asked on

openLDAP

I have AD example.com

openLDAP unix.example.com

Can I able to integrate openLDAP with AD to get user information from AD and authorize to application connected with unix openLDAP server?

ASKER CERTIFIED SOLUTION

Zephyr ICT

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

linuxperson

ASKER

thanks

for some application it requires SSL/TLS

i am getting the following error

slapd[21444]: daemon: TLS not supported (ldaps://x.x.x.x)

here is my slapd.conf

include /openldap/openldap-install/etc/openldap/schema/core.schema
include /openldap/openldap-install/etc/openldap/schema/collective.schema
include /openldap/openldap-install/etc/openldap/schema/corba.schema
include /openldap/openldap-install/etc/openldap/schema/cosine.schema
include /openldap/openldap-install/etc/openldap/schema/duaconf.schema
include /openldap/openldap-install/etc/openldap/schema/dyngroup.schema
include /openldap/openldap-install/etc/openldap/schema/inetorgperson.schema
include /openldap/openldap-install/etc/openldap/schema/java.schema
include /openldap/openldap-install/etc/openldap/schema/misc.schema
include /openldap/openldap-install/etc/openldap/schema/nis.schema
include /openldap/openldap-install/etc/openldap/schema/openldap.schema
include /openldap/openldap-install/etc/openldap/schema/pmi.schema
include /openldap/openldap-install/etc/openldap/schema/ppolicy.schema

pidfile /openldap/openldap-install/var/run/slapd.pid
argsfile /openldap/openldap-install/var/run/slapd.args

database bdb
suffix "dc=unix,dc=example,dc=com"
rootdn "cn=Manager,dc=unix,dc=example,dc=com"
rootpw secret
directory /openldap/openldap-install/var/openldap-data
index objectClass eq

TLSCACertificateFile /tls-certs/CA.crt
TLSCertificateFile /tls-certs/server.crt
TLSCertificateKeyFile /tls-certs/server.key
TLSCipherSuite HIGH:MEDIUM:+SSLv2

Zephyr ICT

What command did you use to start slapd?

Did you use something like:

 /usr/local/libexec/slapd -s 256 -h "ldaps:///"

Open in new window

linuxperson

ASKER

still same issue

Zephyr ICT

Hmmm, did you add "TLS_CACERT" to the ldap.conf file?

You should be able to test your certificates by doing following:

openssl s_client -connect localhost:636 -showcerts

Open in new window

linuxperson

ASKER

where is ldap.conf located?

I am using openldap and i did modify slapd.conf file only

Zephyr ICT

You might find it here: /usr/local/etc/openldap/ldap.conf

But it's more used for client authentication, you can ignore that one for now, barking up the wrong tree ...

What else ... Did that openssl test work?

Difficult to troubleshoot something like this, maybe this will help you pinpoint something.

linuxperson

ASKER

actually i did download the source code and installing

linuxperson

ASKER

env CPPFLAGS="-I/openldap/db4/include" LDFLAGS="-L/openldap/db4/lib" ./configure --with-tls=openssl --prefix=/openldap/openldap-install

when i tried to enable SSL during building the source code, i am getting

checking for openssl/ssl.h... no
configure: error: Could not locate TLS/SSL package

Zephyr ICT

Hi,

Sorry, was bedtime last night for me :)

Ok, so OpenLDAP has been installed? If yes maybe this command can help solve the SSL issue:

env CC=gcc CPPFLAGS="-I/dir/ssl/include" LDFLAGS="-L/dir/ssl/lib" ./configure --with-ssl=/dir/ssl -with-tls

Open in new window