Trouble getting ldaps to work

9 Jan 2014

      Hi.

I'm having trouble setting up a rlm_ldap module.

FR version is 3.0.0

Trimmed output from radiusd -X:

radiusd: #### Instantiating modules ####
 instantiate {
 }
 modules {
  # Loaded module rlm_ldap
  # Instantiating module "ldap_xxxxxx" from file
/usr/local/etc/raddb/mods-enabled/ldap_xxxxxx
  ldap ldap_xxxxxx {
      server = "ldap.example.org"
      port = 636
      password = "whocares"
      identity = "someuser@example.org"
   user {
       filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})"
       scope = "sub"
       base_dn = "dc=example,dc=org"
       access_positive = yes
   }
   group {
       filter = "(objectClass=posixGroup)"
       scope = "sub"
       base_dn = "dc=example,dc=org"
       name_attribute = "cn"
       membership_attribute = "memberOf"
       cacheable_name = no
       cacheable_dn = no
   }
   client {
       scope = "sub"
    attribute {
        identifier = "host"
        shortname = "cn"
    }
   }
   profile {
       filter = "(&)"
   }
   options {
       ldap_debug = 40
       chase_referrals = no
       rebind = yes
       net_timeout = 3
       res_timeout = 20
       srv_timelimit = 20
       idle = 60
       probes = 3
       interval = 3
   }
   tls {
       ca_file = "/usr/local/etc/raddb/certs/ca.example.org.pem"
       start_tls = no
       require_cert = "demand"
   }
  }
   accounting {
       reference = "."
   }
   post-auth {
       reference = "."
   }
rlm_ldap (ldap_xxxxxx): Initialising connection pool
   pool {
       start = 4
       min = 2
       max = 6
       spare = 2
       uses = 0
       lifetime = 0
       cleanup_delay = 5
       idle_timeout = 60
       spread = no
   }
rlm_ldap (ldap_xxxxxx): Opening additional connection (0)
rlm_ldap (ldap_xxxxxx): Connecting to ldap.example.org:636
rlm_ldap (ldap_xxxxxx): Bind with someuser@example.org to
ldap.example.org:636 failed: Can't contact LDAP server
rlm_ldap (ldap_xxxxxx): Opening connection failed (0)
rlm_ldap (ldap_xxxxxx): Removing connection pool
/usr/local/etc/raddb/mods-enabled/ldap_xxxxxx[8]: Instantiation failed for
module "ldap_xxxxxx"

FR is able to bind with the LDAP server only if require_cert is set to
"never", which makes me believe this is a certificate verification issue.

I tried to do a manual connect using openssl using
openssl s_client -connect ldap.example.org:636 -CAfile
/usr/local/etc/raddb/certs/ca.example.org.pem -debug
which shows a Verify return code: 0 (ok)

Module is being called at the sites-enabled/default:
authorize {
....
    -ldap_xxxxx
....
}

BTW: Why the "-" before the module name?

TIA

Trouble getting ldaps to work

Alberto Martínez