2012/7/25 Chaudhari, Rohit K. <Rohit.Chaudhari(a)jhuapl.edu>
Hey,****
** **
So I did forget to set the TLS_REQCERT parameter. I now set it to
TLS_REQCERT allow. 1
If you put it to "allow" you should also configure TLS_CACERT. If you
haven't done it then try with "TLS_REQCERT never" first.
Also, I put the ldap URL as ldap:// instead of ldaps. Is there something
I have to do on the server side. I tried logging in with the user on
the
client side and still it fails. When I do:
No, you should absolutely test with "ldaps" (or with "ldap" but adding
the
switch "-ZZZZZ" ). That's the only test that will help you to find out if
you have configured SSL/TLS correctly on the client. The test with "ldap"
will always work since no SSL/TLS is involved.
@+
*From:* 389-devel-bounces(a)lists.fedoraproject.org [mailto:
389-devel-bounces(a)lists.fedoraproject.org] *On Behalf Of *Andrey
Ivanov
*Sent:* Wednesday, July 25, 2012 9:38 AM
*To:* 389 Directory server developer discussion.
*Subject:* Re: [389-devel] SSO to 389 Server from 389 Client****
** **
Hi,
don't forget either to
* add on the client workstation the CA certificate that signed the LDAP
server certifcate to /etc/openldap/ldap.conf (TLS_CACERT parameter)
* or to disable the certificate check: ("TLS_REQCERT never")
You can easily test fro the client whethe rit worked or not :
ldapsearch -x -H
ldaps://your.ldap.server.example.com -b "" -s base
if the result of this command is the follwoing error then you have not
configured the CA on the workstation correctly:
ldap_bind: Can't contact LDAP server (-1)
additional info: error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Otherwise you will have the DSE base attributes...
@+****
2012/7/25 Chaudhari, Rohit K. <Rohit.Chaudhari(a)jhuapl.edu>****
Hello everyone,
The setup is as follows. We have set up a server with 389 DS without DNS
(hardcoded IP addresses in /etc/hosts) and created a CA certificate for
distribution on servers and clients. The 389 client has been set up to
allow users created on the server to authenticate against LDAP when logging
in for the first time. However, this is failing.
The server has 389 and a CA certificate.
The client is given the CA certificate as certificate.asc. Then, we used
authconfig-tui to configure the client to use LDAP authentication against
the server using TLS/SSL.
In regards to a previous thread, one had brought up that there might be
issues using LDAP authentication with TLS if the server is set up without
DNS and has IP addresses hard-coded in /etc/hosts. Does anyone have any
suggestions as to why I am unable to log in against the server from my
client machine. The user created in LDAP is given POSIX attributes so that
if it's a user attempting to log in for the first time, it is able to do so
(since POSIX attributes includes Group ID, UID, etc.)
Thanks.
________________________________________
--
389-devel mailing list
389-devel(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-devel****
** **
--
389-devel mailing list
389-devel(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-devel