LDAPS configuration help with ELM 7.0.2 for DOORS NEXT

John Servo

Oct 05 '23, 1:11 a.m.

Hello, i've been really struggling with trying to get ldaps to authenticate so we can use AD SSO with our rm server running on windows 2019 on liberty

Currently I imported the client certificate using ikeyman tool. When I view the p12 file using the ikeyman app, under personal certificates, I can see my host cert that was signed by the CA, and when i go to the signer certificates section I can see the intermediate CA and Root CA certificates as well.

Next I changed the server.xml to the following:

<ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore" sslProtocol="TLSv1.2" trustDefaultCerts="true"

enabledCiphers="TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA256"/>

And I enabled the ldapuserregistry which looks like this:

<feature>ldapRegistry-3.0</feature>

</featureManager>

<!-- Sample LDAP user registry configuration

-->

</idsFilters>

</ldapRegistry>

But i am getting an error like so when trying to log into the jazz admin portal:

[ERROR ] com.ibm.wsspi.security.wim.exception.WIMSystemException: CWIML4520E: The LDAP operation could not be completed. The LDAP naming exception javax.naming.NamingException: LDAP response read timed out, timeout used:60000ms. occurred during processing.

com.ibm.wsspi.security.wim.exception.WIMException: com.ibm.wsspi.security.wim.exception.WIMSystemException: CWIML4520E: The LDAP operation could not be completed. The LDAP naming exception javax.naming.NamingException: LDAP response read timed out, timeout used:60000ms. occurred during processing.

at com.ibm.ws.security.wim.ProfileManager.loginImpl(ProfileManager.java:1823)

at [internal classes]

at com.ibm.team.repository.server.servletbridge.LoginFilter.doFilter(LoginFilter.java:69)

at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:201)

at [internal classes]

Caused by: com.ibm.wsspi.security.wim.exception.WIMSystemException: CWIML4520E: The LDAP operation could not be completed. The LDAP naming exception javax.naming.NamingException: LDAP response read timed out, timeout used:60000ms. occurred during processing.

at com.ibm.ws.security.wim.adapter.ldap.context.ContextManager.getDirContext(ContextManager.java:750)

... 4 more

Caused by: javax.naming.NamingException: LDAP response read timed out, timeout used:60000ms.

at com.sun.jndi.ldap.Connection.readReply(Connection.java:491)

at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:377)

at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:226)

at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2803)

at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:331)

at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxFromUrl(LdapCtxFactory.java:237)

at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:201)

at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:255)

at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:166)

at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:96)

at org.apache.aries.jndi.ContextHelper.getInitialContextUsingBuilder(ContextHelper.java:199)

... 4 more

[AUDIT ] CWWKS1100A: Authentication did not succeed for user ID username.omitted An invalid user ID or password was specified.

NOTES

I am running windows 2019 and jre20 with wsl as well for testing ldapsearch.

Once thing when i use ldapsearch to auth to the ldaps server on another linux machine I am able to do it fine, but when I try to run the same ldapsearch query in my elm server using WSL I get:

Enter LDAP Password:

ldap_sasl_bind

ldap_send_initial_request

ldap_new_connection 1 1 0

ldap_int_open_connection

ldap_connect_to_host: TCP ldaps.company.co.us:636

ldap_new_socket: 3

ldap_prepare_socket: 3

ldap_connect_to_host: Trying [ip address]:636

ldap_pvt_connect: fd: 3 tm: -1 async: 0

attempting to connect:

connect success

TLS: peer cert untrusted or revoked (0x42)

TLS: can't connect: (unknown error code).

ldap_err2string

ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

However if i disable TLS/SSL cert check from ldap.conf, via "TLS_REQCERT never" it will be successful in authenticating with my username and password

Is there a way to disable certificate checking in ELM as well to see if i can log in?? Or am i doing something else wrong?

I'd be really grateful for some assistance getting this working. thanks!

0 votes

4 answers

3,014 views

0 votes

4 answers

Permanent link

Ralph Schoon

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER (64.6k●3●36●49) Oct 05 '23, 3:17 a.m.

