Aaron Richton wrote:

On Fri, 2 Aug 2013, pramod kulkarni wrote:

...

Hi,I need information on how to configure OpenLDAP server in the slapd.conf to look for certificates from windows certificate store? Currently i am using certificates from file in a path.

Waiting for your inputs.

In libraries/libldap you'll find

tls_g.c tls_m.c tls_o.c

which are for GnuTLS, MozNSS, and OpenSSL respectively. I'd imagine that the Right Thing would be to make a new file here, that utilizes the Windows crypto APIs (therefore accessing the Windows certificate stores).

You're talking about implementing a wrapper around Windows' schannel DLL which in turn uses CAPI key stores.

Another also rather hypothetical approach: I vaguely remember that someone wrote a PKCS#11 provider for accessing CAPI keystore which could be used in libnss and therefore in OpenLDAP (tls_m.c). It would be a lot of work to get that going - something for adventurers with lots of spare time. ;-}

Ciao, Michael.

Hi,

On Mon, 5 Aug 2013, pramod kulkarni wrote:

Thanks for the reply,

How to replace the file based access in OpenLDAP with windows certificate store access. we have the functionality to access the windows certificate store but how to integrate with OpenLDAP ?

lets try it in other words. There is no such functionality currently in openldap currently.

If you want it you need to develop it.

Greetings Christian

Regards, Pramod

On Fri, Aug 2, 2013 at 10:57 PM, Michael Ströder michael@stroeder.comwrote:

...

Aaron Richton wrote:

...

On Fri, 2 Aug 2013, pramod kulkarni wrote:

...

Hi,I need information on how to configure OpenLDAP server in the

slapd.conf

...

...

to look for certificates from windows certificate store? Currently i am using certificates from file in a path.

Waiting for your inputs.

In libraries/libldap you'll find

tls_g.c tls_m.c tls_o.c

which are for GnuTLS, MozNSS, and OpenSSL respectively. I'd imagine that

the

...

Right Thing would be to make a new file here, that utilizes the Windows

crypto

...

APIs (therefore accessing the Windows certificate stores).

You're talking about implementing a wrapper around Windows' schannel DLL which in turn uses CAPI key stores.

Another also rather hypothetical approach: I vaguely remember that someone wrote a PKCS#11 provider for accessing CAPI keystore which could be used in libnss and therefore in OpenLDAP (tls_m.c). It would be a lot of work to get that going - something for adventurers with lots of spare time. ;-}

Ciao, Michael.