Hello,

Sorry, I tried posting this yesterday but it didn't seem to make it on the list - trying again.

I currently have OpenLDAP (2.4.28) running on a Linux box with a local database and a meta backend which represents the local database along with a remote Active Directory server (2008 R2). Below is a snapshot of my slapd.conf.

#------------------------------------------------------------

include /etc/openldap/schema/core.schema

include /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/nis.schema

include /etc/openldap/schema/samba.schema

loglevel -1

modulepath /usr/lib/openldap/

allow bind_v2

database bdb

suffix "dc=local,dc=example,dc=com"

directory /var/lib/ldap

rootdn "cn=root,dc=local,dc=example,dc=com"

rootpw secret

database meta

suffix "dc=example,dc=com"

rootdn "cn=root,dc=example,dc=com"

rootpw secret

## Local

uri ldap://localhost/ou=Users,dc=local,dc=example,dc=com

idassert-bind bindmethod=simple binddn="cn=root,dc=local,dc=example,dc=com" credentials=secret

##Remote Active Directory

uri ldap://ad.example.com/cn=Users,dc=example,dc=com

idassert-bind bindmethod=simple

binddn="cn=sync,cn=users,dc=example,dc=com"

credentials=secret

# tls_cacert=/etc/openldap/cacerts/ad-ca.cer

# tls_cert=/etc/openldap/local.pem

# tls_key=/etc/openldap/local.key

#-----------------------------------------------------------

When I run the following command:

ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost

Everything works as expected with the above config , meaning I see the local and remote/proxied entries on AD with the root credentials specified above. Logs on AD indicate that a user sync preformed a search. As I understand, id-assertion is working??

Now if I change the remote entry to the following (enable ssl):

##Remote Active Directory

uri ldaps://ad.example.com/cn=Users,dc=example,dc=com

idassert-bind bindmethod=simple

binddn="cn=sync,cn=users,dc=example,dc=com"

credentials=secret

tls_cacert=/etc/openldap/cacerts/ad-ca.cer

tls_cert=/etc/openldap/local.pem

tls_key=/etc/openldap/local.key

The same command (ldapsearch -x -D "cn=root, dc=example,dc=com" -w secret -b " dc=example,dc=com " -H ldap://localhost) binds locally successfully but does not list any remote attributes from AD.

Verbose logging enabled on Active Directory indicates an anonymous bind and subsequent failure. This is what I'm trying to understand.

However, if I search using an account that resides on the AD server (-D " cn=sync,cn=users,dc=example,dc=com" -w secret) it works and the traffic is encrypted. The root account "seems" to be ignored when it comes to the assertion butonly when ssl is enabled.

Now, if I use TLS instead,

##Remote Active Directory

uri ldap://ad.example.com/cn=Users,dc=example,dc=com

tls start

idassert-bind bindmethod=simple

binddn="cn=sync,cn=users,dc=example,dc=com"

credentials=secret

tls_cacert=/etc/openldap/cacerts/ad-ca.cer

tls_cert=/etc/openldap/local.pem

tls_key=/etc/openldap/local.key

Everything works, and I see the remote entries in AD using the meta root credentials. I've verified the network traffic to ensure it was indeed encrypted. I've also verified that using ldapsearch directly (ex: -H ldaps://ad.exmaple.com) to AD and it also functions as intended. I did play around with slapd-ldap and it seemed behave the same as meta regarding ldaps. In my eyes, something in my configuration makes the proxy seemingly ignore ldaps entries. Hopefully I didn't miss anything painfully obvious in the docs :)

Thanks,