1)
X_LDERRNO (revision 1)
X_MEMCACHE (revision 1)
X_IO_FUNCTIONS (revision 1)
X_EXTIO_FUNCTIONS (revision 1)
X_DNS_FUNCTIONS (revision 1)
X_MEMALLOC_FUNCTIONS (revision 1)
X_THREAD_FUNCTIONS (revision 1)
X_EXTHREAD_FUNCTIONS (revision 1)
X_GETLANGVALUES (revision 1)
X_CLIENT_SIDE_SORT (revision 1)
X_URL_FUNCTIONS (revision 1)
X_FILTER_FUNCTIONS (revision 1)
ldap_init( sundc1.consoto.com, 636 )
ldaptool_getcertpath -- /var/ldap/cert8.db
ldaptool_getkeypath -- .
ldaptool_getdonglefilename -- (null)
filter pattern: objectclass=*
returning: ALL
filter is: (objectclass=*)
version: 1
dn: dc=consoto,dc=com
objectClass: top
objectClass: domain
objectClass: domainDNS
distinguishedName: DC=consoto,DC=com
instanceType: 5
whenCreated: 20071220204021.0Z
whenChanged: 20071226231851.0Z
subRefs: DC=ForestDnsZones,DC=consoto,DC=com
subRefs: DC=DomainDnsZones,DC=consoto,DC=com
subRefs: CN=Configuration,DC=consoto,DC=com
uSNCreated: 4098
uSNChanged: 16663
name: consoto
objectGUID:: bM0hWw8HKEOYCFN3yQ==
creationTime: 128426572605937500
forceLogoff: -9223372036854775808
lockoutDuration: -18000000000
lockOutObservationWindow: -18000000000
lockoutThreshold: 0
maxPwdAge: -37108517437440
minPwdAge: -864000000000
minPwdLength: 7
modifiedCountAtLastProm: 0
nextRid: 1003
pwdProperties: 1
pwdHistoryLength: 24
objectSid:: AQQAAAAAAAUAAYA4LaLGUspxVHsMP
serverState: 1
uASCompat: 1
modifiedCount: 129
auditingPolicy:: AAE=
nTMixedDomain: 0
rIDManagerReference: CN=RID Manager$,CN=System,DC=consoto,DC=com
fSMORoleOwner: CN=NTDS Settings,CN=SUNDC1,CN=Servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=consoto,DC=com
systemFlags: -1946157056
wellKnownObjects: B:32:6227F0AF1FC2410D8E3BB10615BB5B0F:CN=NTDS Quotas,DC=sunl
ab,DC=com
wellKnownObjects: B:32:F4BE92A4C777485E878E9421D53087DB:CN=Microsoft,CN=Progra
m Data,DC=consoto,DC=com
wellKnownObjects: B:32:09460C08AE1E4A4EA0F64AEE7DAA1E5A:CN=Program Data,DC=sun
lab,DC=com
wellKnownObjects: B:32:22B70C67D56E4EFB91E9300FCA3DC1AA:CN=ForeignSecurityPrin
cipals,DC=consoto,DC=com
wellKnownObjects: B:32:18E2EA80684F11D2B9AA00C04F79F805:CN=Deleted Objects,DC=
consoto,DC=com
wellKnownObjects: B:32:2FBAC1870ADE11D297C400C04FD8D5CD:CN=Infrastructure,DC=s
unlab,DC=com
wellKnownObjects: B:32:AB8153B7768811D1ADED00C04FD8D5CD:CN=LostAndFound,DC=sun
lab,DC=com
wellKnownObjects: B:32:AB1D30F3768811D1ADED00C04FD8D5CD:CN=System,DC=consoto,DC
=com
wellKnownObjects: B:32:A361B2FFFFD211D1AA4B00C04FD7D83A:OU=Domain Controllers,
DC=consoto,DC=com
wellKnownObjects: B:32:AA312825768811D1ADED00C04FD8D5CD:CN=Computers,DC=consoto
,DC=com
wellKnownObjects: B:32:A9D1CA15768811D1ADED00C04FD8D5CD:CN=Users,DC=consoto,DC=
com
objectCategory: CN=Domain-DNS,CN=Schema,CN=Configuration,DC=consoto,DC=com
isCriticalSystemObject: TRUE
gPLink: [LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=Syste
m,DC=consoto,DC=com;0]
masteredBy: CN=NTDS Settings,CN=SUNDC1,CN=Servers,CN=Default-First-Site-Name,C
N=Sites,CN=Configuration,DC=consoto,DC=com
ms-DS-MachineAccountQuota: 10
msDS-Behavior-Version: 2
msDS-PerUserTrustQuota: 1
msDS-AllUsersTrustQuota: 1000
msDS-PerUserTrustTombstonesQuota: 10
msDs-masteredBy: CN=NTDS Settings,CN=SUNDC1,CN=Servers,CN=Default-First-Site-N
ame,CN=Sites,CN=Configuration,DC=consoto,DC=com
dc: consoto
1 matches
I am thinking about pam.conf file or ldapclient's configuration file, any suggestion?

