Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am working on a integrating LDAP authentication with my PHP Project deployed on a Linux platform. I successfully completed the ldapsearch from command line and from php code for NON SSL connection.

When it comes to SSL connection, I am not able to make it work. I am thinking if I can make the ldapsearch work from commandline, dealing with php side won't be a problem. I am using CentOS and below is my search result query pattern - which works for non-SSL request on port 3268 but fails for port 3269 with two errors ldap_start_tls: Can't contact LDAP server (-1) and ldap_bind: Can't contact LDAP server (-1). I have searched for this query and it lead me to pages which talk about Kerboros authentication, which I don't want. Any help would be greatly appreciated.

SSL

    [Test]$ ldapsearch -x -h ldap.internal.company.com -D "CN=personName,OU=EUS,
            DC=company,DC=com" -p 3269 -b "dc=company,dc=com" 
            samaccountname=personName -Z "/etc/openldap/cacerts/test.cer" 
             -w "<<MyPassword>>"
        ldap_start_tls: Can't contact LDAP server (-1)
        ldap_bind: Can't contact LDAP server (-1)

Non-SSL

       [Test]$ ldapsearch -x -h ldap.internal.company.com -D "CN=personName,
      OU=EUS, DC=company,DC=com" -p 3268 -b "dc=company,dc=com"            
       samaccountname=personName -Z "/etc/openldap/cacerts/test.cer" -w 
          .....
          ...
         //Gives valid output
share|improve this question
    
-Z is not followed by your trusted CA. In fact, the trusted CA(s) cannot be set as part of the command. Use either ldap.conf,.ldaprc or environmental variables –  84104 May 9 '13 at 22:56

1 Answer 1

up vote 1 down vote accepted

A few things you could try:

in ldap.conf add this:

TLS_REQCERT never

And in your ldapsearch string:

-H ldaps://ldap.internal.company.com:3269

Instead of:

-h ldap.internal.company.com -p 3269
share|improve this answer
    
Thanks Danila! I did have the ldap.conf setting right but the changing the ldapsearch string did the trick. –  prashantsunkari May 9 '13 at 22:08
    
I am glad it helped. –  Danila Ladner May 9 '13 at 22:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.