| Author |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
 Posted: Fri 19 Oct '12 20:44 Post subject: Apache on Windows 7 - Windows LDAP and SSL |
 |
|
I have Apache 2.2.17 running on Windows 7. I'm using PHP to query a Windows 2008 LDAP server. Everything works ok until I try to use LDAPS. Many of the resources I can find refer to a ldap.conf file and the certificates being the main problem. I don't have an ldap.conf file anywhere, so I put all of the relevant lines in the httpd.conf.
One of the things I'm not sure on is the certificate I'm getting from the 2008 AD server. I haven't found any tutorial that covers it with an implementation in Apache on Windows. Many tutorials cover using LDAP to authenticate to the site, but I need to use it for queries. I used the procedure at http://social.technet.microsoft.com/wiki/contents/articles/2980.ldap-over-ssl-ldaps-certificate.aspx#CustomServerAuthCert to get the certificate installed and exported. But I don't know a way to confirm that it's using the cert I think it is for LDAPS. All LDAPS tests work (LDP.EXE from Windows).
Here is my test script:
| Code: |
$LDAPUserDomain = "@domain.com";
$LDAPUser = "user";
$LDAPUserPassword = "password";
$LDAPHost = "ldaps://ldap.domain.com";
$connect = ldap_connect($LDAPHost) or die("Could not connect to LDAP");
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
ldap_bind($connect,$LDAPUser.$LDAPUserDomain,$LDAPUserPassword) or die(ldap_error($connect) . ' (' . ldap_errno($connect) . ')');
|
Here is what I've added to my httpd.conf (Also tried adding LDAPTrustedGlobalCert with the CA cert):
| Code: |
LDAPTrustedClientCert CA_BASE64 "C:/Program Files (x86)/Apache Software Foundation/Apache2.2/conf/ssl/LDAPoverSSL.cer"
LDAPVerifyServerCert Off
|
When I run the test script, I get "Can't contact LDAP server (-1)". The ldap_connect works ok, but the ldap_bind does not. If I change the ldap host in the script to ldap instead of ldaps, it works. I've seen references to splitting the cert into a key file but I get errors when I try to run the commands. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Mon 22 Oct '12 13:13 Post subject: |
|
|
| I had already reviewed those and they don't address my specific question. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
| Posted: Mon 22 Oct '12 15:08 Post subject: Re: Apache on Windows 7 - Windows LDAP and SSL |
|
|
| MikeM-2468 wrote: | | I've seen references to splitting the cert into a key file but I get errors when I try to run the commands. |
Example?
by the way, you forget to specify the needed port in ldap_connect. You connect over the default port which is not SSL |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Mon 22 Oct '12 15:46 Post subject: |
|
|
I'm searching for the example.
I had tried specifying the port previously but that didn't change anything. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Mon 22 Oct '12 16:08 Post subject: |
|
|
| No luck finding the example. I guess we should forget I mentioned it. Sounds like it wasn't standard procedure anyway. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Mon 22 Oct '12 16:44 Post subject: |
|
|
If LDAPVerifyServerCert Off is set, shouldn't it just work whether the certificate is setup correctly or not?
I have this set in httpd.conf. Is that the correct place? |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
| Posted: Mon 22 Oct '12 17:04 Post subject: |
|
|
| Ya, paste it into the httpd.conf very end |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Mon 22 Oct '12 17:06 Post subject: |
|
|
| OK, so that's not the problem. Why else would it fail if LDAPVerifyServerCert Off is set? |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
| Posted: Mon 22 Oct '12 17:46 Post subject: |
|
|
| This is what I would do. Set the error_reporting in PHP to max. Run the relevant script part on the command line to see if apache if the issue or my code itself. Plus a heavy use of print_r() to see what is going on. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Mon 22 Oct '12 17:56 Post subject: |
|
|
The only error in the log is "PHP Warning: ldap_bind(): Unable to bind to server: Can't contact LDAP server"
The output from the bind command is "Can't contact LDAP server (-1)"
The ldap_connect command runs without error. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
| Posted: Tue 23 Oct '12 10:26 Post subject: |
|
|
| On the manual I found that it is a security feature from PHP... http://de3.php.net/ldap_bind search for SSL in the user comments. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Tue 23 Oct '12 13:16 Post subject: |
|
|
| That goes back to my original question about ldap.conf. I don't have one of those or know where to put it. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
| Posted: Tue 23 Oct '12 14:04 Post subject: |
|
|
| You have that file if you use OpenLDAP instead of M$ AD. I haven't figured out why what fails with PHP. But I think it is about the certificate. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
| Posted: Tue 23 Oct '12 23:16 Post subject: |
|
|
| MikeM-2468 wrote: |
It must be the openldap client that needs this, because I'm hitting an AD LDAP server.
|
The compiled in LDAP client in PHP or an external resource you use?
So you just created those folders in C: and the ldap.conf? |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Wed 24 Oct '12 14:08 Post subject: |
|
|
It must be the client compiled into PHP. There is no other client.
Yes, I just created the folder and file. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Wed 24 Oct '12 15:21 Post subject: |
|
|
But....
Using "TLS_REQCERT never" allows it to work, but it won't work for modify commands. Looks like I still have a certificate issue because I think the client needs to accept the cert, not ignore it for the modify commands to work. |
|
| Back to top |
|
MikeM-2468
Joined: 19 Oct 2012
Posts: 12
|
| Posted: Wed 24 Oct '12 18:13 Post subject: |
|
|
| I fixed the certificate issue, but still can't use the modify commands. I get "Server is unwilling to perform". I get similar error when using ldp.exe to run the same request. Maybe I have a syntax/formatting issue. I think Apache is ok. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7442
Location: EU, Germany, Next to Hamburg
|
|
| Back to top |
|
