RE: [Evolution] LDAP with Auth

On Thu, 2003-02-13 at 02:13, Tony Earnshaw wrote:
ons, 2003-02-12 kl. 22:32 skrev Chris Toshok:

Perhaps someone could actually try to assist us in figuring out what is
wrong here. I'd like to continue to use EVO, but, I need access to my
company LDAP.

Hmm, I didn't receive this mail that Tony's responding to...  private

No, it was posted to the list. Had it been private, I'd have forwarded

Strange, I don't remember seeing it... *shrug*, not important.

Anyway, I investigated this a little the last time you (David) sent mail
about it back in December I think?  There wasn't much that could be
determined from my end here..  "openssl s_client" prints out the cert
fine, but ldapsearch hangs, just like evolution does.  The error the
wombat printed out was 0x55 (LDAP_TIMEOUT), which is the same behavior
as the command line tool.  This might be some failing with openssl, I
don't know.

ldapsearch should never hang, but return a result - whatever that is.
There's a list of errors in ldap.h as long as your arm to cope with all
ldap eventualities (not poorly configured DNS or the like, though).

In conditions where it's possible to induce a hang, ldapsearch will
*always* hang unless you give it an explicit timeout.  It defaults to
infinite wait.  but that doesn't matter, as it turns out in this
instance i was just being stupid and using -ZZ on the command line
instead of -H ldaps://....  I get the successful (but empty) search with

It's troubling that I have essentially the same set up here (SSL/TLS set
to Always, port set to 636 - I don't even allow connections on 389 on
this particular box) and it works fine for me.

We just call ldap_start_tls and hope for the

That bit made me smile :-) It's possible to debug in detail at the
server end, and if one's running Openldap clients like ldapsearch,
they can be run at the same debug levels as slapd.

yeah.  actually there's code in the ldap backend to enable debugging but
it doesn't appear to be working.  hrm..

My point with the above line was that we can't do all the nice stuff the
mailer can wrt self signed certs, popping up dialogs, asking for user
confirmation and all that.  There's no way we can recover from what the
ldap library considers to be a fatal error, or (as far as I can tell,
please correct me if I'm wrong) cause a connection to fail because of
what we/the user considers a fatal error.  We're stuck with the openldap
client lib's policy decisions.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]