I have now sat down and looked at your suggestion and I am pretty certain we can't implement it ... :( I was hoping it was just going to be configuration files that were copied (maybe a naive hope, but there you go!) This system is going to be deployed as a live service for a government agency so I do not think we can, in all good conscience, have binaries from two different OS releases residing on the same server as it will make the system nigh-on non-patchable.
Let's hope Sun have somethig constructive to say about our issue which, I am slowly beginning to think, is related to the password.
If I su to the test AD user we have whilst logged in as a root user (which does not, of course, prompt for a password) it all works nicely - home directory, shell, the id command gives all that is expected of uid and gid. Now, should I be in a as a non-root user and try the same I get prompted for a password and it all fails - despite me providing what should be the correct password.
If I do a getent for the user the returned data has a blank for the password field (as opposed to the usual x).
I think that somewhere, somehow, in the transmission of data that the password is getting a level of encryption that the AD is not setup to unravel. The packets are all encrypted through ldap (we are using tls simple) but what of the password within the packet? Does anything encrypt that first, and if so, does AD know how to decrypt it?

Trying to connect to an AD LDAP over SSL via OPEN_SSL

Hello,
We are getting the error below when we attempt to run this code. Any ideas? Does this point to an incorrectly configured wallet and/or certificate?
DECLARE
BEGIN
l_session := DBMS_LDAP.init ( hostname => l_ldap_host_in, portnum => l_ldap_port_in );
l_retval := DBMS_LDAP.OPEN_SSL(l_session, owallet_loc, owallet_pwd, 2); -- Over SSL
l_retval := DBMS_LDAP.simple_bind_s ( ld => l_session, dn => l_ldap_dn_in, passwd => l_ldap_password_in );
l_retval := DBMS_LDAP.unbind_s(l_session);
END;
Error report:
ORA-31202: DBMS_LDAP: LDAP client/server error: UnKnown Error Encountered
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 86
ORA-06512: at "SYS.DBMS_LDAP", line 1457
ORA-06512: at "SYS.DBMS_LDAP", line 1234
ORA-06512: at line 21
31202. 00000 - "DBMS_LDAP: LDAP client/server error: %s"
*Cause: There is a problem either on the LDAP server or on the client.
*Action: Please report this error to the LDAP server administrator or
your Database administrator.
Any help will be greatly appreciated! Thank you,
Alex.

We had never tried this before. I'm the Programmer trying to make the code work. I found this other thread Google'ing https://kr.forums.oracle.com/forums/thread.jspa?threadID=494022&start=15&tstart=0 and asked our Network Admin and our DBA to follow steps 1 and 2 and provide location to the wallet and password when they were done, which they did.
Now I'm testing the code and getting that error. I was about to report it to them, but I thought I should try and help by providing a possible fix, or maybe the code is the problem?
Alex.
Edited by: alarzabal on Dec 7, 2011 6:24 PM

LInks over shape doesn't work

I just recently reformatted my iWeb pages and I love them. The problem is that most of them are buried under a pictures category (I want them that way). When I created hyperlinks in iWeb it changed the color of my font. So I inserted a shape behind the text and put the hyperlinks there.
That doesn't work. I also tried putting the hyperlinks back on the text and when I publish, they don't work either. I like the shapes and don't want to remove them. How can I keep the pink shapes under my pictures page and keep the text white?
http://web.mac.com/kryst1012/iWeb/Krystin/Photos.html

Keep all of your shapes right where they are! To make your text into hyperlinks then, just insert another shape...make it big or small enough to cover your text. Go ahead and drag it right over your text. Now attach the hyperlink to this shape. Now in the INspector,click over to the Graphics tab and change the opacity of this shape to 1%.
You have now created a "hotspot" hyperlink over your text! All without moving any of your other shapes around! Publish and see the results... Let me know if it works out for you!

Xcelsius/Dashboard Design - mouse over capability doesn't work/losing hover

Hello there, I am currently in a tough situation. If any Xcelsius gurus can provide me with a solution, I would very much appreciate your help.
I currently have a dashboard with pie chart component in the default view. It has a radio button with two values. The mouse over doesn't work when the dashboard is loaded. However, when I make a selection in the radio button, the mouse over works for both the options. I have noticed this is a bug but if anyone has a solution or way around it, let me know.
Another issue - I have a 'All' view and 'Region' views in the menu bar. When a user clicks on a particular Region, then clicks all and goes back to a region, I lose the drill down capability on the pie chart thats on the Region view. initially, the mouse over and drill down works fine. However, after going to the All view and coming back to a region, this capability is lost. It acts the same way as the problem above. User can't hover nor drill down. If anyone has a solution to this, let me know.

