Topic: Is the Microsoft LDAP SDK the only option?

[mattross]

I am having a problem with secure LDAP authentication using the 2.4.4 Windows binaries downloaded from this site.

It authenticates successfully with insecure LDAP, but not secured LDAP. Browsing through this forum I see it is a common problem under Windows so I was wondering if other SDKs could be used instead of the Microsoft one to build it?

The AuthLDAPURL looks like this: ldap://ourserver:389/ou=ourcontext,o=ourtree?uid?sub?(objectClass=inetOrgPerson)

Changing ldap to ldaps as well as the port results in the following Apache error:

AH01695: auth_ldap authenticate: user myusername authentication failed; URI /Software [LDAP: ldap_simple_bind() failed][Unavailable]

[admin]

Assume you have certificates in place and followed http://httpd.apache.org/docs/2.2/mod/mod_ldap.html#usingssltls ?

Is your issues the same as at www.apachelounge.com/viewtopic.php?t=5200 ?

There is opened a Bugzilla ticket https://issues.apache.org/bugzilla/show_bug.cgi?id=54626 , maybe you can add a comment to this ticket.

See also on the dev list http://mail-archives.apache.org/mod_mbox/httpd-dev/201303.mbox/%3c1362477582472-5004121.post@n6.nabble.com%3e

[mattross]

I have our Terena CA chain certificates added via the MMC snap-in under 'Trusted Root Certification Authorities' and the server's certificate in the 'Personal' store as documented here: http://support.microsoft.com/kb/321051

I do not get the 'CA certificates cannot be set using this method, as they are stored in the registry instead' message in the error log with debugging enabled. Just in case I tried the patched mod_ldap.so from that post and it does not affect the error I receive. I still suspect it's closely related to that problem though as I did previously get that message when I was using Apache 2.2.

I have 'LDAPVerifyServerCert Off' and 'LDAPTrustedMode SSL' in the top-level httpd.conf. The rest is in a .htaccess file:

[covener]

tried this trace facility?

http://msdn.microsoft.com/en-us/library/aa366152%28VS.85%29.aspx

[covener]

and of course, error log with LogLevel debug or TRACE8

[mattross]

Thanks for the trace utility tip, I've managed to get a mass of further debug output. It looks like it comes down to this after it has successfully connected to the LDAP server:

LdapConnect failed to open connection 0xf10858, error = 0x80090325

A quick web search (http://social.msdn.microsoft.com/Forums/en-US/vcgeneral/thread/7e8466b0-136d-4a04-a8a6-0389fd4ce8e1) implies it may not be finding the certificates I previously imported. I've checked and all of the required certificate chain is present in 'Trusted Root Certification Authorities'. That is the right place for them isn't it?

[James Blond]

AFAIK you have to set the path LDAPTrustedGlobalCert --> http://httpd.apache.org/docs/2.4/mod/mod_ldap.html#usingssltls and http://httpd.apache.org/docs/2.4/mod/mod_ldap.html#ldaptrustedglobalcert

[mattross]

If I comment out 'LDAPVerifyServerCert Off' and add 'LDAPTrustedGlobalCert CA_BASE64 /path/to/our/CA/cert/chain' I still get the same error, and the 'CA certificates cannot be set using this method, as they are stored in the registry instead' is back.

I tried with the patch mod_ldap.so as well and it makes no difference.

[James Blond]

I thought about keeping LDAPVerifyServerCert Off while adding LDAPTrustedGlobalCert

[James Blond]

Since the topic says: "Is the Microsoft LDAP SDK the only option?"

OpenLDAP SDK,Novell LDAP SDK and Mozilla LDAP SDK should be possible, too

[mattross]

I've been trying various versions of LDAPVerifyServerCert and LDAPTrustedGlobalCert settings and cannot make any progress. When the global cert is set I always get 'CA certificates cannot be set using this method, as they are stored in the registry instead'.

Using the certificates MMC snap-in I've tried adding the certificates again, including via the physical store which allows 'Registry' certificate additions. None of it makes a difference to the traced log output error = 0x80090325 when establishing a secure connection to the LDAP server.

I am interested in trying a different LDAP SDK to bypass this particular issue. Many years ago I had some experience using the Netscape and Novell SDKs. As I have Visual Studio 2010 how difficult is it to build from source? I had a quick go last week but the projects would not open in Visual Studio without errors.

[mattross]

I decided to start again and deleted all the configuration and certificates. This time it works. Not sure what was wrong in my configuration, but I now have ldaps working as I had hoped.

Thanks for your help.

[lakshmi]

Hi mattross,

In your comment, you said that, "I decided to start again and deleted all the configuration and certificates. This time it works."

Could you please elaborate me what configurations have you deleted? and now what is your configuration?

Please let me, since i want to configure my Apache to work with LDAPS.

Thanks,
Lakshmi