Authentication with LDAP via SSL

Hello List,

I'm trying to get apache 2.0.46 to authenticate against an iPlanet
Directory Server ver 4.16 using an SSL connection. I can get to work
without SSL but when I try to configure for SSL and restart the server,
I get the following in the error_log:

[Wed Jul 09 12:45:22 2003] [notice] LDAP: Built with OpenLDAP LDAP SDK
[Wed Jul 09 12:45:22 2003] [crit] LDAP: Invalid LDAPTrustedCAType
directive - BASE64_FILE type required
[Wed Jul 09 12:45:22 2003] [warn] LDAP: SSL initialization failed
[Wed Jul 09 12:45:22 2003] [notice] LDAP: SSL support unavailable
[Wed Jul 09 12:45:22 2003] [notice] Apache/2.0.46 (Unix) mod_ssl/2.0.46
OpenSSL/0.9.7a configured -- resuming normal operations

My certificate database is a copy of cert7.db and according to the docs
the directive to tell apache about my certificates is LDAPTrustedCAType
which can be either CERT7_DB_PATH, BASE64_FILE or DER_FILE. It seems
that for some reason apache isn't accepting CERT7_DB_PATH!

Any idea what I'm doing wrong?


I compiled with the netscape sdk.

This is how I built apache:

export LDFLAGS="-L/opt/local/ldapcsdk/lib/
 -R/opt/local/ldapcsdk/lib/:/usr/local/lib:/usr/lib"

export CPPFLAGS="-I/opt/local/ldapcsdk/lib/include
 -I/usr/kerberos/include"

./configure --prefix=/opt/apache/dev/2.0.46/default/servers \
               --enable-so \
               --enable-mods-shared="ldap auth-ldap" \
               --with-ldap \
               --with-auth-ldap \
               --with-ldap-lib=/opt/local/ldapcsdk/ \
               --with-ldap-include=/opt/local/ldapcsdk/ \
               --with-gdbm \
               --with-berkeley-db \
               --with-ssl \
               --enable-ssl  \
               --enable-auth-anon --enable-auth-dbm --enable-auth-digest \
               --enable-rewrite

Here are the related config directives from httpd.conf:

LDAPTrustedCA /opt/local/cert_db/cert7.db
LDAPTrustedCAType    CERT7_DB_PATH

LDAPSharedCacheSize 200000
LDAPCacheEntries 1024
LDAPCacheTTL 600
LDAPOpCacheEntries 1024
LDAPOpCacheTTL 600
<Location /ldap-status>
SetHandler ldap-status
Order deny,allow
Deny from all
Allow from dcri.duke.edu
AuthLDAPEnabled on
AuthLDAPURL ldaps://ldap.dcri.duke.edu/o=DCRI,c=US?uid?sub
AuthLDAPAuthoritative on
AuthLDAPBindDN dn="uid=admin,ou=administrators,o=DCRI,c=US"
AuthLDAPBindPassword "some_passwd"
require valid-user
AuthType Digest
AuthName "DCRI LDAP Login"
</Location>

Thanks,

Vic Engle
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers