Mailing List Archive: Apache: Users

LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD

Index | Next | Previous | View Threaded

sandro.tosi at register

Nov 2, 2009, 2:17 AM

Post #1 of 19 (1798 views)
Permalink

LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD

Hello,
we are enabling LDAP auth on our apache stack. Starting from
apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .

The configure line we used for apache is:

$ ./configure --prefix=/usr/local/apache --mandir=/path/to/man
--with-ssl=/path/to/openssl-0.9.8g-16052008 --enable-mods-shared=all
--enable-ssl --enable-so --with-ldap --enable-authnz-ldap --enable-ldap

and the one for php is:

./configure --prefix=/usr/local/php --mandir=/usr/local/php/man
--with-mysql=/path/to/mysql --with-apxs2=/usr/local/apache/bin/apxs
--with-oci8=/shared/oracle/OraHome1 --with-curl --with-mhash
--with-imap=/path/to/imap-2007b --with-openssl --with-gd --with-zlib
--with-ttf --with-t1lib --with-mcrypt=/path/to/libmcrypt
--enable-shared=max --enable-mbstring --enable-inline-optimization
--enable-magic-quotes --enable-sigchild --enable-soap
--enable-gd-native-ttf --with-jpeg-dir=/usr/lib --with-xpm-dir=/usr/lib
--with-png-dir=/usr/lib --with-freetype-dir=/usr/lib

Build and install went fine.

We also installed openldap-client-2.3.27 and set "TLS_REQCERT never"
into /etc/openldap/ldap.conf .

And now starts the problem :( We configured httpd.conf to contain

LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
...
LDAPVerifyServerCert Off

Then we set a dir with .htaccess similar to this:

AuthType Basic
AuthName "<name>"
AuthBasicProvider ldap
AuthzLDAPAuthoritative Off
AuthLDAPBindDN uid=<uid>,ou=<ou>,ou=<ou>,dc=<dc>,dc=<dc>
AuthLDAPBindPassword <pwd>
AuthLDAPURL ldaps://<address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
require valid-user

If I then try to access a page under that .htaccess, then I'm prompted
for username and password, but then I'm redirected to a 500 page and in
error.log I can read

[Mon Nov 02 10:59:38 2009] [warn] [client 127.0.0.1] [10522] auth_ldap
authenticate: user stosi authentication failed; URI /index.html [LDAP:
ldap_set_option failed. Could not set LDAP_OPT_X_TLS to
LDAP_OPT_X_TLS_HARD][Operations error]

We are stuck in this situation since days :( we searched the internet
for the above error message, but except for a couple of posts on
issues.apache.org (that don't help) there is nothing else but complains
about how obscure that error is.

I think there's something related to SSL and how recent apache (it seems
from 2.2.12?) handle it: in fact, we had to move SSLCertificateFile into
httpd.conf and set explicitly "SSLEngine On" where needed (while before
it was a bit implicitly).

I appreciate any help, cause we are out of any idea on how to move on.

Regards,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Emmanuel.Bailleul at telindus

Nov 2, 2009, 2:38 AM

Post #2 of 19 (1758 views)
Permalink

RE: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

> -----Message d'origine-----
> De : Sandro Tosi [mailto:sandro.tosi [at] register]
> Envoyé : lundi 2 novembre 2009 11:17
> À : users [at] httpd
> Objet : [users [at] http] LDAP: ldap_set_option failed. Could not set
> LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD
>
> Hello,
> we are enabling LDAP auth on our apache stack. Starting from
> apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
>
> The configure line we used for apache is:
>
> $ ./configure --prefix=/usr/local/apache --mandir=/path/to/man
> --with-ssl=/path/to/openssl-0.9.8g-16052008 --enable-mods-shared=all
> --enable-ssl --enable-so --with-ldap --enable-authnz-ldap --enable-ldap
>
> and the one for php is:
>
> ./configure --prefix=/usr/local/php --mandir=/usr/local/php/man
> --with-mysql=/path/to/mysql --with-apxs2=/usr/local/apache/bin/apxs
> --with-oci8=/shared/oracle/OraHome1 --with-curl --with-mhash
> --with-imap=/path/to/imap-2007b --with-openssl --with-gd --with-zlib
> --with-ttf --with-t1lib --with-mcrypt=/path/to/libmcrypt
> --enable-shared=max --enable-mbstring --enable-inline-optimization
> --enable-magic-quotes --enable-sigchild --enable-soap
> --enable-gd-native-ttf --with-jpeg-dir=/usr/lib --with-xpm-dir=/usr/lib
> --with-png-dir=/usr/lib --with-freetype-dir=/usr/lib
>
> Build and install went fine.
>
> We also installed openldap-client-2.3.27 and set "TLS_REQCERT never"
> into /etc/openldap/ldap.conf .
>
> And now starts the problem :( We configured httpd.conf to contain
>
> LoadModule ldap_module modules/mod_ldap.so
> LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
> ...
> LDAPVerifyServerCert Off
>
> Then we set a dir with .htaccess similar to this:
>
> AuthType Basic
> AuthName "<name>"
> AuthBasicProvider ldap
> AuthzLDAPAuthoritative Off
> AuthLDAPBindDN uid=<uid>,ou=<ou>,ou=<ou>,dc=<dc>,dc=<dc>
> AuthLDAPBindPassword <pwd>
> AuthLDAPURL ldaps://<address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
> require valid-user
>
> If I then try to access a page under that .htaccess, then I'm prompted
> for username and password, but then I'm redirected to a 500 page and in
> error.log I can read
>
> [Mon Nov 02 10:59:38 2009] [warn] [client 127.0.0.1] [10522] auth_ldap
> authenticate: user stosi authentication failed; URI /index.html [.LDAP:
> ldap_set_option failed. Could not set LDAP_OPT_X_TLS to
> LDAP_OPT_X_TLS_HARD][Operations error]
>
> We are stuck in this situation since days :( we searched the internet
> for the above error message, but except for a couple of posts on
> issues.apache.org (that don't help) there is nothing else but complains
> about how obscure that error is.
>
> I think there's something related to SSL and how recent apache (it
> seems
> from 2.2.12?) handle it: in fact, we had to move SSLCertificateFile
> into
> httpd.conf and set explicitly "SSLEngine On" where needed (while before
> it was a bit implicitly).
>
> I appreciate any help, cause we are out of any idea on how to move on.
>
> Regards,
> Sandro
>

Hi,

Did you try your LDAPS connection with ldapsearch first ? (sth like ldapsearch -H <ldaps url> -x ...).
An important thing : when calling your ldap server, do use the resolved name rather than the IP. You can even add it in your hosts file if needed.
Two other things :
- what king of ldap server are u using ?
- when building, are you sure you did not have several ssl toolkits/versions installed ? Can you confirm httpd has been built with the correct one (I just remember having made this mistake once and having to build with an option like "--with-ssl=<path-to-the-right-openssl-dir") ?

Regards.

Emmanuel

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 2, 2009, 3:01 AM

Post #3 of 19 (1727 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Emmanuel Bailleul wrote:
> Hi,
>
> Did you try your LDAPS connection with ldapsearch first ? (sth like ldapsearch -H <ldaps url> -x ...).
>
Sorry I didn't mentioned: yes, I have tested, and with ldapsearch it
works fine (using the name address and not the IP address)
> An important thing : when calling your ldap server, do use the resolved name rather than the IP. You can even add it in your hosts file if needed.
>
I use the name address and not the IP address. Do you think that's the
problem? I think it doesn't even try to connect to the ldap server.
Anyhow, I gave it a try, and same error come.
> Two other things :
> - what king of ldap server are u using ?
>
it's "OpenLDAP server (slapd) version 2.4.11-1" (Debian Lenny).
> - when building, are you sure you did not have several ssl toolkits/versions installed ? Can you confirm httpd has been built with the correct one (I just remember having made this mistake once and having to build with an option like "--with-ssl=<path-to-the-right-openssl-dir") ?
I actually used "--with-ssl=/path/to/openssl-0.9.8g-16052008". But, hey,
now that I look at it, in the error.log I see:

[Mon Nov 02 11:26:54 2009] [info] mod_ssl/2.2.14 compiled against
Server: Apache/2.2.14, Library: OpenSSL/0.9.7e

WTH?! why is using 0.9.7e while I told him to link against 0.9.8g?

