ldap_set_option（）不設置選項「LDAP_OPT_SSL」

我有一個嘗試連接到LDAP服務器的安全端口10636.ldap_set_option（）不設置選項「LDAP_OPT_SSL」

這裏上運行Windows應用程序的源：

#include "windows.h" 
#include "ntldap.h" 
#include "winldap.h" 
#include "schnlsp.h" 
#include "stdio.h" 
#include "tchar.h" 
const size_t newsize = 100; 

// Entry point for your application 
int main(int argc, char* argv[]) 
{ 
    LDAP* pLdapConnection = NULL; 
    INT returnCode = 0; 
    INT connectSuccess = 0; 
    ULONG version = LDAP_VERSION3; 
    SecPkgContext_ConnectionInfo sslInfo; 
    LONG lv = 0; 

    // Initialize an LDAP session using SSL. 
    pLdapConnection = ldap_sslinit("localhost",10636,1); 
    if (pLdapConnection == NULL) 
    { 
     printf("ldap_sslinit failed.\n"); 
     return -1; 
    } 

    // Specify version 3; the default is version 2. 
    printf("Setting Protocol version to 3.\n"); 
    returnCode = ldap_set_option(pLdapConnection, 
     LDAP_OPT_PROTOCOL_VERSION, 
     (void*)&version); 
    if (returnCode != LDAP_SUCCESS) 
     goto FatalExit; 

    // Verify that SSL is enabled on the connection. 
    printf("Checking if SSL is enabled\n"); 
    returnCode = ldap_get_option(pLdapConnection,LDAP_OPT_SSL,(void*)&lv); 
    if (returnCode != LDAP_SUCCESS) 
     goto FatalExit; 

    // If SSL is not enabled, enable it. 
    if ((void*)lv == LDAP_OPT_ON) 
     printf("SSL is enabled\n"); 
    else 
    { 
     printf("SSL not enabled.\n SSL being enabled...\n"); 
     returnCode = ldap_set_option(pLdapConnection,LDAP_OPT_SSL,LDAP_OPT_ON); 
     if (returnCode != LDAP_SUCCESS) 
      goto FatalExit; 
    } 

    // Connect to the server. 
    connectSuccess = ldap_connect(pLdapConnection, NULL); 

    if(connectSuccess == LDAP_SUCCESS) 
     printf("ldap_connect succeeded \n"); 
    else 
    { 
     printf("ldap_connect failed with 0x%x.\n",connectSuccess); 
     goto FatalExit; 
    } 

    // Bind with current credentials. 
    printf("Binding ...\n"); 
    returnCode = ldap_bind_s(pLdapConnection,NULL,NULL,LDAP_AUTH_NEGOTIATE); 
    if (returnCode != LDAP_SUCCESS) 
     goto FatalExit; 

    // Retrieve the SSL cipher strength. 
    printf("Getting SSL info\n"); 
    returnCode = ldap_get_option(pLdapConnection,LDAP_OPT_SSL_INFO,&sslInfo); 
    if (returnCode != LDAP_SUCCESS) 
     goto FatalExit; 

    printf("SSL cipher strength = %d bits\n",sslInfo.dwCipherStrength); 

    goto NormalExit; 

    // Perform cleanup. 
NormalExit: 
    if (pLdapConnection != NULL) 
     ldap_unbind_s(pLdapConnection); 
    return 0; 

    // Perform cleanup after an error. 
FatalExit: 
    if(pLdapConnection != NULL) 
     ldap_unbind_s(pLdapConnection); 
    printf("\n\nERROR: 0x%x\n", returnCode); 
    return returnCode; 
}

設置完成後ldap_set_option(pLdapConnection,LDAP_OPT_SSL,LDAP_OPT_ON);，應用程序仍然無法設置該選項。因此，連接失敗，返回代碼爲LDAP_SERVER_DOWN。

有人可以指出爲什麼它無法設置選項？服務器確實支持ldaps://連接。

UPDATE： 當我做ldapsearch的LDAP服務器

ldapsearch -x -H ldaps://localhost -p 10636 -d 1

上我得到了錯誤：

ldap_url_parse_ext(ldaps://localhost:10636) 
ldap_create 
ldap_url_parse_ext(ldaps://localhost:10636/??base) 
ldap_sasl_bind 
ldap_send_initial_request 
ldap_new_connection 1 1 0 
ldap_int_open_connection 
ldap_connect_to_host: TCP localhost:10636 
ldap_new_socket: 472 
ldap_prepare_socket: 472 
ldap_connect_to_host: Trying ::1 10636 
ldap_pvt_connect: fd: 472 tm: -1 async: 0 
attempting to connect: 
connect errno: 10061 
ldap_close_socket: 472 
ldap_new_socket: 472 
ldap_prepare_socket: 472 
ldap_connect_to_host: Trying 127.0.0.1:10636 
ldap_pvt_connect: fd: 472 tm: -1 async: 0 
attempting to connect: 
connect success 
TLS trace: SSL_connect:before/connect initialization 
TLS trace: SSL_connect:SSLv2/v3 write client hello A 
TLS trace: SSL_connect:SSLv3 read server hello A 
TLS certificate verification: depth: 0, err: 18, subject: /C=US/O=ASF/OU=ApacheD 
S/CN=zanzibar, issuer: /C=US/O=ASF/OU=ApacheDS/CN=zanzibar 
TLS certificate verification: Error, self signed certificate 
TLS trace: SSL3 alert write:fatal:unknown CA 
TLS trace: SSL_connect:error in SSLv3 read server certificate B 
TLS trace: SSL_connect:error in SSLv3 read server certificate B 
TLS: can't connect: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:cert 
ificate verify failed (self signed certificate). 
ldap_err2string 
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

然而，加入「TLS_REQCERT從來沒有」到ldap.conf的一切開始後，加工。現在， 如何讓我的示例程序跳過「TLS證書驗證」？

來源

2013-05-14 Ashwin kumar

驗證服務器是否能夠接受SSL連接：1.使用'openssl s_client -connect host：port' 2.使用已知好的工具，例如'ldapsearch'，嘗試使用爲安全指定的端口連接服務器連接。 – 2013-05-14 11:19:22

謝謝。由於證書驗證失敗，ldapsearch也不起作用。我正在更新我的帖子以獲得更多詳細信息 – 2013-05-15 09:44:50

-1

嘗試以下環境變量傳遞給你的代碼：

LDAPTLS_REQCERT=never

忽略其可能過期或無效服務器證書。

來源

2014-01-17 16:31:10 kenorb

ldap_set_option（）不設置選項「LDAP_OPT_SSL」

回答

相關問題