FYI this is the article on the main forum page:
Announcement: New to Spry, or the Spry forums?
Hide Details
Before you post a topic please verify that:
You are using the latest Spry files
The latest version of the Adobe Spry Framework is 1.6.1, this is the same version that ships with Dreamweaver CS4. If you use Dreamweaver CS3 (uses Spry 1.4), its wise to upgrade your files to the latest version. This can easily be done using the Spry Updater that can be found here.
After that we will have a look at your code.
Ben

Mail service SSL doesn't work after migration

Well, the migration worked well, EXCEPT that I cannot get SSL to work for the mail service.
The same SSL certificate that works fine for the web service doesn't seem to work properly for mail. Prior to the in place upgrade, everything was fine, now, mail clients get the message that certificate may have been issued by an unknown authority -- BUT ONLY FOR IMAP and POP. Using the same certificate for SMTP seems to work just fine.
My working theory is that at one point I had to reissue the certificate completely, and that somehow, Cyrus was using the older certificate and private key, and that during the migration, things got really hosed.
Is there any way to get the new dovecot service to use the same cert? The GUI suggests it is, but I suspect some command line trickery may be needed.
On one final note: how does one run Keychain First Aid on the system keychain?

For reasons I cannot explain, dovecot.conf contains a line commented out specifically excluding the CA chain file -- saying it usually isn't required.
Removing the comment from this field (the installer generated a new file and created it on the disk, it's just commented out) resulted in SSL magically working again.
Now the bigger question: why was option in the dovecot.conf file intentionally disabled, even though the correct information (correct imported file path, correct imported files) were populated?

Http tunneling (t3 over http) doesn't work!! (examples too)

Hi,
I'm trying to get http tunneling (t3 connection over http protocol) to work. I
ran some examples included with Weblogic that try establishing that connection
(PingTest, HelloApplet, SimpleT3Client), as well as my own test program, and they
all give an error similar to this :
Couldn't get a reference to server. Exception :
javax.naming.CommunicationException. Root exception is java.net.ConnectException:
No server found at HTTP://<IP>:<port>
at weblogic.rjvm.RJVMFinder.findOrCreate(RJVMFinder.java:161) at weblogic.rjvm.ServerURL.findOrCreateRJVM(ServerURL.java:200)
at weblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialContextFactoryDelegate.java,
Compiled Code) at weblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialContextFactoryDelegate.java:148)
at weblogic.jndi.WLInitialContextFactory.getInitialContext(WLInitialContextFactory.java:123)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:671) at
javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:242) at javax.naming.InitialContext.init(InitialContext.java:218)
at javax.naming.InitialContext.<init>(InitialContext.java:194)
(I replaced the actual Ip and port with <IP> and <port>).
Now, the server is started and working at that ip and port - it services web http
requests correctly, etc. Regular T3 connection (not over http) also works with
it.
Does anyone know the reason for this problem and/or how to fix it?
Thanks, Leonid Portnoy

It appears that one has to use the "Java Plugin" for this mode to work. The
question is does the version of plugin need to be "in sync" with the JVM
version on the server. ?.
/rk
"Adomas Svirskas" <[email protected]> wrote in message
news:[email protected]...
>
It seems that the solution is to have these two lines in the
properties file:
weblogic.httpd.enable=true
weblogic.httpd.tunnelingenabled=true
Now it works.
Thanks,
Adomas
"Adomas Svirskas" <[email protected]> wrote:
Hi Leonid,
Have you found a solution for this? I have these problems too.
Thanks,
Adomas
"Leonid Portnoy" <[email protected]> wrote:
Hi,
I'm trying to get http tunneling (t3 connection over http protocol)to
work. I
ran some examples included with Weblogic that try establishing thatconnection
(PingTest, HelloApplet, SimpleT3Client), as well as my own test program,
and they
all give an error similar to this :
Couldn't get a reference to server. Exception :
javax.naming.CommunicationException. Root exception is
java.net.ConnectException:
No server found at HTTP://<IP>:<port>
at weblogic.rjvm.RJVMFinder.findOrCreate(RJVMFinder.java:161) atweblogic.rjvm.ServerURL.findOrCreateRJVM(ServerURL.java:200)
atweblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialCon
textFactoryDelegate.java,
Compiled Code) atweblogic.jndi.WLInitialContextFactoryDelegate.getInitialContext(WLInitialCon
textFactoryDelegate.java:148)
atweblogic.jndi.WLInitialContextFactory.getInitialContext(WLInitialContextFact
ory.java:123)
atjavax.naming.spi.NamingManager.getInitialContext(NamingManager.java:671)
at
javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:242)
at javax.naming.InitialContext.init(InitialContext.java:218)
at javax.naming.InitialContext.<init>(InitialContext.java:194)
(I replaced the actual Ip and port with <IP> and <port>).
Now, the server is started and working at that ip and port - it services
web http
requests correctly, etc. Regular T3 connection (not over http) alsoworks
with
it.
Does anyone know the reason for this problem and/or how to fix it?
Thanks, Leonid Portnoy

