Hi All,<div><br></div><div>Finally, I am able to solve the issue.</div><div><br></div><div>I just replaced the IP address used in AuthLDAPUrl in httpd.conf of apache with the hostname that has been used during creating the certificate (CN) and that worked for me.</div>
<div><br></div><div>Thank you very much for all the support.</div><div><br></div><div>Regards</div><div>Asimananda</div><br><div class="gmail_quote">On Tue, Sep 22, 2009 at 10:49 AM, Asimananda Mohanty <span dir="ltr">&lt;<a href="mailto:asimananda.mohanty@gmail.com">asimananda.mohanty@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Hi,<div><br></div><div>I did run some openssl commands and here is what I saw.</div><div><br></div><div># openssl s_client -connect &lt;ldap server ip&gt;:636</div>
<div><br></div><div><div class="im"><div>verify error:num=20:unable to get local issuer certificate</div>
<div>verify return:1</div><div><br></div></div><div><div class="im"><div>verify error:num=21:unable to verify the first certificate</div><div>verify return:1</div><div><br></div></div><div><div>No client certificate CA names sent</div>
<div>---</div>
<div>SSL handshake has read 1162 bytes and written 450 bytes</div><div>---</div><div class="im"><div>Verify return code: 21 (unable to verify the first certificate)</div><div><div><br></div></div></div></div></div><div><br>
</div><div>The same thing I got when I ran the command on local ldap server too.</div>
<div><br></div><div>Are the certificates not OK? If this is so, how am I able to run ldapsearch with &quot;-ZZ&quot; option.</div><div><br></div><div>Regards</div><div>Asimananda</div><div><div></div><div class="h5"><br>
<div class="gmail_quote">On Tue, Sep 22, 2009 at 10:15 AM, Asimananda Mohanty <span dir="ltr">&lt;<a href="mailto:asimananda.mohanty@gmail.com" target="_blank">asimananda.mohanty@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<div><br></div><div>Regarding the apache issue, as I expected, fingers raised towards the certificate file even if I have clarified that the same certificate works fine with the local client (installed along with the server).</div>


<div><br></div><div>Is there any way so as to prove that certificate file is Ok?</div><div><br></div><div>Regards</div><div>Asimananda<div><div></div><div><br><br><div class="gmail_quote">On Mon, Sep 21, 2009 at 3:53 PM, Asimananda Mohanty <span dir="ltr">&lt;<a href="mailto:asimananda.mohanty@gmail.com" target="_blank">asimananda.mohanty@gmail.com</a>&gt;</span> wrote:<br>


<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I think I am supposed to provide the bind DN with &quot;-D&quot; option i.e. cn=admin,dc=ldap-company,dc=com.<div><br>


</div><div>With this value, it works fine.</div><div><br></div><div>Sorry for the mistake.</div><div><br>
</div><div>Reg Apache issue, I will post it here once it is solved.</div><div><br></div><div>Regards</div><div>Asimananda<div><div></div><div><br><br><div class="gmail_quote">On Mon, Sep 21, 2009 at 3:42 PM, Asimananda Mohanty <span dir="ltr">&lt;<a href="mailto:asimananda.mohanty@gmail.com" target="_blank">asimananda.mohanty@gmail.com</a>&gt;</span> wrote:<br>



<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Dieter,<div><br></div><div>I will try to look it from a different angle. Once I am able to solve it, I will post it here.</div>



<div><br></div><div>I have one more query.</div><div><br></div><div>On my server, I am able to get the result by :</div>
<div><br></div><div># <font color="#FF0000">ldapsearch -d8 -H ldaps://<a href="http://ldap-company.com" target="_blank">ldap-company.com</a> -b dc=ldap-company,dc=com uid=asimananda</font></div><div><div><div>
SASL/DIGEST-MD5 authentication started</div>
<div>Please enter your password:</div><div><br></div></div><div>&lt;Result&gt;</div><div><br></div><div>But the following query doesn&#39;t show any result and throws error.</div><div><br></div><div># <font color="#FF0000">ldapsearch -d8 -H ldaps://<a href="http://ldap-company.com" target="_blank">ldap-company.com</a> -D dc=ldap-company,dc=com uid=asimananda -W</font></div>




<div><div>Enter LDAP Password:</div><div>ldap_bind: Invalid credentials (49)</div><div>#</div><div><br></div><div>Does this mean that I have still some configuration to do?</div><div><br></div><div>Please comment.</div><div>




<br></div><div>Regards</div><div>Asimananda</div></div><div><div></div><div><br><div class="gmail_quote">On Mon, Sep 21, 2009 at 10:54 AM, Dieter Kluenter <span dir="ltr">&lt;<a href="mailto:dieter@dkluenter.de" target="_blank">dieter@dkluenter.de</a>&gt;</span> wrote:<br>




<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Asimananda Mohanty &lt;<a href="mailto:asimananda.mohanty@gmail.com" target="_blank">asimananda.mohanty@gmail.com</a>&gt; writes:<br>





<br>
&gt; Hi Dieter,<br>
&gt;<br>
</div><div>&gt; Thanks for the reply.<br>
&gt;<br>
&gt; My Apache is built with openldap lib only.<br>
&gt;<br>
&gt; I am able to connect to ubuntu host my my solaris client on ports 389 and 636.<br>
&gt;<br>
&gt; Then I guess, apache is not able to verify the certificates presented. In that case, please let me know how do I debug<br>
&gt; slapd to watch apache connection.<br>
<br>
</div>As I mentioned many times, this topip is neither OpenLDAP nor Ubuntu<br>
related, it is just a question of how to properly set up Apache on Sun<br>
Solaris 10.<br>
Did you configure mod_auth_ldap and mod_ldap to use TLS?<br>
There are two sources of information, Sun Bigadmin and Apache<br>
documentation. Lot of documentation is referring to *.der or cert7.db<br>
files, note that OpenLDAP only handles *.pem files. For mor<br>
information on this topic read openssl documentation.<br>
<br>
<a href="http://httpd.apache.org/docs/2.0/mod/mod_ldap.html" target="_blank">http://httpd.apache.org/docs/2.0/mod/mod_ldap.html</a><br>
<a href="http://www.sun.com/bigadmin/home/index.jsp" target="_blank">http://www.sun.com/bigadmin/home/index.jsp</a><br>
<div><div></div><div><br>
-Dieter<br>
<br>
--<br>
Dieter Klünter | Systemberatung<br>
<a href="http://dkluenter.de" target="_blank">http://dkluenter.de</a><br>
GPG Key ID:8EF7B6C6<br>
53°37&#39;09,95&quot;N<br>
10°08&#39;02,42&quot;E<br>
</div></div></blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br>