How to force SSL (not STARTTLS) using environment variables in OpenLDAP 2.3.x

[Björn Wiberg <Bjorn.Wiberg@its.uu.se>]

Hi!

I'm wondering how one can force the usage of SSL (not STARTTLS) through 
environment variables for OpenLDAP 2.3.x?

This is for a client application (FTP daemon run on a per-connection 
basis) which does not accept LDAP URIs in its configuration, and an LDAP 
server which does not support STARTTLS.


In 2.1.x, one could set LDAPTLS and LDAPTLS_CACERT to get this working. An 
example using ldapsearch:

---8<---
root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPTLS=hard 
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ldapsearch -h 
ldapauth1.uu.se -p 636 -s sub -b 
ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 
10 -L -L uid=bwiberg_hotel sn
ldap_init( ldapauth1.uu.se, 636 )
request 1 done
filter: uid=bwiberg_hotel
requesting: sn
version: 1

dn: uid=bwiberg_hotel,ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se
sn: Wiberg
request 2 done
root@spinus:/usr/local/src/openldap-2.1.29/clients/tools#
--->8---

...and if one did not set either one of those, one got:

---8<---
root@spinus:/usr/local/src/openldap-2.1.29/clients/tools#
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ldapsearch -h 
ldapauth1.uu.se -p 636 -s sub -b 
ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 
10 -L -L uid=bwiberg_hotel sn ldap_init( ldapauth1.uu.se, 636 )
ldap_bind: Local error (82)

root@spinus:/usr/local/src/openldap-2.1.29/clients/tools# LDAPTLS=hard 
ldapsearch -h ldapauth1.uu.se -p 636 -s sub -b 
ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v -d 
10 -L -L uid=bwiberg_hotel sn
ldap_init( ldapauth1.uu.se, 636 )
TLS certificate verification: Error, self signed certificate in 
certificate chain
TLS: can't connect.
ldap_bind: Can't contact LDAP server (81)
        additional info: error:14090086:SSL 
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
--->8---


However, OpenLDAP 2.3.32 does not recognize LDAPTLS=hard any longer:

---8<---
root@spinus:/usr/local/src/openldap-2.3.32/clients/tools# LDAPTLS=hard 
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -h 
ldapauth1.uu.se -p 636 -s sub -b 
ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v 
-d 10 -L -L uid=bwiberg_hotel sn
ldap_initialize( ldap://ldapauth1.uu.se:636 )
(hexdump cut out)
ldap_read: want=8, got=5
  0000:  80 03 00 00 01                                     .....
ldap_result: Local error (-2)
--->8---

Setting LDAPTLS_REQCERT=hard + LDAPTLS_CACERT, or even LDAPTLS=hard + 
LDAPTLS_REQCERT=hard + LDAPTLS_CACERT, gives the same error. That is, 
LDAPTLS_REQCERT=hard does not force SSL as LDAPTLS=hard once did.

Setting LDAPURI="ldaps://ldapauth1.uu.se:636/", not specifying a host name 
and port number (-h, -p), and optionally skipping LDAPTLS or 
LDAPTLS_REQCERT, works:

---8<---
root@spinus:/usr/local/src/openldap-2.1.29/clients/tools#
LDAPURI="ldaps://ldapauth1.uu.se:636/"
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -s sub
-b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x
-v -d 20 -L -L uid=bwiberg_hotel sn
ldap_initialize( <DEFAULT> )
request 1 done
filter: uid=bwiberg_hotel
requesting: sn
version: 1

dn: uid=bwiberg_hotel,ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se
sn: Wiberg
request 2 done

root@spinus:/usr/local/src/openldap-2.3.32/clients/tools# 
LDAPURI="ldaps://ldapauth1.uu.se:636/" 
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -s sub 
-b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x 
-v -L -L uid=bwiberg_hotel sn
ldap_initialize( <DEFAULT> )
filter: uid=bwiberg_hotel
requesting: sn
version: 1

dn: uid=bwiberg_hotel,ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se
sn: Wiberg
--->8---

...but as soon as one adds -h and -p, ldapsearch and/or libldap ignores 
LDAPURI and tries ldap:// instead of ldaps://. This is true both for 
2.1.29 and 2.3.32:

---8<---
root@spinus:/usr/local/src/openldap-2.1.29/clients/tools#
LDAPURI="ldaps://ldapauth1.uu.se:636/"
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -h
ldapauth1.uu.se -p 636 -s sub -b
ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se -D cn=root -w SECRET -x -v
-d 20 -L -L uid=bwiberg_hotel sn
ldap_init( ldapauth1.uu.se, 636 )
ldap_bind: Local error (82)

root@spinus:/usr/local/src/openldap-2.3.32/clients/tools# 
LDAPURI="ldaps://ldapauth1.uu.se:636/" 
LDAPTLS_CACERT=/hotel/apache/etc/ssl/certs/pcacert.pem ./ldapsearch -s sub 
-h ldapauth1.uu.se -p 636 -b ou=webUpdate-W2,ou=userRoleData,dc=uu,dc=se 
-D cn=root -w SECRET -x -v -L -L uid=bwiberg_hotel sn
ldap_initialize( ldap://ldapauth1.uu.se:636 )
ldap_result: Local error (-2)
--->8---

...so "overriding" the specified hostname and port with a URI through 
environment variables seems impossible.


Could anyone give some piece of advice on how to force SSL as in the older 
versions, i.e. without LDAPURI or its -H ldapsearch counterpart?

As, sadly, my client application will always suggest a hostname and port 
number to connect to, in its calls to libldap, and does not have the 
ability to accept LDAP URIs in its configuration. The earlier environment 
variable solution was an easy work-around, and I would have hoped that 
this possibility would stay in future (> 2.1) versions...

Many thanks in advance!

Best regards,
Björn Wiberg
Uppsala University
IT Support Department