Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (asf.osuosl.org: local policy)
Importance: normal
Priority: normal
Date: Fri, 20 Jan 2006 10:17:42 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-ID: <7209E76DACFED9469D4F5169F9880C7A1F65@mail01bldr.arraybp.com>
Content-Class: urn:content-classes:message
Thread-Topic: [users@httpd] ldaps authentication
thread-index: AcYd4m6LNW5Qu3x0RTKXVMg9RF53TwAAq7mA
From: "Sturgis, Grant" <Grant.Sturgis@arraybiopharma.com>
To: <users@httpd.apache.org>
Subject: RE: [users@httpd] ldaps authentication

> From: Ricardo Stella [mailto:stella@rider.edu]=20

> What do logs show ?

The error_log shows this:

[Fri Jan 20 10:08:47 2006] [warn] [client 10.10.233.101] [2056]
auth_ldap authenticate: user jgood authentication failed; URI
/servers/smtp0/smtp0.htm [LDAP: ldap_simple_bind_s() failed][Can't
contact LDAP server], referer: http://mrtg/mail_servers.htm


>=20
> Also, do you know if you are establishing a connection ?

Yes, it appears that apache is trying to set up an ldaps session, but
failing.  Perhaps something analogous to the 'tls_checkpeer no' in
ldap.conf?

>=20
> And, also, any permissions issue with the server reading the=20
> certificate ?

The cert file is owned by apache with a mode of 400.  All of the parent
directories are 755.

>=20
> Sturgis, Grant wrote:
> > No luck on this thread.  Let me ask a different question:
> >
> > Is anyone using ldaps authentication - or ldap for that matter? =20
> >
> > Anyone using ldaps to AD?
> >
> > Thanks,
> >
> > Grant
> > ---------------=20
> >
> >  =20
> >> -----Original Message-----
> >> From: Sturgis, Grant=20
> >> Sent: Wednesday, January 18, 2006 2:12 PM
> >> To: users@httpd.apache.org
> >> Subject: [users@httpd] ldaps authentication
> >>
> >> Greetings List,
> >>
> >> I have seen this question posted several times, but have not seen a
> >> resolution.  If it is in the archives, I apologize for not=20
> seeing it
> >> there.
> >>
> >> I have ldap authentication working using mod_auth_ldap,=20
> but I want to
> >> enable ldaps to avoid transmitting passwords in clear text. =20
> >> This is the
> >> configuration so far:
> >>
> >> <Directory "/home/httpd/ldap_test">
> >>    AuthType basic
> >>    AuthName "ldap test"
> >>    AuthLDAPUrl
> >> ldap://dc1.domain.com/dc=3Ddomain,dc=3Dcom?sAMAccountName?sub?(obj
> >> ectClass=3Du
> >> ser)
> >>    AuthLDAPBindDN cn=3Dnobody,ou=3DUsers-IT,dc=3Ddomain,dc=3Dcom
> >>    AuthLDAPBindPassword password
> >>    AuthLDAPGroupAttribute member
> >>    require group =
cn=3Dldap_test_group,ou=3DUsers-IT,dc=3Ddomain,dc=3Dcom
> >> </Directory>
> >>
> >> however, to enable ldaps, I add these lines (outside the=20
> >> <Directory>, of
> >> course):
> >>
> >> LDAPTrustedCA /etc/httpd/conf/cacerts/dc1.cer
> >> LDAPTrustedCAType BASE64_FILE
> >>
> >> and then change ldap to ldaps in the AuthLDAPUrl line
> >>
> >> and it stops working.
> >>
> >> I have used this cert successfully in pam_ldap and ldapsearch. =20
> >>
> >> Any suggestions for what I could be doing wrong? =20
> >>
> >> The details:
> >>
> >> RHEL ES 4
> >> httpd-2.0.52-22.ent
> >>
> >> Thanks for any suggestions,
> >>
> >> Grant
> >> -----------------
> >>
> >>
> >>
> >>
> >> Pardon this rubbish:
> >>
> >>

This electronic message transmission is a PRIVATE communication which =
contains
information which may be confidential or privileged. The information is =
intended=20
to be for the use of the individual or entity named above. If you are =
not the=20
intended recipient, please be aware that any disclosure, copying, =
distribution=20
or use of the contents of this information is prohibited. Please notify =
the
sender  of the delivery error by replying to this message, or notify us =
by
telephone (877-633-2436, ext. 0), and then delete it from your system.


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org