Using LDP.exe to connect to an SSL LDAP server?

  • Thread starter Thread starter Damon Rand
  • Start date Start date
D

Damon Rand

Hi there,

I'm sorry if this is a little off-topic but this seems to be the forum
for Microsoft LDAP experts.

I am trying to connect to an SSL NDS directory using Microsoft LDP.exe

I have also installed our organizations self-signed CA certificate for
the NDS into the Windows certificate store.

Using LDP I have confirmed that authentication is required by this
LDAP directory.

res = ldap_simple_bind_s(ld, 'drand', <unavailable>); // v.3
Error <8>: ldap_simple_bind_s() failed: Strong Authentication Required

Now I set LDAP_OPT_SSL to 1 and that I am getting this error.

<0x0> = ldap_get_option(ld, 0xA, 0)
0x52 = ldap_set_option(ld, 0xA, 1)
res = ldap_simple_bind_s(ld, 'drand', <unavailable>); // v.3
Error <52>: ldap_simple_bind_s() failed: Unavailable

This seems to be an error number from Novell but I am thinking the
problem is with my LDP configuration:

0x34
52
LDAP_UNAVAILABLE: Indicates that the LDAP server cannot process the
client's bind request, usually because it is shutting down.

What ldap_set_option parameters do I need?

What bind settings should I use in Microsoft LDAP.. Method=SSPI?
Function Type = Generic or Simple?

Has anyone successfully connected to a secure NDS directory with
LDP.exe?

Regards
Damon.
 
Robbie Allen said:
First, did you connect to port 636?
Click to expand...

Hi,
Yes, and I tried connecting by IP address because apparently NDS
uses server certificates with IPs rather than domain names..

ld = ldap_open("192.168.1.1", 636);
Error <0x0>: Fail to connect to 192.168.1.1.

It may actually be that our NDS server is not properly configured
for SSL though.. I couldn't connect from Mozilla either on 636 and
people say I should at least be able to get the SSL certificate by
typing..

https://192.168.1.1:636/

in Mozilla.

Damon.
 
Does the server certificate on the LDAP server have a subject of
192.168.1.1?

LDP.exe is going to check to see if the subject field of the certificate
matches the server name.

--Shawn
This posting is provided "AS IS" with no warranties and confers no rights.
 
Back
Top