[Date Prev][Date Next] [Chronological] [Thread] [Top]

slapd-meta and tls_reqcert=allow

I'm using OpenLDAP 2.4.23-26 from Centos 6. I seem to be hitting a configuration issue regarding slapd-meta and SSL/TLS.

Here is my meta config:

database        meta
suffix          "dc=virtual,dc=local"
rootdn          "cn=root,dc=virtual,dc=local"
rootpw          password

# Local
uri             ldap://localhost/dc=ds1,dc=virtual,dc=local
suffixmassage   "dc=ds1,dc=virtual,dc=local" "dc=lab,dc=local"
idassert-bind   bindmethod=simple binddn="cn=root,dc=lab,dc=local" credentials=password

#Remote AD server
uri ldap://,dc=virtual,dc=local
tls start
suffixmassage "dc=ad1,dc=virtual,dc=local" "dc=mslab,dc=local"
idassert-bind bindmethod=simple binddn="CN=Sync,CN=Users,DC=lab,DC=local" credentials="Password1" starttls="yes" tls_reqcert="allow"

It seems as though  tls_reqcert="allow" is ignored for the remote AD server.  If set that variable in the ldap.conf everything works fine.  But shouldn't the above function as an override to the default of 'demand'?  The behaviour is the same when I change the above to use SSL instead.

Another thing I noticed was that adding tls_crlcheck="none" to my idassert-bind line causes slaptest to fail..not sure if this is related or not.

/etc/openldap/slapd.conf: line 68: "idassert-bind <args>": unable to parse field "tls_crlcheck=none".
slaptest: bad configuration file!

 I must be misunderstanding the docs.  Any help would be appreciated.