2

Basically i have an application that sits on JBoss which needs to connect to a LDAP server. (OS is Windows XP Pro) I started the JBoss with run.bat -c all -b 192.168.1.1.

I have no problem connecting to the LDAP server without SSL. The problem only surface when the LDAP server is setup with SSL, i have trouble connecting to the LDAP server. The following is the error message.

javax.naming.CommunicationException: simple bind failed: 192.168.1.100:636 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]

I have google about configuring JBoss and LDAP and stumbled upon http://docs.jboss.org/jbportal/v2.6.2/referenceGuide/html/ldap.html . Do I really need a JBoss Portal to setup with LDAP??

Could anyone out there help me out with this?? Am i missing out any configuration on JBoss??

Any advice would be greatly appreciated. Many thanks in advance.

Kevin

Nivek
  • 149
  • 1
  • 2
  • 8

1 Answers1

0

I think you need to import the trusted root certificate, (possibly any intermediary certs as well) into the Java keystore that JBoss is using. (When running on Linux, only place I have run JBoss, it uses Tomcat to run JBoss in it).

I am not sure where the default Java key store would be for Tomcat. You can use keytool from any Java JDK install, and import the trusted root that way. The keystore password should be 'default' since there is nothing secret about trusted root public keys.

Sample Keytool syntax might be:

keytool -importcert -keystore Path/to/store -storepass Password (Usually default or changeit) -alias Something -file FileWithPublicKey

To get the trusted root, an easy way is if the same cert is used for an HTTP interface. But I think IE will let you try ldaps://serverIP/ and then in the icon with a lock, you can see certificate details.

There is a tab for the certification chain. The top item is the CA who signed this cert (aka the Root that we need to Trust, to make it a Trusted Root).

If all this is too much, then here is a funny trick! Get the 600K Java based LDAP browser, called LBE and delete the local file lbecacert then run the LDAP Browser, make a config for your LDAP server, with SSL enabled, and when you first connect it will get the Trusted Root, prompt you to Trust it once, always, or never. Select Always, and exit.

The newly created lbecacert file now has just the one trusted root in it. Cute eh? I use this when I am lazy and it works fine.

Now where should the Tomcat cacerts be? Well it might be sufficient in your JVM install, lib/security to either add the trusted root to the cacerts there, or else replace that file with this one (which is not the best option, since you might want some of those default trusted roots).

geoffc
  • 2,165
  • 5
  • 25
  • 40
  • Hi there, thanks for the reply. Can you explain more on what do you meant by import the trusted root that way?? btw, I am using portecle-1.5 to generate the cert. And also i am unable to find the default key store for Tomcat too. Any other advice?? – Nivek Oct 12 '10 at 03:48
  • If you have the cert, 'keytool -importcert -keystore Path/to/store -storepass Password (Usually default or changeit) -alias Something -file FileWithPublicKey' should be enough to do it. If you can see the Cert via HTTP, in IE/Firefox, when you view the cert, look at the cert chain, and export the CA that signed it. Thats what you want to import. – geoffc Oct 12 '10 at 17:03