I'm struggling to find a simple explanation on how to configure a CentOS 6.8 machine to use LDAPS to query Active Directory running on a Windows 2012 R2 Domain Controller.

I've joined the Linux client to the domain and I've configured the Domain Controller as a Certification Authority. From the DC I can use LDP and connect to localhost on port 636. So I believe the DC should support LDAPS at this point.

On the client I've generated a certificate using: openssl req -nodes -newkey rsa:2048 -keyout domain.key -out domain.csr

So it generated those two files. From what I understand I need to send a request from the client to the DC to enroll the client with the CA. I have no idea how to do this. I believe once I've accomplished this i should be able to use ldapsearch to query active directory from the client.

So effectively, how do I configure the client to talk to the DC using a trusted certificate?

  • Are you using SSSD? – ewwhite Jan 2 '17 at 3:17
  • No, I don't think I am. Unless I am indirectly without knowing it. When I joined the client to the domain I used authconfig-tui and simply specified winbind authentication and ads as the security model. I never needed to edit or modify an sssd.conf file. Although, I suppose it's possible that authconfig-tui modified that config file for me. – dutsnekcirf Jan 2 '17 at 16:15
  • I should also point out that I've recently read about Microsoft's Network Device Enrollment Service and thought maybe I needed to use that to enroll my cert with the CA. however, what confuses me about it is that it states that this service is intended for network devices that aren't joined to the domain. My client is in fact joined to the domain. I just need it to be able to query Active Directory over a secure connection using the LDAPS protocol on port 636 using the ldapsearch utility. – dutsnekcirf Jan 2 '17 at 16:23

So I've been able to figure out how to do this finally.

The first task to get this working was to get the Domain Controller configured as a Certification Authority. To do this I followed this video: https://www.youtube.com/watch?v=JFPa_uY8NhY

After I was able to connect to AD on port 636 I had to configure openldap on the CentOS machine to use that port. I figured if I could get ldapsearch to query AD on port 636 then the final step would be to get tac_plus to do the same. To configure openldap all I had to do was edit the /etc/openldap/ldap.conf file.

I modified three fields; BASE, URI, and added the line "TLS_REQCERT allow".

The BASE field was important to get correct. It must the be the proper format and point to where your user accounts are found in AD. Mine was: "CN=users, DC=ent, DC=local".

The URI field was also important to get correct. I used the fully qualified domain name for the server and port number. It ended up being: "ldaps://dc1-ent.ent.local:636".

The "TLS_REQCERT allow" line allows the CentOS machine to request a certificate from the Domain Controller as part of the process of establishing a session with the server. This is similar to how SSH implements it's key exchange algorithm when establishing an SSH session with a remote host.

Then I used the following ldapsearch command to verify it works:

ldapsearch -D "myusername@ent.local" -W -p 636 -h ldaps://dc1-ent.ent.local -b "CN=users, DC=ent, DC=local" -s Sub -x -ZZ "(objectclass=*)" -d1

The -d1 option in the command above allows verbose debug output so I could see the exchange of the server's public key to be used to encrypt the session.

All worked from there on out. I was able to use wireshark to capture the traffic and confirm that an encrypted TLS session was established at the time of authentication. I believe this method of authenticating with AD is known as PEAP. I have not bothered to get EAP-TLS or EAP-TTLS working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.