Re: SSL connection using libLDAP [RESOLVED]

[Alexander Hartner <alex@j2anywhere.com>]

Thanks Kurt,

I have it working now. Even though the example is in ObjectiveC, it  
might be helpful to other.

	if ([connectionDetail sslEnabled])
	{
		NSString * url = [NSString stringWithFormat:@"ldaps://%@:%@  
",hostname,[port stringValue]];
		NSLog(@"Using SSL URL : %@\n",url);
		ldap_initialize(&ldap,[url cString]);
	}
	else
	{
		NSString * url = [NSString stringWithFormat:@"ldap://%@:%@  
",hostname,[port stringValue]];
		NSLog(@"Using URL : %@\n",url);
		ldap_initialize(&ldap,[url cString]);
	}
	
	ldap_perror(ldap, "LDAP INITIALISED");
	
	const int ldap_version=LDAP_VERSION3;
	int e = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION,  
&ldap_version);
	ldap_perror(ldap, "LDAP VERSION 3 SET");

	if ([connectionDetail sslEnabled])
	{
		e = ldap_set_option(ldap, LDAP_OPT_X_TLS_CACERTFILE, "/etc/openldap/ 
cacert.pem");
		ldap_perror(ldap, "SETTING CACERTIFICATE FILE");
		ldap_start_tls_s(ldap, NULL, NULL);
		ldap_perror(ldap, "LDAP STARTING TLS");
	}
	
	e = ldap_simple_bind_s(ldap, [username cString], [password cString]);
	ldap_perror(ldap, "LDAP BOUND");
	char * errorMessage = ldap_err2string(e);

Tx
Alexander Hartner
alex@j2anywhere.com

Does a good farmer neglect a crop he has planted?
Does a good teacher overlook even the most humble student?
Does a good father allow a single child to starve?
Does a good programmer refuse to maintain his code?
  - The Tao of Programming


On 18 Mar 2006, at 15:39, Kurt D. Zeilenga wrote:

> At 01:00 AM 3/18/2006, you wrote:
> > Hi Kurt,
> >
> > I tried to look for the man pages, but can't find them anywhere.  
> > They don't seem to be included on OS X, Gentoo or the website.
> >
> > []
> >
> >
> > I had a look at the examples (clients/tools) and I modified my  
> > code. I hope I have the sequence right ? I call the following  
> > function as follows:
> >
> > 1.)ldap_init
> > 2.)ldap_set_options (Version 3,... ) I think I need to set the  
> > CACERTFILE here. But I don't know what option to set. I am also  
> > hoping for an option to accept self signed certificates without  
> > having to specify a CA.
> > 3.)ldap_start_tls_s
> > 4.)ldap_simple_bind_s
> >
> > It doesn't work yet, because I don't know what options to set. If  
> > you have the man pages could you please email them to me.
> > Thanks for your help
> >
> > Alexander Hartner
> > <mailto:alex@j2anywhere.com>alex@j2anywhere.com
> >
> > Does a good farmer neglect a crop he has planted?
> > Does a good teacher overlook even the most humble student?
> > Does a good father allow a single child to starve?
> > Does a good programmer refuse to maintain his code?
> >  - The Tao of Programming
> >
> >
> > On 18 Mar 2006, at 04:46, Kurt D. Zeilenga wrote:
> >
> > > OpenLDAP's -lldap supports initiating TLS (SSL) using either
> > > the standard "Start TLS" mechanism [RFC2830] or the non-standard
> > > "ldaps:" (Secure LDAP) mechanism.  In the former case, the
> > > program should call ldap_initialize(3) with the appropriate
> > > ldap: URL, set version to 3, and then call ldap_start_tls_s(3).
> > > In the latter case, ldap_initialize(3) is called with the
> > > ldaps: URL.  In both cases, appropriate certificate information
> > > should be provided via ldap.conf(5) facilities or via
> > > ldap_set_option(3)).  See the client/tools for example code.
> > >
> > > - Kurt
> > >
> > > At 03:56 PM 3/17/2006, Alexander Hartner wrote:
> > > > I am trying to connect to my LDAP directory using libLDAP. With SSL
> > > > disable the following code works, but since I switched SSL on it  
> > > > breaks.
> > > >
> > > >       ldap = ldap_init([hostname cString], [port intValue]);
> > > >       ldap_perror(ldap, "LDAP INITIALISED");
> > > >       const int version = 3;
> > > >       int e = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION,  
> > > > &version);
> > > >       ldap_perror(ldap, "LDAP VERSION 3 SET");
> > > >
> > > >       e = ldap_simple_bind_s(ldap, [username cString], [password  
> > > > cString]);
> > > >
> > > >       char * errorMessage = ldap_err2string(e);
> > > >       ldap_perror(ldap, "LDAP BOUND");
> > > >
> > > > The error reported is :
> > > >
> > > > LDAP BOUND: Can't contact LDAP server (-1)
> > > >
> > > > I figure this is a problem with ldap_simpel_bind_s, but i can't  
> > > > find
> > > > what I need to modify for SSL to work.
> > > >
> > > > Thanks
> > > >
> > > > Alexander Hartner
> > > > <mailto:alex@j2anywhere.com>alex@j2anywhere.com
> > > >
> > > > Does a good farmer neglect a crop he has planted?
> > > > Does a good teacher overlook even the most humble student?
> > > > Does a good father allow a single child to starve?
> > > > Does a good programmer refuse to maintain his code?
> > > > - The Tao of Programming
>
> This is a form letter.  Due to the volume of email I receive, I
> cannot personally respond to each message directed to my mailbox.
>
> If your message concerns the use of OpenLDAP Software, I suggest
> that you post your message to the most appropriate mailing list
> (which is not necessarily an OpenLDAP mailing list).
>         http://www.openldap.org/lists/
>
> If your message is a general LDAP question, I suggest you use
> the U-Mich LDAP mailing list <ldap@umich.edu>.
>
> I do often answer questions that are asked in public forums.  I
> do this for the benefit of the community.  As taking discussions
> off list only affords the enquirer the benefit of my response,
> I ask that you ask whatever follow-up questions you might have
> in the public forum.
>
> Regards, Kurt