You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Eirik Lygre <ei...@gmail.com> on 2013/03/01 00:50:58 UTC
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Eric Covener wrote
> On Thu, Feb 28, 2013 at 11:12 AM, Eirik Lygre <
> eirik.lygre@
> > wrote:
>> We have been trying to set up Apache on Windows with ldaps (ssl)
>> authentication, using apr-util compiled with the Microsoft ldap sdk.
>>
>> I believe I have identified a bug in the interaction between httpd
>> (util_ldap.c) and apr-util which makes this combination impossible. This
>> email is an attempt to explain the problem and get a second set of eyes
>> on
>> this. If people agree that this is / might be a bug, I'll file the proper
>> issue and take it from there.
>>
>> Does the below sound like a reasonable analysis? Am I missing something?
>
> seems to make sense, were you able to test the mod_ldap side of the
> change, or is the rebuild a problem?
The number of moving parts needed to build it all was a bit daunting, so
it's all theory, I'm afraid. If anybody with a working build setup could add
the required if-test and build a version, I'd be more than willing to test
and verify it all.
Eirik
--
View this message in context: http://apache-http-server.18135.n6.nabble.com/Bug-using-authnz-ldap-module-with-Microsoft-LDAP-SDK-and-ldaps-secure-ldap-tp5003960p5003976.html
Sent from the Apache HTTP Server - Dev mailing list archive at Nabble.com.
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Posted by Eric Covener <co...@gmail.com>.
> [Tue Mar 05 10:07:47.862394 2013] [authnz_ldap:debug] [pid 4492:tid 884]
> mod_authnz_ldap.c(500): [client ::1:62053] AH01691: auth_ldap
authenticate:
> using URL ldaps://server:1389/ou=People,dc=example,dc=com?uid
> [Tue Mar 05 10:07:47.878395 2013] [ldap:error] [pid 4492:tid 884]
> (70023)This function has not been implemented on this platform: AH01277:
> LDAP: Unable to add rebind cross reference entry. Out of memory?
> [Tue Mar 05 10:07:47.878395 2013] [authnz_ldap:info] [pid 4492:tid 884]
> [client ::1:62053] AH01695: auth_ldap authenticate: user MYUSERNAME
> authentication failed; URI /server-status [LDAP: Unable to add rebind
cross
> reference entry.][]
>
Try http://httpd.apache.org/docs/current/mod/mod_ldap.html#ldapreferrals Off
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Posted by Eirik Lygre <ei...@gmail.com>.
Eric Covener wrote
> On Mon, Mar 4, 2013 at 3:34 PM, Steffen <
> info@
> > wrote:
>> On your request a patched mod_ldap.so available at AL post,
>> with following changes in ldap_util.c :
>
> Thanks!
Better, but. The initialization now works fine, but it then fails during
bind. I guess that since nobody ever got past init, nobody ever got to test
this further either, and there may be many issues in the remaining process.
The messages are now like this, where the first two show that we have
progress, and the last three show that there are still problems (fwiw, it
seems to fail inside apr_ldap_rebind_add in
http://svn.apache.org/viewvc/apr/apr-util/tags/1.4.1/ldap/apr_ldap_rebind.c?view=markup):
[Tue Mar 05 10:07:06.898979 2013] [ldap:info] [pid 4492:tid 356] AH01318:
APR LDAP: Built with Microsoft Corporation. LDAP SDK
[Tue Mar 05 10:07:06.898979 2013] [ldap:info] [pid 4492:tid 356] AH01319:
LDAP: SSL support available
...
[Tue Mar 05 10:07:47.862394 2013] [authnz_ldap:debug] [pid 4492:tid 884]
mod_authnz_ldap.c(500): [client ::1:62053] AH01691: auth_ldap authenticate:
using URL ldaps://server:1389/ou=People,dc=example,dc=com?uid
[Tue Mar 05 10:07:47.878395 2013] [ldap:error] [pid 4492:tid 884]
(70023)This function has not been implemented on this platform: AH01277:
LDAP: Unable to add rebind cross reference entry. Out of memory?
[Tue Mar 05 10:07:47.878395 2013] [authnz_ldap:info] [pid 4492:tid 884]
[client ::1:62053] AH01695: auth_ldap authenticate: user MYUSERNAME
authentication failed; URI /server-status [LDAP: Unable to add rebind cross
reference entry.][]
Now, given that this seems to be a non-working, and probably never-tested,
configuration, I guess actually debugging and stabilizing it is probably a
bigger task than expected. Also, the current workflow (I read code, you
compile, I test) is, um, sub-optimal. Thus:
- I'm going to stop trying to understand the code and propose fixes this way
- If anybody wants to take this forward (which would be nice!), I can
instead offer to set up a publicly available ldaps-server, and create a
httpd.conf-file which can be used to test and debug the issue
- Or, if there are any other items I can do, please ask!
