Copy link to clipboard
Copied
I am trying to use cfldap with the secure="CFSSL_CLIENT_AUTH" on Coldfusion 2016. I specified the p12 file location using clientcert and the password using clientcertpassword. I also imported the sever's cert into the cacert keystore. When I run the page I always get "One or more of the required attributes may be missing or incorrect or you do not have permissions to execute this operation on the server." Anyone have experience with this?
Copy link to clipboard
Copied
Yes, see options discussed in another similar thread (last year), here:
What that person found was the "right answer" for them was to get the certificate for the LDAP server directly using openssl and import them.
But note that another suggestion (I offered) was to just get their JVM updated. That has helped many people with problems calling out of CF via https/ssl/tls. Again, see the post for more, to find which will work best for you.
Copy link to clipboard
Copied
Thanks for the response. I am seeing what what I think is shown here:
Copy link to clipboard
Copied
Fair enough. But there's no solution offered there, right? And neither of the folks reporting there indicate what JVM version they had. I just added a comment asking them about that.
So first, you should add a vote (if you had not) so that if they or others reply, you will be notified.
But until then, you might want to also indicate there or here what JVM version you are running, and whether you have tried the latest available version supported by your CF (which would be either Java 8 or 11, depending on what CF 2016 update you ahve done, and both of which have been updated in 2021). Again, see the link I offer for more, including more help if you may need it to see if this would be the solution for you.
Copy link to clipboard
Copied
I am using Coldfusion 2016 update 16 with Java 8 update 281 (this should be current for Java 8 as I am typing this now). As the post you linked indciated, I tried using the cert from the server obtained using OpenSSL, but that has not seemed to make a difference after importing that into the cacert keystore (I ensured I was adding it to the correct keystore for the version of Java I have installed). Thanks again @Charlie Arehart for your suggestions!
Copy link to clipboard
Copied
Make sure you retrieve not just the root certificate, but also any intermediate certificates on the LDAP server, and import them all into Java as a single "chain".
Dave Watts, Eidolon LLC
Copy link to clipboard
Copied
Thanks @Dave Watts . I did ensure the entire chain is imported into Java's cacert keystore. Unfortunately I am still having the error.
I just want to confirm that I am correct, when using the clientcert attribute, I am pointing to the actual path of the p12 file on the Coldfusion server and then providing the password with the clientcertpassword attribute correct?
Copy link to clipboard
Copied
That sounds right to me. I would recommend testing this in another LDAP client to ensure that it works. I've generally used JXplorer for this kind of thing in the past.
http://jxplorer.org/
Dave Watts, Eidolon LLC
Copy link to clipboard
Copied
Thank you @Dave Watts . I download JXplorer and loaded the chain into cacerts and pointed it to the client cert p12 file and provided the password. I was able to successfully connect to the LDAP server without any issues. Unfortunately I am still not able to get cfldap to work. It seems to immediately error with the error "One or more of the required attributes may be missing or incorrect or you do not have permissions to execute this operation on the server".
Copy link to clipboard
Copied
Are you able to read the LDAP server's logs? They might have more useful information.
Dave Watts, Eidolon LLC
Copy link to clipboard
Copied
And if somehow all still seems "right" about the certs, and yet things don't work, I have two thoughts:
Let us know if you've ruled these both out, assuming Dave suggestions don't get things solved.
Copy link to clipboard
Copied
@Dave Watts I can see the test connections on the LDAP server but nothing when attempting with Coldfusion. @Charlie Arehart thanks for those two points out. I did confirm from the Summary page that Coldfusion is using new jvm that is installed on the server, pointing to the correct path. I can also confirm that I have imported the certifcate into that Java version's cacert keystore in its lib/security folder, not /coldfusion2016/jre. I appreciate all the suggestions and thoughts.
Copy link to clipboard
Copied
You might be able to get more useful logging information from the LDAP server if you can log into it locally, when you try to connect.
Dave Watts, Eidolon LLC
Copy link to clipboard
Copied
Here are a couple more ideas. The first is simple, the second may not be as palatable:
Let us know how things go.
Copy link to clipboard
Copied
Also, it might be helpful to know:
Finally, in that tracker ticket link I shared in my first reply, note how the person reporting it showed using jvm args (like -Djavax.net.debug) to capture the handshake of the ssl communications (between CF and any ssl/tls call out to anything). Have you enabled that, to see if it shows anything useful when things fail? I realize that can be a bit of dumpster diving. Again, just trying yo give you ideas so you don't feel totally stuck.
Often in cases like this, it turns out that there is something rather unique about your setup which explains why it's happening to you--and yet doesn't happen so often that there are clear and obvious solutions.
Copy link to clipboard
Copied
Thanks for all the suggestions @Charlie Arehart . I'm going to dig into all of those and I'll report back. Thank you again!
Copy link to clipboard
Copied
Out of curiousity, did you have any luck with this?
I can't be much help with it, because I never found a solution. I know this would be a pain, because I did it back when I was trying to figure out this issue, but I'd recommend installing Coldfusion 11 Update 19 go through the exact same setup steps you did for CF 2016. Make sure you update the JVM and import the certs. Then copy your test page and P12 over to CF11 and see if it works. That won't fix your problem, but it would confirm that you have a working test page and that the issue started with CF 2016.
I set all three versions of CF (11, 2016,and 2018) up in a new test environment, so I was sure I was following the steps exactly the same for all three. It worked just fine in CF 11, but in both 2016 and 2018 I'd get the error. If you go that route, it wouldn't take much longer to also install CF 2021 to see if it happened to get fixed in there.
I eventually gave up and had to wait until we got a new information provider that we use username and password for.
Good luck, I hope you find a solution.
Copy link to clipboard
Copied
@George____ I have not been able to get it to work. @Charlie Arehart had a lot of great suggestions, I was able to try a few of them:
I did apply the latest hotfix (version 17) and am still getting the same error. I do appreciate everyone's thoughts and suggestions very much!
Copy link to clipboard
Copied
Slobs, given all your testing and details you have shared, I want to press on one more point. While you shared about a month ago that you had confirmed you had an updaetd jvm (1.8.0_281) and that you confirmed in the CF Admin that CF was using it (and that you had imported any certs into its lib/security/cacerts), I want to ask if you would do one more sanity check. The following code will confirm things FROM WITHIN code (the current JVM version and the location that would have the lib/security folder you would have wanted to manipulate, if needed). Are they really the values you expect them to be:
<cfdump var="#server.system.properties.java.version#">
<cfdump var="#server.system.properties.java.home#">
Again, it's just a sanity check before folks may go further into other explorations. Thanks.
Copy link to clipboard
Copied
@Charlie Arehart Thanks for your suggestion.
Indeed, the cfdump version outputs 1.8.0_281 and the home location cfdump outputs E:\ColdFusion2016\jre1.8.0_281.
Copy link to clipboard
Copied
Ah, ok. Wow. Strange tale, indeed. Hope someone may come along with more insight for you. I think I'm out of ideas, for now.
(FWIW, these last couple of replies prompted me to create a blog post about how to check the JVM version running in CF, via code. I posted a longer variant of the post on my own site, and a shorter post on the Adobe site.)