ldapuserfolder的sslé— ®é¢˜,重发

    问题描述: ldapuserfolder用ldap over 
ssl不能和openldap建立连接.
    环境:freebsd5.4 amd64,zope 
2.7.6,python2.3.5,plone2.0.5,openldap-sasl-server2.2.26,
openssl 0.9.7g,py23-ldap2-2.0.7,py23-openssl-0.6,ldapuserfolder2.5,gruf3.2
    目的:用openldap ssl代替zope内置用户认证。
	操作步骤:openldap配置按照

http://www.openldap.org/pub/ksoper/OpenLDAP_TLS_howto.html#4.1 
,只做了4.1以本人差劲的英文水平来理解,
后面的做法需要在客户端也配置openssl,因此不采用.
rc.conf里面添加:
slapd_enable="YES"
slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap://0.0.0.0/ 
ldaps://0.0.0.0/"'
slapd_sockets="/var/run/openldap/ldapi"
同时用ldap://0.0.0.0/ ldaps://0.0.0.0/是测试目的.
slapd.conf:
include		/usr/local/etc/openldap/schema/core.schema
include     /usr/local/etc/openldap/schema/corba.schema
include     /usr/local/etc/openldap/schema/cosine.schema
include     /usr/local/etc/openldap/schema/dyngroup.schema
include     /usr/local/etc/openldap/schema/inetorgperson.schema
include     /usr/local/etc/openldap/schema/misc.schema
include     /usr/local/etc/openldap/schema/nis.schema
include     /usr/local/etc/openldap/schema/openldap.schema
.....
TLSCACertificateFile	/usr/local/etc/openldap/server.pem
TLSCertificateFile	/usr/local/etc/openldap/server.pem
TLSCertificateKeyFile	/usr/local/etc/openldap/server.pem
.....
启动ldap,sockstat -l确认了ldap在389和636端口服务.
    zmi:在plone site的gruf里add ldapuserfolder source,
ldap服务器选项ldap 
389,连接成功.plone用户注册正常,用windows工作站上的ldapbrowser连接也正常.

问题出现:ldap服务器选项改ldap over ssl 
636.ldapuserfolder显示连不上.但用windows工作站上
ldapbrowser连接测试正常:连接时提示证书标识,确认后连接成功.
不知道哪里出了问题或者有什么变通方法?
ssl目的是不希望明码传输用户认证信息给ldap server.
试过slapd.conf里add security ssf=1 update_ssf=112 simple_bind=64,
结果是注册不了用户,zmi提示需要加密.

参考python-ldap.sourceforge.net的文档
http://www.blasum.net/holger/wri/comp/net/7appl/ldap/bochum2003/
Using LDAP from Java+Tomcat and Python+Zope：
7.3 TLS/SSL for python and zope
In a previous article with a similar point of view as ours [Ri01a] then 
non-availability
of LDAPv3 and this LDAP over TLS/SSL was still a problem for python 
programmers.
This has been solved, since Michael Stroder introduced LDAPv3 support into
in die python-ldap-2.0.0pre06 in summer 2002. As most zope applications for 
LDAP
(such as LDAPUserFolder, CMFUserFolder, LDAPDirectoryManager, LDAPAdapter,
ZopeLDAP) use python-ldap (ldaptor would be an alternative), the use of 
TLS/SSL is
possible, once the user updates the openldap and python-ldap library (see 
[Chou03])
and provides all the CA certificates needed for the connection.

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

_______________________________________________
zope-chinese list
[email protected]
http://zope.cn/mailman/listinfo/zope-chinese