Receiveing data over RTP doesn't work

First of all , excuse my english.....it really sucks
Second of all , this is my problem:
I modified the JMStudio source to suit my needs.....leaving just what i needed.The application works......it sends data just fine but it does't receives it.I tried to rewrite the function thousand of times in different modes but it doesn't work.
This is my source code :
          private void openRtp () {
OpenRtpDialog dlgOpenRtp;
String strAction;
String strAddress;
String strPort;
String strTtl;
RTPManager           receptie=RTPManager.newInstance();
InetAddress      adresaip=null;
int                    port,ttl;
ReceiveStreamListener receptiestr = null;
ReceiveStreamEvent     x = null;
dlgOpenRtp = new OpenRtpDialog ( this, cfgJMApps );
     dlgOpenRtp.isVisible ();
strAction = dlgOpenRtp.getAction ();
if ( !strAction.equals(JMDialog.ACTION_OPEN) )
return;
strAddress = dlgOpenRtp.getAddress();
strPort = dlgOpenRtp.getPort ();
strTtl = dlgOpenRtp.getTtl ();
               try {
                    adresaip=InetAddress.getByName(strAddress);
               } catch (UnknownHostException e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
port=Integer.valueOf(strPort).intValue();
ttl=Integer.valueOf(strTtl).intValue();
SessionAddress adresa=new SessionAddress(adresaip,port,ttl);
     try {
                    receptie.initialize(adresa);
               } catch (InvalidSessionAddressException e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
               } catch (IOException e) {
                    // TODO Auto-generated catch block
                    e.printStackTrace();
if ( receptie == null ) {
MessageDialog.createErrorDialog ( this, JMFI18N.getResource("jmstudio.error.sessionmngr.create") );
return;
receptie.addReceiveStreamListener(receptiestr);
receptiestr.update(x);
update(x);
// the rest will be done when we get NewReceiveStreamEvent
updateMenu ();
pls tell me what i do wrong cause it's driving me insane......the function from the JMStudio works in the original but doesn't work in my version so it makes me think that the problem is from somewhere else.
For further assistance i'll be watching this thread closely.
Thank you for your help.
Yours gratefully,
Sorin

I'm just going to point you in the direction of some sample code...
[http://java.sun.com/javase/technologies/desktop/media/jmf/2.1.1/solutions/AVReceive.html]
Go look at their "initialize" function and figure out what the sample code is doing that you aren't...
And remember, it could simply be a matter of doing something wrong with IP address... You can't use 127.0.0.1 for RTP transmissions, and you can't broadcast to the same computer if your transmit code is binding the destination port as the transmission port. IE, if you tell it to broadcast to the remote computer on port 2600, and it uses the local port 2600 to broadcast on...then you won't be able to read from port 2600 on the local computer.

LDAP over SSL - Works with AD Username but not with full logon @

Hello
I have 2 Cisco ASA 5505 and have configured SSL over LDAP to connect via a Active Directory server.
Everything works fine apart that lets say I have a user called [email protected] - When I am using Anyconnect or Cisco VPN Client and try that it does not work at all.
If I try abc without the @zzz.com then it works and authenticates to the AD and gets DHCP and user is fine.
The only question is since I think I have seen this documented somewhere - is that correct or can I use the @ full AD UPN ??
I am trying to make our users do a single SSO and have every other application using the full UPN.
Thanks

Hello
I have 2 Cisco ASA 5505 and have configured SSL over LDAP to connect via a Active Directory server.
Everything works fine apart that lets say I have a user called [email protected] - When I am using Anyconnect or Cisco VPN Client and try that it does not work at all.
If I try abc without the @zzz.com then it works and authenticates to the AD and gets DHCP and user is fine.
The only question is since I think I have seen this documented somewhere - is that correct or can I use the @ full AD UPN ??
I am trying to make our users do a single SSO and have every other application using the full UPN.
Thanks

Just bought 2013 MBP, VPN over L2TP doesn't work

I've already been looking at other articles about this issue, but they all seem to be related to the OS X Server edition of Mavericks. I'm assuming this issue is probably the same on the regular edition of Mavericks as well. Does anyone know if/when a patch will come out to fix this issue and does anyone know a work around in the mean time, that doesn't involve copying racoon over from Mountain Lion, since I never had Mountain Lion in the first place

A new Mac comes with 90 days of free tech support from AppleCare.
AppleCare: 1-800-275-2273
Best.

LC + ActiveDirectory + LDAP over SSL = doesn't work

Similar Messages

Maybe you are looking for