Infact

# strings modules/mod_ssl.so | grep '0.9.7' | wc -l
33

Could that be the problem? Any suggestion how to fix that? Other to look?

Thanks a lot,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Emmanuel.Bailleul at telindus

Nov 2, 2009, 3:09 AM

Post #4 of 19 (1724 views)
Permalink

RE: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

> -----Message d'origine-----
> De : Sandro Tosi [mailto:sandro.tosi [at] register]
> Envoyé : lundi 2 novembre 2009 12:01
> À : users [at] httpd
> Objet : Re: [users [at] http] LDAP: ldap_set_option failed. Could not set
> LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD
>
> Emmanuel Bailleul wrote:
> > Hi,
> >
> > Did you try your LDAPS connection with ldapsearch first ? (sth like
> ldapsearch -H <ldaps url> -x ...).
> >
> Sorry I didn't mentioned: yes, I have tested, and with ldapsearch it
> works fine (using the name address and not the IP address)
> > An important thing : when calling your ldap server, do use the
> resolved name rather than the IP. You can even add it in your hosts
> file if needed.
> >
> I use the name address and not the IP address. Do you think that's the
> problem? I think it doesn't even try to connect to the ldap server.
> Anyhow, I gave it a try, and same error come.
> > Two other things :
> > - what king of ldap server are u using ?
> >
> it's "OpenLDAP server (slapd) version 2.4.11-1" (Debian Lenny).
> > - when building, are you sure you did not have several ssl
> toolkits/versions installed ? Can you confirm httpd has been built with
> the correct one (I just remember having made this mistake once and
> having to build with an option like "--with-ssl=<path-to-the-right-
> openssl-dir") ?
> I actually used "--with-ssl=/path/to/openssl-0.9.8g-16052008". But,
> hey,
> now that I look at it, in the error.log I see:
>
> [Mon Nov 02 11:26:54 2009] [info] mod_ssl/2.2.14 compiled against
> Server: Apache/2.2.14, Library: OpenSSL/0.9.7e
>
> WTH?! why is using 0.9.7e while I told him to link against 0.9.8g?
>
> Infact
>
> # strings modules/mod_ssl.so | grep '0.9.7' | wc -l
> 33
>
> Could that be the problem? Any suggestion how to fix that? Other to
> look?
>
> Thanks a lot,
> Sandro
>

I don't think that how mod_ssl was built has anything to do with your ldaps problems, but as you could see in https://issues.apache.org/bugzilla/show_bug.cgi?id=41041 , the error you mentioned could clearly be due to different libs used at compile time and at run time. Maybe you could try to follow the suggestions described in this thread in order to recompile mod_authnz_ldap with the original openssl toolkit ?

Emmanuel

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 2, 2009, 5:21 AM

Post #5 of 19 (1726 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

> I don't think that how mod_ssl was built has anything to do with your ldaps problems, but as you could see in https://issues.apache.org/bugzilla/show_bug.cgi?id=41041 , the error you mentioned could clearly be due to different libs used at compile time and at run time. Maybe you could try to follow the suggestions described in this thread in order to recompile mod_authnz_ldap with the original openssl toolkit ?
>

I recompiled apache linking with OpenSSL 0.9.8g, and it claims it uses it:

[Mon Nov 02 13:51:47 2009] [notice] Apache/2.2.14 (Unix) mod_ssl/2.2.14
OpenSSL/0.9.8g configured

but the problem is still there :(

The post you mention (I've already raed it) is referring to Solaris
linker; I'm on Linux, and ld only knows of 0.9.8:

