Hi all,

I would like to use the proxy features (and as soon as this works for me also some kind of rewriting / mapping) with openldap 2.4.25:

./configure --prefix=/scratch/openldap \ --with-tls=openssl \ --enable-meta \ --enable-ldap \ --enable-rewrite \ --enable-rwm \ --enable-bdb \ --enable-overlays \ --enable-perl \ --enable-shell

make install...

I may access one LDAP backend via ldap: but not the other (Active Directory) via ldaps:

What works fine is

1. ldapsearch for LDAP-Tree-1 / Server-1: =========================================

Direct access to LDAP server: ----------------------------- ldapsearch -x -H ldap://ldap-server-1 -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6

and using the proxy: -----------------------------

ldapsearch -x -H ldap://ldap-proxy -b 'ou=OU1,o=desy,c=de' '(mail=*)' | fgrep num # numResponses: 7 # numEntries: 6

(This tree is rather small.)

what is not working is

2. ldapsearch for Active-Directory / Server-2: ==============================================

Direct Access to AD-Server -----------------------------

ldapsearch -x -H ldaps://domain-controller \ -D CN=accountname,OU=...,OU=...,OU=...,DC=desy,DC=de \ -W \ -b 'ou=ou1,...,dc=desy,dc=de' \ '(samaccountname=testuser)' | fgrep num

Enter LDAP Password: # numResponses: 2 # numEntries: 1

Doing the same via the proxy fails: ----------------------------------- ldapsearch -x -H ldap://ldap-proxy -b 'ou=...,...,dc=desy,dc=de' # extended LDIF # # LDAPv3 # base <ou=...,...,dc=desy,dc=de> with scope subtree # filter: (objectclass=*) # requesting: ALL #

# search result search: 2 result: 48 Inappropriate authentication

# numResponses: 1

I would like to understand why this fails.

slapd.conf is like this ----------

include /scratch/openldap/etc/openldap/schema/core.schema include /scratch/openldap/etc/openldap/schema/cosine.schema include /scratch/openldap/etc/openldap/schema/inetorgperson.schema

idletimeout 120

pidfile /scratch/openldap/var/run/slapd.pid argsfile /scratch/openldap/var/run/slapd.args

# -- 1st LDAP-backend, the one which works, see 1. above database ldap uri ldap://ldap-server-1:portnumber/ suffix "ou=ouA,o=desy,c=de"

# -- 2nd LDAP-/Active-Driectory-backend, that one, which fails database ldap suffix "ou=OU1,...,dc=desy,dc=de" uri ldaps://domain-controller/ acl-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret idassert-bind bindmethod=simple binddn="CN=...,DC=desy,DC=de" credentials=TopSecret mode=none tls_cacertdir=/etc/pki/tls/certs tls_reqcert=never tls_crlcheck=none idle-timeout 1800 rebind-as-user yes

# -- just to make sure for now that I will see everything access to * by * read

# === END OF SLAPD.CONF ===

When I am strace'ing slapd with "-e trace=file -f" I cannot see that any file in tls_cacertdir is read. But I would have expected that.

Any directions what I should looking for, now?

Kind regards, Dirk

-- Dirk Jahnke-Zumbusch Deutsches Elektronen-Synchrotron DESY IT Information Fabrics Member of the Helmholtz Association D-22603 Hamburg Notkestrasse 85 / 22607 Hamburg T: +49-40-899.81760 F: +49-40-899.41760 dirk.jahnke-zumbusch@desy.de