Anyway, thanks a lot for spending time on helping out, and sorry that I
can't take it all the way.
Eirik
--
View this message in context: http://apache-http-server.18135.n6.nabble.com/Bug-using-authnz-ldap-module-with-Microsoft-LDAP-SDK-and-ldaps-secure-ldap-tp5003960p5004121.html
Sent from the Apache HTTP Server - Dev mailing list archive at Nabble.com.
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Posted by Eric Covener <co...@gmail.com>.
On Mon, Mar 4, 2013 at 3:34 PM, Steffen <in...@apachelounge.com> wrote:
> On your request a patched mod_ldap.so available at AL post,
> with following changes in ldap_util.c :
Thanks!
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps (secure ldap)?
Posted by Steffen <in...@apachelounge.com>.
On your request a patched mod_ldap.so available at AL post,
with following changes in ldap_util.c :
rc = apr_ldap_ssl_init(p,
NULL,
0,
&(result_err));
- if (APR_SUCCESS == rc) {
+ if (APR_SUCCESS == rc && !apr_is_empty_array(st->global_certs)) {
rc = apr_ldap_set_option(ptemp, NULL, APR_LDAP_OPT_TLS_CERT,
(void *)st->global_certs, &(result_err));
}
Steffen
-----Original Message-----
From: Eirik Lygre
Sent: Monday, March 4, 2013 8:15 PM Newsgroups: gmane.comp.apache.devel
To: dev@httpd.apache.org
Subject: Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Eirik Lygre wrote
>
> Eirik Lygre wrote
>>
>> Eric Covener wrote
>>> On Thu, Feb 28, 2013 at 11:12 AM, Eirik Lygre <
>>> eirik.lygre@
>>> > wrote:
>>> seems to make sense, were you able to test the mod_ldap side of the
>>> change, or is the rebuild a problem?
>> The number of moving parts needed to build it all was a bit daunting, so
>> it's all theory, I'm afraid. If anybody with a working build setup could
>> add the required if-test and build a version, I'd be more than willing to
>> test and verify it all.
> I have entered an issue in the bug database, available as
> https://issues.apache.org/bugzilla/show_bug.cgi?id=54626.
>
> Eirik
Given that I'm unable to build it myself, is there anything I can do to help
move this issue forward and get it resolved?
Eirik
--
View this message in context:
http://apache-http-server.18135.n6.nabble.com/Bug-using-authnz-ldap-module-with-Microsoft-LDAP-SDK-and-ldaps-secure-ldap-tp5003960p5004104.html
Sent from the Apache HTTP Server - Dev mailing list archive at Nabble.com.
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Posted by Eirik Lygre <ei...@gmail.com>.
Eirik Lygre wrote
>
> Eirik Lygre wrote
>>
>> Eric Covener wrote
>>> On Thu, Feb 28, 2013 at 11:12 AM, Eirik Lygre <
>>> eirik.lygre@
>>> > wrote:
>>> seems to make sense, were you able to test the mod_ldap side of the
>>> change, or is the rebuild a problem?
>> The number of moving parts needed to build it all was a bit daunting, so
>> it's all theory, I'm afraid. If anybody with a working build setup could
>> add the required if-test and build a version, I'd be more than willing to
>> test and verify it all.
> I have entered an issue in the bug database, available as
> https://issues.apache.org/bugzilla/show_bug.cgi?id=54626.
>
> Eirik
Given that I'm unable to build it myself, is there anything I can do to help
move this issue forward and get it resolved?
Eirik
--
View this message in context: http://apache-http-server.18135.n6.nabble.com/Bug-using-authnz-ldap-module-with-Microsoft-LDAP-SDK-and-ldaps-secure-ldap-tp5003960p5004104.html
Sent from the Apache HTTP Server - Dev mailing list archive at Nabble.com.
Re: Bug using authnz_ldap_module with Microsoft LDAP SDK and ldaps
(secure ldap)?
Posted by Eirik Lygre <ei...@gmail.com>.
Eirik Lygre wrote
>
> Eric Covener wrote
>> On Thu, Feb 28, 2013 at 11:12 AM, Eirik Lygre <
>> eirik.lygre@
>> > wrote:
>> seems to make sense, were you able to test the mod_ldap side of the
>> change, or is the rebuild a problem?
> The number of moving parts needed to build it all was a bit daunting, so
> it's all theory, I'm afraid. If anybody with a working build setup could
> add the required if-test and build a version, I'd be more than willing to
> test and verify it all.
I have entered an issue in the bug database, available as
https://issues.apache.org/bugzilla/show_bug.cgi?id=54626.
Eirik
--
View this message in context: http://apache-http-server.18135.n6.nabble.com/Bug-using-authnz-ldap-module-with-Microsoft-LDAP-SDK-and-ldaps-secure-ldap-tp5003960p5003994.html
Sent from the Apache HTTP Server - Dev mailing list archive at Nabble.com.