[users@httpd] httpd <---> ldaps

[Dave <ma...@hotmail.com>]

Greetings.

I haven't had to administer Apache for about 6 or 7 years now, but recently jumped back into it to setup a subversion repository for developers.  I'm working on setting up subversion on Apache (Linux) to authenticate via ldaps to an Active Directory domain controller.  Front end subversion client accesses Apache successfully via https.  However, I cannot get Apache to talk ldaps while verifying the certs.  I've been banging my head against this thing for weeks now, and am beyond frustrated.  I've read & researched to no end - scoured the Internet - found others with a similar issue, but no fix yet.  Any help anyone could provide would be greatly appreciated.

Sincerely,
Dave

RHEL5.3 x86_64

RPMs:

httpd-2.2.3-45

mod_ssl-2.2.3-45

openssl-0.9.8e-12

openldap-2.3.43-12

subversion-1.6.11-7

mod_dav_svn-1.6.11-7



Active Directory - Windows Server 2003


Was already in httpd.conf:
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so

Added to ssl.conf:
SSLRandomSeed startup file:/dev/urandom 1024
SSLRandomSeed connect file:/dev/urandom 1024
SSLCipherSuite SSLv3:+HIGH:+MEDIUM
SSLCertificateFile /etc/pki/tls/http/apache_server_cert.pem
SSLCertificateKeyFile /etc/pki/tls/apache_server_key.pem
SSLCACertificateFile /etc/pki/CA/domain_controller_CA_cert.pem
SSLVerifyClient require
SSLVerifyDepth 1
SSLOptions +StrictRequire

The following httpd.conf configuration works for authenticating via ldaps without verifying the certificates:

##############################
# Subversion config

LDAPVerifyServerCert off

<Location /repos>
    DAV svn
    SVNPath /opt/local/svn/repos
        SSLRequireSSL

    Order deny,allow
    Deny from All
    AuthName "Subversion Repository"
    AuthType Basic
    AuthBasicProvider ldap
    Satisfy any
    Require ldap-group CN=Subversion,CN=Users,DC=domain,DC=com
    AuthLDAPURL "ldaps://domain_controller.domain.com:636/CN=Users,DC=domain,DC=com?sAMAccountName?sub?(objectClass=*)" SSL
    AuthLDAPBindDN "CN=Apache,CN=Users,DC=domain,DC=com"
    AuthLDAPBindPassword "password"

</Location>

CustomLog logs/svn_log "%t %u %{SVN-ACTION}e" env=SVN-ACTION

##############################


However, changing LDAPVerifyServerCert to "on" and adding LDAPTrustedGlobalCert pointing to CA cert (shown below) to verify the certificates gives me a 500 error in the subversion client (Tortoise), and the below error in ssl_error_log.  I also tried adding a second LDAPTrustedGlobalCert pointing to apache_server cert, to no avail.

httpd.conf:


##############################

# Subversion config


LDAPTrustedGlobalCert CA_BASE64 /etc/pki/CA/domain_controller_CA_cert.pem
LDAPTrustedGlobalCert CERT_BASE64 /etc/pki/tls/http/apache_server_cert.pem   #####  Tried with and without this line
LDAPVerifyServerCert on

<Location /repos>
    DAV svn
    SVNPath /opt/local/svn/repos
        SSLRequireSSL

    Order deny,allow
    Deny from All
    AuthName "Subversion Repository"
    AuthType Basic
    AuthBasicProvider ldap
    Satisfy any
    Require ldap-group CN=Subversion,CN=Users,DC=domain,DC=com
    AuthLDAPURL "ldaps://domain_controller.domain.com:636/CN=Users,DC=domain,DC=com?sAMAccountName?sub?(objectClass=*)" SSL
    AuthLDAPBindDN "CN=Apache,CN=Users,DC=domain,DC=com"
    AuthLDAPBindPassword "password"

</Location>

CustomLog logs/svn_log "%t %u %{SVN-ACTION}e" env=SVN-ACTION

##############################

ssl_error_log:
[Wed May 04 17:31:42 2011] [warn] [client 192.168.151.74] [27453] auth_ldap authenticate: user subversion_test authentication failed; URI /repos [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server]

I run "openssl s_client -CApath /etc/pki/CA/ -connect domain_controller.domain.com:636" and receive "Verify return code:  0 (ok)", so it appears the SSL handshake is fine outside of Apache:

CONNECTED(00000003)
depth=1 /DC=com/DC=domain/CN=domain_controller
verify return:1
depth=0 /C=US/ST=State/L=City/O=Org/OU=OrgUnit/CN=domain_controller.domain.com
verify return:1
---
Certificate chain
 0 s:/C=US/ST=State/L=City/O=Org/OU=OrgUnit/CN=domain_controller.domain.com
   i:/DC=com/DC=domain/CN=domain_controller
---
Server certificate
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
subject=/C=US/ST=State/L=City/O=Org/OU=OrgUnit/CN=domain_controller.domain.com
issuer=/DC=com/DC=domain/CN=domain_controller
---
Acceptable client certificate CA names
/DC=com/DC=domain/CN=DOMAIN                  ##### <--- not sure why its returning CN=DOMAIN and not CN=domain_controller
...                                                                  ##### <--- the rest are standard CAs (Verisign, etc)
...
...
---
SSL handshake has read 4776 bytes and written 443 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1                                      ##### <--- also not sure why its stating TLSv1 protocol instead of SSL.
    Cipher    : RC4-MD5
    Session-ID: .........................................
    Session-ID-ctx:
    Master-Key: .........................................
    Key-Arg   : None
    Krb5 Principal: None
    Start Time: 1304534983
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---

read:errno=0