[rt-users] ExternalAuth to active directory over SSL

[Guillaume Hilt]

Hello,

I'm using a fresh install of RT 4.0.19 on Ubuntu 14.04 AMD64, using .deb 
packages.

I'm trying to make ExternalAuth work with LDAP over SSL (Active 
Directory on 2008 R2 x64), we an internal CA managed under Windows 2008 
R2 x64.
I added the CA cert in /etc/ssl/certs/srv2.lan.domain.com_ca.pem.

I followed a previous discussion on this matter here : 
http://lists.bestpractical.com/pipermail/rt-users/2012-March/075690.html
I'm facing the same issue.

$ openssl s_client -connect srv2.lan.domain.com:636 -CApath /etc/ssl/certs
Return Verify return code: 21 (unable to verify the first certificate)

$ openssl verify -CAfile /etc/ssl/certs/srv2.lan.domain.com_ca.pem 
/etc/ssl/certs/srv2.lan.domain.com_cert.pem
/etc/ssl/certs/srv2.lan.domain.com_cert.pem: OK

Running LDP.exe on the domain controllers running in SSL mode works fine.


RT's log gives the following :

RT::Authen::ExternalAuth::LDAP::_GetBoundLdapObj Can't bind: 
LDAP_OPERATIONS_ERROR 1


An ldapsearch gives me this (snipped hex code) :

ldap_initialize( ldaps://srv2.lan.domain.com:636/??base )
tls_write: want=117, written=117
tls_read: want=3422, got=1443
tls_read: want=1979, got=1448
tls_read: want=531, got=531
tls_write: want=12, written=12
tls_write: want=267, written=267
tls_write: want=6, written=6
tls_write: want=117, written=117
tls_read: want=5, got=5
tls_read: want=1, got=1
tls_read: want=5, got=5
tls_read: want=80, got=80
TLS: can't connect: (unknown error code).
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)


Here's my configuration :

         'AD_LAN' => {
                 'type'                      =>  'ldap',
                 'server'                    => 'srv2.lan.domain.com',
                 'user'                      => 
'CN=r2-d2,CN=Users,DC=lan,DC=domain,DC=com',
                 'pass'                      =>  'XXXXXXX',

                 'base'                      => 
'CN=Utilisateurs,DC=lan,DC=domain,DC=com',
                 'filter'                    => 
'(&(objectClass=organizationalPerson)(mail=*))',
                 'd_filter'                  => 
'(userAccountControl:1.2.840.113556.1.4.803:=2)',

                 'group'                     =>  '',
                 'group_attr'                =>  '',

                 'tls'                       =>  0,
                 'ssl_version'               =>  3,
                 'net_ldap_args'             =>  [ version => 3, port => 
636, debug => 8 ],

                 'attr_match_list' => [
                         'Name',
                         'EmailAddress',
                 ],
                 'attr_map' => {
                         'Name' => 'sAMAccountName',
                         'EmailAddress' => 'mail',
                         'Organization' => 'physicalDeliveryOfficeName',
                         'RealName' => 'cn',
                         'ExternalAuthId' => 'sAMAccountName',
                         'Gecos' => 'sAMAccountName',
                         'WorkPhone' => 'telephoneNumber',
                         'Address1' => 'streetAddress',
                         'City' => 'l',
                         'State' => 'st',
                         'Zip' => 'postalCode',
                         'Country' => 'co'
                 },
         },


Setting tls to 1 give me his different error :

RT::Authen::ExternalAuth::LDAP::_GetBoundLdapObj Can't bind: 
LDAP_SERVER_DOWN 81


Regards,

-- 
   Guillaume Hilt