This is a forum and not a support channel. You might want to open a case with support.

Please try to check the LDAP parameters using http://www.ibm.com/support/docview.wss?uid=swg21445366 .

There is not enough information in the question, but in my experience, you need to get the LDAP connection right and you can not disable features such as TLS.

0 votes

Permanent link

John Servo

(11●1) edited

Oct 05 '23, 3:36 a.m.

Hi thanks for the response.

I previously tried to talk to support and they could not answer my question so they redirected me here........

Also, i tried verifying parameters with apache directory and all seemed okay so far. In the admin panel in jazz teamserver (getting in with basicuserregistry) i am able to import users from AD which is odd because when i enable ldapregistry it fails as shown above

What information am i missing here?

Thanks

0 votes

Comments

Ralph Schoon

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER Oct 05 '23, 3:50 a.m.

I am sorry, but it is absolutely impossible to follow your question. The data displayed does not make sense. It is unclear what you do and where you try to login.

LDAP response read timed out, timeout used:60000ms.

means that you do not get anything back from LDAP. This does not translate to TLS errors. I do not know where JRE 20 comes into the image, but the Jazz products do not support that version of Java.

You can ask here, but this is a forum and there is no way to interchange log files etc, which would be the minimum requirement here.

John Servo

Oct 05 '23, 4:38 a.m.

Hi thanks for your answer,
What is the current supported version of Java for RMS DOORS NEXT 7.0.2? I'm having trouble finding that info.

Permanent link

Ralph Schoon

FORUM ADMINISTRATOR / FORUM MODERATOR / JAZZ DEVELOPER (64.6k●3●36●49) Oct 05 '23, 6:31 a.m.

All Jazz products ship with their own IBM Java. The system requirements can be found on the download page for the version on the "Getting S

started" tab. The latest is: https://jazz.net/wiki/bin/view/Deployment/ELMSystemRequirements702

0 votes

Permanent link

Davyd Norris

(3.5k●2●20) Oct 05 '23, 10:40 p.m.

I think your problem lies in the fact that your LDAP server certificate is untrusted.

TLS: peer cert untrusted or revoked (0x42)

and the fact you can get LDAPS working with an alternate system when you explicitly tell it to ignore the cert check (a bad idea in production systems)

Based on this, it looks like your LDAP server has been set up with a self signed or internally signed SSL certificate. If this is the case then you will need to add the root certificate authority to the trusted CA list in your ELM server. See this:

https://www.ibm.com/docs/en/was-liberty/core?topic=liberty-adding-trusted-certificates-in

0 votes

Comments

John Servo

Oct 09 '23, 4:25 a.m.

hi thanks for your answer.

I was able to authenticate with ldapsearch using the rootca.pem file i got from my ldaps server.

So now I added the same rootca.pem from the ldaps server using the ikeyman tool (im on windows) to the signers certificate section of the keystore that i referenced in server.xml :

<keyStore id="defaultKeyStore" location="certificate.p12" type="PKCS12" password= ... />

however this keystore also contains the certs from my internal CA that were issued for SSL. Should i create another keystore for the root CA of the ldaps server im trying to connect to? But then where do i reference that in the configs?

Am i doing the right thing here? Thanks!

Davyd Norris

Oct 09 '23, 5:53 p.m.

You must add the root CA for the LDAPS server to the server's trust store, which will have the SSL certificate for the server as well as all the trusted CAs in it.

Make a backup copy of the existing store first so you can go back if you need to, but follow the directions in the link above and it should work.

I have found that sometimes I also need to add the same CA to the trusted CAs list of the JRE or JDK itself - normally found in <jre>/lib/security/cacerts

Your answer

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here.

By RSS:

Answers

Answers and Comments

Question details

configuration

× 6,159

ldap

× 88

Question asked: Oct 05 '23, 1:02 a.m.

Question was seen: 3,014 times

Last updated: Oct 09 '23, 5:53 p.m.

LDAPS configuration help with ELM 7.0.2 for DOORS NEXT

4 answers

3,014 views

0 votes

4 answers

Comments

Comments

Your answer

Follow this question

Question details

Related questions