ldapuserfolder用ldap over ssl不能和openldap建立连接
"yang yang" <[email protected]> Mon, 23 May 2005 12:51:52 +0800
| Newsgroups | gmane.comp.web.zope.chinese |
|---|---|
| Message-ID | <[email protected]> |
zope-chinese，您好！
问题描述: ldapuserfolder用ldap over
ssl不能和openldap建立连接.
环境:freebsd5.4 amd64,zope
2.7.6,python2.3.5,plone2.0.5,openldap-sasl-server2.2.26,
openssl 0.9.7g,py23-ldap2-2.0.7,ldapuserfolder2.5,gruf3.2
目的:用openldap
ssl代替zope内置用户认证。
操作步骤:openldap配置按照http://www.openldap.org/pub/ksoper/OpenLDAP_TLS_howto.html#4.1
,只做了4.1以我的英文水平理解,后面的做法需要在客户端也配置openssl,因此不采用.
rc.conf里面添加:
slapd_enable="YES"
slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0/
ldaps://0.0.0.0/"'
slapd_sockets="/var/run/openldap/ldapi"
同时用ldap://0.0.0.0/
ldaps://0.0.0.0/是测试目的.
slapd.conf:
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/corba.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/dyngroup.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/misc.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/openldap.schema
.....
TLSCACertificateFile /usr/local/etc/openldap/server.pem
TLSCertificateFile /usr/local/etc/openldap/server.pem
TLSCertificateKeyFile /usr/local/etc/openldap/server.pem
.....
启动ldap,sockstat
-l确认了ldap在389和636端口服务.
zmi:在plone site的gruf里add ldapuserfolder source,
ldap服务器选项ldap
389,连接成功.plone用户注册正常,用windows工作站上的ldapbrowser连接也正常.
问题出现:ldap服务器选项改ldap
over ssl
636.ldapuserfolder显示连不上.但用windows工作站上
ldapbrowser连接测试正常:连接时提示证书标识,确认后连接成功.
不知道哪里出了问题或者有什么变通方法?
ssl目的是不希望明码传输用户认证信息给ldap
server.
试过slapd.conf里add security ssf=1 update_ssf=112
simple_bind=64,
结果是注册不了用户,zmi提示需要加密.
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
_______________________________________________
zope-chinese list
[email protected]
http://zope.cn/mailman/listinfo/zope-chinese