I'm attempting to use the LDAP_Integration module with our Active Directory (Win2k3) servers. I'm able to connect and log in as a user perfectly fine with the Start-TLS option left unchecked. However, if I check the box, and save, then go back and click the test connection button, it fails with these three errors logged:
------------
ldap_start_tls() [function.ldap-start-tls]: Unable to start TLS: Connect error in /var/www/html/drupal_test/sites/all/modules/ldap_integration/includes/LDAPInterface.inc on line 153.

Could not start TLS. (Error -11: Connect error).

LDAP Bind failure for user LDAPStaff@snf.example.local. Error -1: Can't contact LDAP server
-------------

I have PHP 5.3.5 compile with '--with-ldap' '--with-ldap-sasl' '--with-openssl'.

In ldap.conf I have:
tls_checkpeer no
tls_reqcert never
ssl start_tls
ssl on
ldap_version 3
sasl_secprops maxssf=0

The strangest thing is that it works fine with Start-TLS turned off. It also works fine with Start-TLS turned ON when I use webmin's LDAP browser and settings (which tells me it's probably not a firewall issue). I can't figure out why it doesn't work through this module.

Comments

johnbarclay’s picture

johnbarclay commented

this is a very common problem. Have you had any luck with any of the resources at: http://drupal.org/node/1023900

jlea9378’s picture

jlea9378 commented

Nope, nothing on there seems to help.

On this page (http://drupal.org/node/118092) I noticed this is wrong:
DN for non-anonymous searches: Enter the BINDDN of the account used to bind to the LDAP directory, e.g. CN=drupalread,OU=Service Accounts,OU=People,DC=example,DC=com

It seems the correct entry isn't a DN (Distinguished Name) but rather just the Display Name: Drupal Read.

However that doesn't change anything in my situation because I had it in this format, drupalread@example.com which seemed to work also.

I tried it as just "Drupal Read" but that didn't help.

jlea9378’s picture

jlea9378 commented

Anyone know how to get this working?

cgmonroe’s picture

cgmonroe commented
Status: Active » Postponed

Spent some time looking at this. It appears that PhP has lots of problems with TLS. Google with the terms: 'php ldap tls start failed' for various pages that talk about this.

Some people have had success with making changes to the ldap.conf file on their webservers. Particularly, having the option 'TLS_REQCERT never' set. Be warned that finding where the ldap.conf should be located can be tricky because it changes with PhP versions and the OS. Also, changes here generally require the web server daemon/service to be restarted.

That said, I could not get my WAMP setup to work even with the option set. PhP 5.2.17 would not do TLS while CygWin's ldapsearch had no problems.

At this time, I would recommend using SSL connections rather than TLS. E.g., use the ldaps://server/ format for server and port 636. The security level is the same as is the cost of creating SSL connections. TLS is more efficient if your code only starts it for binds and lets searches, etc. be normal... but most code (ldap_integration included) just use it for all connections/traffic.

Marking this postponed since there does not seem to be any code changes that can fix this.

Homotechsual’s picture

Homotechsual commented

This guide applies to a Windows 2003/2008 based Active Directory domain with a debian-style Linux webserver, however similar steps will be required for other situations, you can Google the various steps to figure this out.

Okay, here goes nothing:

Export Your Certificate
If you don't know how to do this, there is a guide here: http://support.microsoft.com/kb/555252
Export your certificate to a file named: CACert.cer for ease of reference.

Copy The Certificate
Copy the certificate created above to your webserver. (Assuming Debian based linux for this guide, use google to find steps for your OS.

You'll want to place the certificate in the /etc/ssl/certs/ directory.

Run "c_rehash"

Edit Your LDAP.conf
The most common location for this file on linux is here: /etc/ldap/ldap.conf

Add the following under the "Certificates" section:

TLS_CACERT /etc/ssl/certs/CACert.cer
TLS_CACERTDIR /etc/ssl/certs
#TLS_REQCERT never

I make no guarantees that this will fix your issues, but it fixed mine! You can uncomment the last line in the section above if you still have issues