Hi, Chad. Thanks for the suggestions.
I actually did try your LDAPTLS_REQCERT=allow suggestion, but when the
existing ~/.ldaprc is in place (with the TLS_REQCERT=demand line), that
option seems to be ignored for some reason. I don't know why.
To illustrate:
$ cat ~/.ldaprc
TLS_CERT /home/ldap/certs/admin.crt$ LDAPTLS_REQCERT=allow ldapsearch -LLL -x -H
TLS_KEY /home/ldap/certs/admin.key
TLS_REQCERT demand
SASL_MECH external
ldaps://server.autozone.com -D "<SNIP>" -w <SNIP> -b dc=domain,dc=com
uid=user
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
$ mv ~/.ldaprc ~/.ldaprc-old
$ LDAPTLS_REQCERT=allow ldapsearch -LLL -x -H
ldaps://server.autozone.com -D "<SNIP>" -w <SNIP> -b dc=domain,dc=com
uid=user
dn: uid=user,ou=people,dc=domain,dc=com
uid: user
<SNIP>
It seems like the ~/.ldaprc file is overriding what I specify on the
command line, but as I mentioned before, I *have* to have that global
configuration there for all of the other LDAP server this account
interacts with.
Likewise, I did try messing with the LDAPRC variable. I actually
mentioned that in my original post:
I'd consider that a bug in ldapsearch - if I'm explicitly defining
* Creating a separate ~/.ldaprc-server file and exporting
LDAPRC=.ldaprc-server - in this case, both ~/.ldaprc AND
~/.ldaprc-server are sourced (found using strace), so again my
host-specific settings are ignored.
LDAPRC, I'd expect it to ready that file *instead* of ~/.ldaprc, but it
actually reads it *in addition* to ~/.ldaprc, which I discovered by
examining strace output. There may be some cases where this behavior is
desired, but in this case, it causes my global configuration to
(apparently) again take precedence, overriding the TLS_REQCERT=allow
setting.
Any other suggestions?
--
Jared
On 10/09/2013 01:26 PM, Chad Scott wrote:
> Set environment variables.
>
> export LDAPTLS_REQCERT=allow
>
> or
>
> LDAPTLS_REQCERT=allow ldapsearch ...
>
> If neither of those work, specify a specific LDAPRC with:
>
> export LDAPRC=somefile.conf
>
> or
>
> LDAPRC=somefile.conf ldapsearch ...
>
>
> On Wed, Oct 9, 2013 at 11:12 AM, Jared <list-389@legroom.net
> <mailto:list-389@legroom.net>> wrote:> HOST server.domain.com <http://server.domain.com>
>
> but I can. As I mentioned in my original post, adding this to ~/.ldaprc
> or /etc/openldap/ldap.conf makes ldapsearch work perfectly fine:
>
> PORT 636
> TLS_REQCERT allow
>
> The problem is with applying this configuration to the one host while
> still setting my default configuration for SASL certificate-based
> authentication to everything else. How do I do that?
>
> or, to ask the question differently, forget the fact that I'm dealing
> with an invalid cert. There's no need to to get hung up on that detail.
> I have one ldaprc configuration that I need to define for a host, and a
> default ldaprc configuration I need to define for all other hosts. How
> do I make them work together?
>
> --
> Jared
>
> On 10/09/2013 01:06 PM, Michael Ströder wrote:
> > Jared wrote:
> >> expired and self-signed.
> >
> > You cannot work around expired certs. But in case of self-signed
> certs you can
> > put them into trusted CA certs file.
> >
> > Ciao, Michael.
> >
>
>