Jira and LDAPs Multi Domain

[Florian_Schmutz]

Hi

In case of the upcomming Microsoft Patch which is disabling the LDAP and enabling LDAPs by default we need to change our User LDAP Connection of our jira.

We have now the Problem that one of the Domains is working with ldaps and the other not.

Here ist the Error MSG:

***************************************************************************************
Verbindungstest fehlgeschlagen. Antwort vom Server:
DC1.DOMAIN2.local:636; nested exception is javax.naming.CommunicationException: DC1.DOMAIN2.locall:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
***************************************************************************************

We have added the Cert of the DC1.DOMAIN2.local the same way as for the DC1.DOMAIN1.local

***************************************************************************************
keytool -importcert -keystore "C:\Program Files\Atlassian\Confluence\jre\lib\security\cacerts" -file DC1.DOMAIN2.local.cer
***************************************************************************************

In Case of the upper Error we added additionaly the Root CA of the Domain B to the cerststore

***************************************************************************************
keytool -import -trustcacerts -alias DC1.DOMAIN2.local -file root-ca.cer -keystore "C:\Program Files\Atlassian\Confluence\jre\lib\security\cacerts"
***************************************************************************************

More Informations:

Jira and confluence is installed on a windows 2k12r2 Server in the Domain1
On the Jira are 2 LDAP Query Configured Pointing to DC1.DOMAIN1.local and DC1.DOMAIN2.local over Port 636
The SSL checkbox is on.

The Query is working over LDAP. So the whole  AD query User and the LDAP Path  is working.

In Domain1 and Domain2 are AD Integrated CAs installed and the DC's has taken a cert of them.

The Jira and the Domain Controllers were booted multiples times.
The LDP.exe is connecting to DC1.DOMAIN1.local and DC1.DOMAIN2.local sucessfully.

So a little Update of this Problem.

I tryed to troubleshoot this issue with this:
https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-error-779355358.html

So first the Issue

With this Domain it is not working.

With this it is working

On the Jira Server with the SSLPoke Java tool the Problem is inverted.

So in Jira the gro domain isent working but the AIL
In the SSLPOke the gro domain is working but the AIL not.

And Finaly with the used Keestore from Jira i guess.

Could there be any know issue with jira or better Java that only one LDAPS connection could be formed in one Java Session?

Kind Regards

Florian

[Florian_Schmutz]

Im still strugeling with this issue.
In case of the upcomming microsoft upgrade i need to fix this ;(

[Florian_Schmutz]

Could that be the reason?

https://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLSession.html

[Florian_Schmutz]

Anyone some Ideas?