# ldconfig -p | grep -i libssl
libssl.so.0 (libc6) => /usr/lib/libssl.so.0
libssl.so (libc6) => /usr/lib/libssl.so

# ls -l /usr/lib/libssl.so.0
lrwxrwxrwx ... /usr/lib/libssl.so.0 -> libssl.so.0.9.8

What else can I do? Thanks a lot for the support :) ,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

covener at gmail

Nov 2, 2009, 5:41 AM

Post #6 of 19 (1716 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

> I think there's something related to SSL and how recent apache (it seems
> from 2.2.12?) handle it: in fact, we had to move SSLCertificateFile into
> httpd.conf and set explicitly "SSLEngine On" where needed (while before it
> was a bit implicitly).

This version is where SNI came in, but I have a hard time buying that
you never had "SSLEngine on" in any context.

Can you apply this patch and generate debugging info from the SDK?

http://people.apache.org/~covener/ldap_debug/

--
Eric Covener
covener [at] gmail

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 2, 2009, 5:58 AM

Post #7 of 19 (1726 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Eric Covener wrote:
>> I think there's something related to SSL and how recent apache (it seems
>> from 2.2.12?) handle it: in fact, we had to move SSLCertificateFile into
>> httpd.conf and set explicitly "SSLEngine On" where needed (while before it
>> was a bit implicitly).
>>
>
> This version is where SNI came in, but I have a hard time buying that
> you never had "SSLEngine on" in any context.
>
No no, we had them, but not in every context (at least one in each
config file, but not in each vhost that needs that).
> Can you apply this patch and generate debugging info from the SDK?
>
> http://people.apache.org/~covener/ldap_debug/
>
Thanks a lot for the patch! I applied (against 2.2.14 tarball code) it
but then apache fails to build:

make[4]: Entering directory `/path/to/src/httpd-2.2.14/modules/ldap'
/path/to/src/httpd-2.2.14/srclib/apr/libtool --silent --mode=compile gcc
-g -O2 -pthread -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE
-D_LARGEFILE64_SOURCE -I/path/to/src/httpd-2.2.14/srclib/pcre -I.
-I/path/to/src/httpd-2.2.14/os/unix
-I/path/to/src/httpd-2.2.14/server/mpm/prefork
-I/path/to/src/httpd-2.2.14/modules/http
-I/path/to/src/httpd-2.2.14/modules/filters
-I/path/to/src/httpd-2.2.14/modules/proxy
-I/path/to/src/httpd-2.2.14/include
-I/path/to/src/httpd-2.2.14/modules/generators
-I/path/to/src/httpd-2.2.14/modules/mappers
-I/path/to/src/httpd-2.2.14/modules/database
-I/path/to/src/httpd-2.2.14/srclib/apr/include
-I/path/to/src/httpd-2.2.14/srclib/apr-util/include
-I/path/to/src/httpd-2.2.14/server
-I/path/to/src/httpd-2.2.14/modules/proxy/../generators
-I/path/to/openssl-0.9.8g-16052008/include
-I/path/to/src/httpd-2.2.14/modules/ssl
-I/path/to/src/httpd-2.2.14/modules/dav/main -prefer-pic -c util_ldap.c
&& touch util_ldap.slo
util_ldap.c: In function 'util_ldap_merge_config':
util_ldap.c:1891: error: 'util_ldap_state_t' has no member named
'debug_level'
util_ldap.c:1891: error: 'util_ldap_state_t' has no member named
'debug_level'
util_ldap.c: In function 'util_ldap_post_config':
util_ldap.c:2053: error: 'util_ldap_state_t' has no member named
'debug_level'
util_ldap.c:2054: error: 'util_ldap_state_t' has no member named
'debug_level'
util_ldap.c:2058: error: 'util_ldap_state_t' has no member named
'debug_level'
util_ldap.c: In function 'util_ldap_set_debug_level':
util_ldap.c:2080: error: 'util_ldap_state_t' has no member named
'debug_level'
make[4]: *** [util_ldap.slo] Error 1
make[4]: Leaving directory `/path/to/src/httpd-2.2.14/modules/ldap'
make[3]: *** [shared-build-recursive] Error 1
make[3]: Leaving directory `/path/to/src/httpd-2.2.14/modules/ldap'
make[2]: *** [shared-build-recursive] Error 1
make[2]: Leaving directory `/path/to/src/httpd-2.2.14/modules'
make[1]: *** [shared-build-recursive] Error 1
make[1]: Leaving directory `/path/to/src/httpd-2.2.14'
make: *** [all-recursive] Error 1

