TLS Hostname verification not working properly

Configuring the server
1

Hello, I am configuring an LDAP connection for user federation but our DNS servers aren’t resolving the domain controller hostname so I thought I would just use the IPs in the connection URL. I activated --tls-hostname-verifier=ANY and allowed for deprecated algorithms to be used but I am still getting this issue.

Error when authenticating to LDAP: Could not negotiate TLS: javax.naming.AuthenticationException: Could not negotiate TLS [Root exception is javax.net.ssl.SSLPeerUnverifiedException: hostname of the server ‘xx.xxx.xx.xxx’ does not match the hostname in the server’s certificate.]

Any suggestions ?

2

Not had that issue but the documentation indicates that secure LDAP requires hostname validation.

Configuring trusted certificates - Keycloak
“Please note that this setting does not apply to LDAP secure connections, which require strict hostname checking.”

maybe that’s why?

3

I thought that only applied to LDAPS and not LDAP + STARTTLS. I am using the latter.