[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: OpenLDAP and SSL-client authentication?

> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of wun

> Does OpenLDAP (compiled using the OpenSSL lib) support SSL-client
> authentication?


> If yes, since which release?

Looking through the CVS log, I think since about November 2000, or
the 2.0.7 release. That's when the first cut of SASL/EXTERNAL
authentication was rolled out of the development stream into a release.

> Has anybody successfully implemented the OpenLDAP server authenticating
> any LDAP
> client (such as the command-line ldapsearch; the Netscape Adressbook or
> the LDAP
> Browser/Editor version 2.8.1 by Jarek Gawor ; url >
> http://www.iit.edu/~gawojar/ldap/ ).

I have not used the SASL/EXTERNAL mechanism with any of these clients. I
tested with some custom/private code to do SSL-client authentication
the 2.0.7 code was released. My experience with the Netscape client has
pretty spotty as far as ldaps connections go. It took a lot of fiddling to
get Jarek's browser working with ldaps too, and I don't recall ever
it up with a client certificate. The only thing I got working easily was
the command-line tools. For these clients, you just need to set the path
your certificate and private key in ~/.ldaprc:
	TLS_CERT /home/me/mycert.pem
	TLS_KEY  /home/me/mykey.pem

> Finally, how to configure the OpenLDAP server for SSL-client
> authentication (i.e.
> NOT only having an SSL-encrypted wire, but to enable exchanging
> server/client certificates
> for authentication purpose and signing messages using the respective
> private keys, thus verifying
> the identity of the respective parties.

The only supported method is to build OpenLDAP with SASL support. You
need to perform a SASL bind with the EXTERNAL mechanism on a SSL/TLS
You may want to use the "TLSVerifyClient  1" option in slapd.conf to
require that all clients have a valid cert.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc

Attachment: smime.p7s
Description: S/MIME cryptographic signature