CODEWITHSUNDEEP
tomcatldapssl
Jim Blake
Jim Blake

Reputation:

LDAP error in Tomcat - TLS confidentiality required

I'm trying to configure a Realm in Tomcat to access an LDAP server with TLS security. My basic Realm configuration looks like this:

    <Realm className="org.apache.catalina.realm.JNDIRealm" 
        debug="99"
        connectionURL="ldap://localhost:389/"
        userPattern="uid={0},ou=People,dc=nsdl,dc=org" />

I get an error like this:

SEVERE: Catalina.start: 
LifecycleException:  Exception opening directory server connection:  
    javax.naming.AuthenticationNotSupportedException: [LDAP: error code 13 - TLS confidentiality required]
    at org.apache.catalina.realm.JNDIRealm.start(JNDIRealm.java:1697)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1006)
    at org.apache.catalina.core.StandardHost.start(StandardHost.java:736)
    at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1014)
    at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
    at org.apache.catalina.core.StandardService.start(StandardService.java:448)
    at org.apache.catalina.core.StandardServer.start(StandardServer.java:700)
    at org.apache.catalina.startup.Catalina.start(Catalina.java:552)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:295)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:433)

I have tried a wide variety of fixes, without changing the problem or the error message. This includes:

Each of these produces the same error message (although the stack trace is different in some configurations).

Any ideas?

Upvotes: 0

Views: 3751

Answers (1)

Jim Blake
Jim Blake

Reputation:

The answer is actually not related to the question as posted here. The problem was related to how the Realm was specified.

The Realm was specified in a Context element contained in a file located inside the webapp at META-INF/context.xml

What I didn't realize was that

  • Tomcat copies this file to conf/Catalina/localhost/{webapp}.xml,
  • If a newer version of the WAR file is given to Tomcat, it will not replace {webapp}.xml with the newer version

So the reason that the same error message happened every time was because my initial copy of the Realm was bad, and my attempted fixes were not being considered.

In fact, the Realm specification is correct as shown above. Once I cleared out the stubborn file, it worked fine.

Upvotes: 1

Related Questions