<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
What they do in the LDAP authenticator is use TLS if authLDAPUseSSL is
TRUE.<br>
In the AD version, they use LDAPS (i.e. LDAP over SSL) if
authLDAPUseSSL is TRUE.<br>
<br>
I would be interested to hear if the LDAP+TLS approach works.<br>
Their original code used TLS regardless of whether you set the option
or not.<br>
It now only does TLS if you ask it to.<br>
<br>
So please try the attached code instead of the last version I sent you.<br>
<br>
Jules.<br>
<br>
On 03/08/2010 17:08, Brad Beckenhauer wrote:
<blockquote cite="mid:4C57F898020000680005B14C@smtp.aafp.org"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<meta name="GENERATOR" content="MSHTML 8.00.7600.16588">
<div>Ok I get the following warning when connecting usign your new
code.</div>
<div><strong></strong> </div>
<div><strong>Warning</strong>: ldap_start_tls() [<a
moz-do-not-send="true"
href="http://172.22.12.2/function.ldap-start-tls"><font color="red"><b>MailScanner
has detected a possible fraud attempt from "172.22.12.2" claiming to be</b></font>
function.ldap-start-tls</a>]: Unable to start TLS: Connect error in <b>/opt/zendto/lib/NSSLDAPAuthenticator.php</b>
on line 199.</div>
<div> </div>
<div>Line 199 points to a ldap_start_tls code block that appears
twice in the library.</div>
<div> </div>
<div> if ( ldap_start_tls($ldapConn) ) {<br>
</div>
<div> </div>
<div>I've tried using setting the authLDAPUseSSL set to both true and
false, both fail. I'm not sure if it is honoring the false setting yet.</div>
<div> </div>
<div>I currently authenticate to my LDAP server using HTTP, so I know
it works (my ldap server is SLES 10 running edirectory).</div>
<div> </div>
<div>Here is the relevant line from my Apache conf file connecting on
port 389 that works. (IP's and ou's are munged)</div>
<div> </div>
<div>AuthLDAPUrl "<a moz-do-not-send="true"
href="ldap://191.168.19.13:389/ou=Admin,o=TEST?uid">ldap://191.168.19.13:389/ou=Admin,o=TEST?uid</a>"</div>
<div> </div>
<div>my preferences.php line looks like:</div>
<div> </div>
<div>'authLDAPBaseDN' => 'ou=Admin,o=TEST',</div>
<div> </div>
<div>I'll try to work on this later this afternoon.</div>
<div> </div>
<div>thanks</div>
<div>Brad</div>
<div><br>
>>> On 8/3/2010 at 9:57 AM, in message
<a class="moz-txt-link-rfc2396E" href="mailto:4C582E73.7090101@ZendTo.com"><4C582E73.7090101@ZendTo.com></a>, Jules <a class="moz-txt-link-rfc2396E" href="mailto:Jules@zendto.com"><Jules@zendto.com></a>
wrote:<br>
</div>
<table style="margin: 0px 0px 0px 15px; font-size: 1em;"
bgcolor="#f3f3f3" border="0">
<tbody>
<tr>
<td>
<div
style="border-left: 1px solid rgb(5, 5, 5); padding-left: 7px;"><br>
<br>
On 03/08/2010 15:48, Brad Beckenhauer wrote:
<blockquote cite="mid:4C57E5E7020000680005B0BE@smtp.aafp.org"
type="cite">
<meta name="GENERATOR" content="MSHTML 8.00.7600.16588">
<div>Hi Jules,</div>
<div> </div>
<div>I noticed that there is
a authenticator /lib/NSSLDAPAuthenticator.php but the preferences.php
file does not have a corresponding section on implementing it.</div>
</blockquote>
I've never had an LDAP server to test it against. If you fancy
contributing the section, then that would be much appreciated!<br>
<blockquote cite="mid:4C57E5E7020000680005B0BE@smtp.aafp.org"
type="cite">
<div> I have access to SLES servers that supports OPEN LDAP
and thought I'd give it a whirl instead of the AD or IMAP
authenticators.</div>
<div> </div>
<div>The NSSADAuthenticator.php has a section on howto
implement it in the preferences.php file but the
NSSLDAPAuthenticator.php does not have an example.</div>
</blockquote>
It should be much the same as the AD one, as that uses LDAP anyway.<br>
<blockquote cite="mid:4C57E5E7020000680005B0BE@smtp.aafp.org"
type="cite">
<div> </div>
<div>I'm going to "try" configuring the LDAP Auth in the
preferences.php as I have SLES system I can authenticate against.</div>
<div> </div>
<div>I'm "guessing" that the preferences file needs something
like the below to work:</div>
<div> </div>
<div> //<br>
// Settings for the LDAP authenticator.<br>
//<br>
// "authLDAPServers" Array of hostnames to try binding to<br>
// "authLDAPBaseDN" Base distinguished name for search/bind<br>
// "authLDAPAdmins" Cheap way to grant admin privs to users; an<br>
// array of uname's<br>
'authenticator' => 'LDAP',<br>
'authLDAPServers' => array('192.168.1.1','192.168.1.2'),<br>
'authLDAPBaseDN' => 'ou=users,o=domain',</div>
<div> 'authLDAPUseSSL' => false,
<<<<< option does not appear to be currently supported
in v3.59</div>
</blockquote>
That looks good. If you gunzip the attached file and drop it on the top
of your /opt/zendto/lib/NSSLDAPAuthenticator.php file, then you should
get the "authLDAPUseSSL" option you want.<br>
<blockquote cite="mid:4C57E5E7020000680005B0BE@smtp.aafp.org"
type="cite">
<div> </div>
<div>Can the LDAP library be tweaked to allow the use of the
authLDAPUseSSL option in the preferences file? (If my humble
interpretation that it is not currently implemented is correct).</div>
</blockquote>
Done, see above.<br>
<br>
If it works, please let me know and I'll put it in the next release.<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CITP CEng
<a moz-do-not-send="true" class="moz-txt-link-abbreviated"
href="http://www.ZendTo.com">www.ZendTo.com</a>
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM
</pre>
</div>
</td>
</tr>
</tbody>
</table>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
ZendTo mailing list
<a class="moz-txt-link-abbreviated" href="mailto:ZendTo@zendto.com">ZendTo@zendto.com</a>
<a class="moz-txt-link-freetext" href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CITP CEng
<a class="moz-txt-link-abbreviated" href="http://www.ZendTo.com">www.ZendTo.com</a>
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM
</pre>
</body>
</html>