Thanks for your help,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

covener at gmail

Nov 2, 2009, 6:20 AM

Post #8 of 19 (1727 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

> util_ldap.c:1891: error: 'util_ldap_state_t' has no member named
> 'debug_level'

I probably missed a file in the 2.2.x diff, will followup here when
patch is updated.

--
Eric Covener
covener [at] gmail

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

covener at gmail

Nov 2, 2009, 6:23 AM

Post #9 of 19 (1730 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

On Mon, Nov 2, 2009 at 9:20 AM, Eric Covener <covener [at] gmail> wrote:
>> util_ldap.c:1891: error: 'util_ldap_state_t' has no member named
>> 'debug_level'
>
> I probably missed a file in the 2.2.x diff, will followup here when
> patch is updated.

updated at http://people.apache.org/~covener/ldap_debug/2.2.x-ldap_debug-2.diff

--
Eric Covener
covener [at] gmail

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 2, 2009, 7:14 AM

Post #10 of 19 (1726 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Eric Covener wrote:
> On Mon, Nov 2, 2009 at 9:20 AM, Eric Covener <covener [at] gmail> wrote:
>
>>> util_ldap.c:1891: error: 'util_ldap_state_t' has no member named
>>> 'debug_level'
>>>
>> I probably missed a file in the 2.2.x diff, will followup here when
>> patch is updated.
>>
>
>
> updated at http://people.apache.org/~covener/ldap_debug/2.2.x-ldap_debug-2.diff
>
>
Yeah, I was looking at util_ldap.h right when you sent the updated patch :)

Apache builds fine this time, but the info doesn't seems much more
verbose than before (with debug level on):

[Mon Nov 02 15:50:12 2009] [debug] mod_authnz_ldap.c(972): [14305]
auth_ldap url parse: `ldaps://<LDAP server IP
address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)', Host: <LDAP server IP
address>, Port: 636, DN: dc=<dc>,dc=<dc>, attrib: uid, scope: subtree,
filter: (objectClass=*), connection mode: using SSL
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(972): [14309]
auth_ldap url parse: `ldaps://<LDAP server IP
address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)', Host: <LDAP server IP
address>, Port: 636, DN: dc=<dc>,dc=<dc>, attrib: uid, scope: subtree,
filter: (objectClass=*), connection mode: using SSL
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [debug] mod_authnz_ldap.c(377): [client
127.0.0.1] [14309] auth_ldap authenticate: using URL ldaps://<LDAP
server IP address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
[Mon Nov 02 15:50:19 2009] [warn] [client 127.0.0.1] [14309] auth_ldap
authenticate: user <my LDAP user> authentication failed; URI /index.html
[LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to
LDAP_OPT_X_TLS_HARD][Operations error]

Should I enable something in openssl? We configured it with
"--prefix=/path/to/openssl-0.9.8g-16052008 linux-elf".

Thanks again for the support,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

covener at gmail

Nov 2, 2009, 7:19 AM

Post #11 of 19 (1722 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

On Mon, Nov 2, 2009 at 10:14 AM, Sandro Tosi <sandro.tosi [at] register> wrote:
> Apache builds fine this time, but the info doesn't seems much more verbose
> than before (with debug level on):

Did you set the directive mentioned in the HTML and check your main
server errorlog?

