ldap_set_option()不设置选项“LDAP_OPT_SSL”
问题描述:
我有一个尝试连接到LDAP服务器的安全端口10636.ldap_set_option()不设置选项“LDAP_OPT_SSL”
这里上运行Windows应用程序的源:
#include "windows.h"
#include "ntldap.h"
#include "winldap.h"
#include "schnlsp.h"
#include "stdio.h"
#include "tchar.h"
const size_t newsize = 100;
// Entry point for your application
int main(int argc, char* argv[])
{
LDAP* pLdapConnection = NULL;
INT returnCode = 0;
INT connectSuccess = 0;
ULONG version = LDAP_VERSION3;
SecPkgContext_ConnectionInfo sslInfo;
LONG lv = 0;
// Initialize an LDAP session using SSL.
pLdapConnection = ldap_sslinit("localhost",10636,1);
if (pLdapConnection == NULL)
{
printf("ldap_sslinit failed.\n");
return -1;
}
// Specify version 3; the default is version 2.
printf("Setting Protocol version to 3.\n");
returnCode = ldap_set_option(pLdapConnection,
LDAP_OPT_PROTOCOL_VERSION,
(void*)&version);
if (returnCode != LDAP_SUCCESS)
goto FatalExit;
// Verify that SSL is enabled on the connection.
printf("Checking if SSL is enabled\n");
returnCode = ldap_get_option(pLdapConnection,LDAP_OPT_SSL,(void*)&lv);
if (returnCode != LDAP_SUCCESS)
goto FatalExit;
// If SSL is not enabled, enable it.
if ((void*)lv == LDAP_OPT_ON)
printf("SSL is enabled\n");
else
{
printf("SSL not enabled.\n SSL being enabled...\n");
returnCode = ldap_set_option(pLdapConnection,LDAP_OPT_SSL,LDAP_OPT_ON);
if (returnCode != LDAP_SUCCESS)
goto FatalExit;
}
// Connect to the server.
connectSuccess = ldap_connect(pLdapConnection, NULL);
if(connectSuccess == LDAP_SUCCESS)
printf("ldap_connect succeeded \n");
else
{
printf("ldap_connect failed with 0x%x.\n",connectSuccess);
goto FatalExit;
}
// Bind with current credentials.
printf("Binding ...\n");
returnCode = ldap_bind_s(pLdapConnection,NULL,NULL,LDAP_AUTH_NEGOTIATE);
if (returnCode != LDAP_SUCCESS)
goto FatalExit;
// Retrieve the SSL cipher strength.
printf("Getting SSL info\n");
returnCode = ldap_get_option(pLdapConnection,LDAP_OPT_SSL_INFO,&sslInfo);
if (returnCode != LDAP_SUCCESS)
goto FatalExit;
printf("SSL cipher strength = %d bits\n",sslInfo.dwCipherStrength);
goto NormalExit;
// Perform cleanup.
NormalExit:
if (pLdapConnection != NULL)
ldap_unbind_s(pLdapConnection);
return 0;
// Perform cleanup after an error.
FatalExit:
if(pLdapConnection != NULL)
ldap_unbind_s(pLdapConnection);
printf("\n\nERROR: 0x%x\n", returnCode);
return returnCode;
}
设置完成后ldap_set_option(pLdapConnection,LDAP_OPT_SSL,LDAP_OPT_ON);
,应用程序仍然无法设置该选项。因此,连接失败,返回代码为LDAP_SERVER_DOWN
。
有人可以指出为什么它无法设置选项?服务器确实支持ldaps://
连接。
UPDATE: 当我做ldapsearch的LDAP服务器
ldapsearch -x -H ldaps://localhost -p 10636 -d 1
上我得到了错误:
ldap_url_parse_ext(ldaps://localhost:10636)
ldap_create
ldap_url_parse_ext(ldaps://localhost:10636/??base)
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:10636
ldap_new_socket: 472
ldap_prepare_socket: 472
ldap_connect_to_host: Trying ::1 10636
ldap_pvt_connect: fd: 472 tm: -1 async: 0
attempting to connect:
connect errno: 10061
ldap_close_socket: 472
ldap_new_socket: 472
ldap_prepare_socket: 472
ldap_connect_to_host: Trying 127.0.0.1:10636
ldap_pvt_connect: fd: 472 tm: -1 async: 0
attempting to connect:
connect success
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 0, err: 18, subject: /C=US/O=ASF/OU=ApacheD
S/CN=zanzibar, issuer: /C=US/O=ASF/OU=ApacheDS/CN=zanzibar
TLS certificate verification: Error, self signed certificate
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS trace: SSL_connect:error in SSLv3 read server certificate B
TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:cert
ificate verify failed (self signed certificate).
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
然而,加入 “TLS_REQCERT从来没有” 到ldap.conf的一切开始后,加工。现在, 如何让我的示例程序跳过“TLS证书验证”?
答
尝试以下环境变量传递给你的代码:
LDAPTLS_REQCERT=never
忽略其可能过期或无效服务器证书。
验证服务器是否能够接受SSL连接:1.使用'openssl s_client -connect host:port' 2.使用已知好的工具,例如'ldapsearch',尝试使用为安全指定的端口连接服务器连接。 – 2013-05-14 11:19:22
谢谢。由于证书验证失败,ldapsearch也不起作用。我正在更新我的帖子以获得更多详细信息 – 2013-05-15 09:44:50