Skip to Main Content

Security Software

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

LDAP connection over SSL fails

2833851Oct 12 2017 — edited Oct 15 2017

Hello,

We are facing an issue trying to connect to OID 11.1.1.9 via LDAPS using jndi.jar, with the following error.

Code-

    private static void connectToOID (){

        try {

            Hashtable env = new Hashtable();

            env.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);

            env.put(Context.PROVIDER_URL, ldaps://oid.xxx.com:3131);

            env.put(Context.SECURITY_PROTOCOL, "ssl");

            env.put(Context.SECURITY_AUTHENTICATION, "simple");

            env.put(Context.SECURITY_PRINCIPAL, "cn=orcladmin");

            env.put(Context.SECURITY_CREDENTIALS, "Password");

            context = new InitialDirContext(env);

        }

        catch (Exception ex){System.out.println(ex);}

    }

Run-

/opt/jdk1.7.0_80/bin/java -cp .:jndi.jar GetUserFromOID

Error is-

javax.naming.CommunicationException: simple bind failed: oid.xxx.com:3131 [Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure]

The OID certificate is placed in /opt/jdk1.7.0_80/jre/lib/security/cacerts.

Are we missing anything?

If the code is changed to use LDAP and not LDAPS, then it works.

The below code works,

    private static void connectToOID (){

        try {

            Hashtable env = new Hashtable();

            env.put(Context.INITIAL_CONTEXT_FACTORY, contextFactory);

            env.put(Context.PROVIDER_URL, ldap://oid.xxx.com:3060);

            env.put(Context.SECURITY_AUTHENTICATION, "simple");

            env.put(Context.SECURITY_PRINCIPAL, "cn=orcladmin");

            env.put(Context.SECURITY_CREDENTIALS, "Password");

            context = new InitialDirContext(env);

        }

        catch (Exception ex){System.out.println(ex);}

    }

Run-

/opt/jdk1.7.0_80/bin/java -cp .:jndi.jar GetUserFromOID

Any insights will be helpful.

We tried arguments like  -Djavax.net.ssl.keyStore="/opt/jdk1.7.0_80/jre/lib/security/cacerts" -Djavax.net.ssl.keyStorePassword=changeit

-Djavax.net.ssl.trustStore="/opt/jdk1.7.0_80/jre/lib/security/cacerts" -Djavax.net.ssl.trustStorePassword=changeit

etc, but it did not help.

Thank you,

Comments
Locked Post
New comments cannot be posted to this locked post.
Post Details