<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>1. We are running a single RT 4(4.0.4) server on a Dell 760 Optiplex PC running RHEL 6.2 64-bit<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>2. We’re using the <b>RT-Authen-External-Auth </b>version <b>0.10_01</b><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>3. We’re using <b>tls</b> with a Windows 2008 R2 Active Directory server and also <b>https</b> with the clients. The RT server is using a DOD certificate which has a common root CA with the Windows server.<o:p></o:p></p><p class=MsoNormal> The <b>ldap bind </b>user name and password has been verified.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>4. Everything was working fine with our old Windows 2003 server until they replaced it with a Windows 2008 R2 Army Gold Master (AGM) server. An AGM version of an<o:p></o:p></p><p class=MsoNormal> operating system is very strictly configured in terms of security. From that point on no one could log into the RT Server. In the httpd logs the following error is displayed:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> [Mon Mar 19 12:01:32 2012] [critical]: RT::Authen::ExternalAuth::LDAP::_GetBoundLdapObj Can't bind: LDAP_LOCAL_ERROR 82 (/opt/rt4/local/plugins/RT-Authen-ExternalAuth/lib/RT/Authen/ExternalAuth/LDAP.pm:492)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>5. If <b>tls</b> is not used then the login process is successful. However authentication traffic is in the clear. There is an apparent TLS incompatibility between the two machines but I’m not sure what it is.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>6. <b>HTTPS </b>still continues to work between RT server and client machines but <b>tls </b>is still a problem.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any help would be appreciated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>