Hello,
Sorry, I tried posting this yesterday but it didn't seem to make it on the list - trying again.
I currently have OpenLDAP (2.4.28) running on a Linux box with a local database and a meta backend which represents the local database along with a remote Active Directory server (2008 R2). Below is a snapshot of my slapd.conf.
#------------------------------------------------------------
include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema
loglevel -1
modulepath /usr/lib/openldap/
allow bind_v2 database bdb suffix "dc=local,dc=example,dc=com" directory /var/lib/ldap rootdn "cn=root,dc=local,dc=example,dc=com" rootpw secret
database meta suffix "dc=example,dc=com" rootdn "cn=root,dc=example,dc=com" rootpw secret
## Local uri ldap://localhost/ou=Users,dc=local,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=root,dc=local,dc=example,dc=com" credentials=secret
##Remote Active Directory uri ldap://ad.example.com/cn=Users,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret # tls_cacert=/etc/openldap/cacerts/ad-ca.cer # tls_cert=/etc/openldap/local.pem # tls_key=/etc/openldap/local.key
#-----------------------------------------------------------
When I run the following command:
ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost
Everything works as expected with the above config , meaning I see the local and remote/proxied entries on AD with the root credentials specified above. Logs on AD indicate that a user sync preformed a search. As I understand, id-assertion is working??
Now if I change the remote entry to the following (enable ssl):
##Remote Active Directory uri ldaps://ad.example.com/cn=Users,dc=example,dc=com idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret tls_cacert=/etc/openldap/cacerts/ad-ca.cer tls_cert=/etc/openldap/local.pem tls_key=/etc/openldap/local.key
The same command (ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost) binds locally successfully but does not list any remote attributes from AD.
Verbose logging enabled on Active Directory indicates an anonymous bind and subsequent failure. This is what I'm trying to understand.
However, if I search using an account that resides on the AD server (-D " cn=sync,cn=users,dc=example,dc=com" -w secret) it works and the traffic is encrypted. The root account "seems" to be ignored when it comes to the assertion butonly when ssl is enabled.
Now, if I use TLS instead,
##Remote Active Directory uri ldap://ad.example.com/cn=Users,dc=example,dc=com tls start
idassert-bind bindmethod=simple binddn="cn=sync,cn=users,dc=example,dc=com" credentials=secret tls_cacert=/etc/openldap/cacerts/ad-ca.cer tls_cert=/etc/openldap/local.pem tls_key=/etc/openldap/local.key
Everything works, and I see the remote entries in AD using the meta root credentials. I've verified the network traffic to ensure it was indeed encrypted. I've also verified that using ldapsearch directly (ex: -H ldaps://ad.exmaple.com) to AD and it also functions as intended. I did play around with slapd-ldap and it seemed behave the same as meta regarding ldaps. In my eyes, something in my configuration makes the proxy seemingly ignore ldaps entries. Hopefully I didn't miss anything painfully obvious in the docs :)
Thanks,