--
Eric Covener
covener [at] gmail

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 2, 2009, 7:50 AM

Post #12 of 19 (1728 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Eric Covener wrote:
> On Mon, Nov 2, 2009 at 10:14 AM, Sandro Tosi <sandro.tosi [at] register> wrote:
>
>> Apache builds fine this time, but the info doesn't seems much more verbose
>> than before (with debug level on):
>>
>
> Did you set the directive mentioned in the HTML and check your main
> server errorlog?
>
Yeah, sorry I didn't mentioned that, I enabled that option in httpd.conf
(while the vhost I'm using in another config file).

In the main error.log I can see several

[Mon Nov 02 16:25:41 2009] [debug] util_ldap.c(1995): LDAP merging
Shared Cache conf: shm=0x811b0f8 rmm=0x811b128 for VHOST: localhost

one for each vhost, and then this

[Mon Nov 02 16:25:41 2009] [info] APR LDAP: Built with OpenLDAP LDAP SDK
[Mon Nov 02 16:25:41 2009] [info] LDAP: SSL support available
[Mon Nov 02 16:25:41 2009] [notice] Apache/2.2.14 (Unix) mod_ssl/2.2.14
OpenSSL/0.9.8g configured -- resuming normal operations
[Mon Nov 02 16:25:41 2009] [info] Server built: Nov 2 2009 15:32:03
[Mon Nov 02 16:25:41 2009] [debug] prefork.c(1013): AcceptMutex: sysvsem
(default: sysvsem)

Nothing else LDAP related, not even when getting the 500.

Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 4, 2009, 12:31 AM

Post #13 of 19 (1672 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Hello Eric (and others),
do you have any other ideas about what I can look or test about this
issue? I'm really out of ideas and I don't know what else to do.

Thanks a lot in advance,
Sandro

Sandro Tosi wrote:
> Eric Covener wrote:
>
>> On Mon, Nov 2, 2009 at 10:14 AM, Sandro Tosi <sandro.tosi [at] register> wrote:
>>
>>
>>> Apache builds fine this time, but the info doesn't seems much more verbose
>>> than before (with debug level on):
>>>
>>>
>> Did you set the directive mentioned in the HTML and check your main
>> server errorlog?
>>
>>
> Yeah, sorry I didn't mentioned that, I enabled that option in httpd.conf
> (while the vhost I'm using in another config file).
>
> In the main error.log I can see several
>
> [Mon Nov 02 16:25:41 2009] [debug] util_ldap.c(1995): LDAP merging
> Shared Cache conf: shm=0x811b0f8 rmm=0x811b128 for VHOST: localhost
>
> one for each vhost, and then this
>
> [Mon Nov 02 16:25:41 2009] [info] APR LDAP: Built with OpenLDAP LDAP SDK
> [Mon Nov 02 16:25:41 2009] [info] LDAP: SSL support available
> [Mon Nov 02 16:25:41 2009] [notice] Apache/2.2.14 (Unix) mod_ssl/2.2.14
> OpenSSL/0.9.8g configured -- resuming normal operations
> [Mon Nov 02 16:25:41 2009] [info] Server built: Nov 2 2009 15:32:03
> [Mon Nov 02 16:25:41 2009] [debug] prefork.c(1013): AcceptMutex: sysvsem
> (default: sysvsem)
>
> Nothing else LDAP related, not even when getting the 500.
>
> Sandro
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd
>
>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 4, 2009, 6:45 AM

Post #14 of 19 (1669 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Sandro Tosi wrote:
> Hello,
> we are enabling LDAP auth on our apache stack. Starting from
> apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
>

Just to give more information in order to (hopefully) solve this, the
same problem happens also using apache 2.2.9 (recompiled to enable ldap
and authnz_ldap).

HTH,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

covener at gmail

Nov 4, 2009, 6:52 AM

Post #15 of 19 (1670 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

On Wed, Nov 4, 2009 at 9:45 AM, Sandro Tosi <sandro.tosi [at] register> wrote:
> Sandro Tosi wrote:
>>
>> Hello,
>> we are enabling LDAP auth on our apache stack. Starting from
>> apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
>>
>
> Just to give more information in order to (hopefully) solve this, the same
> problem happens also using apache 2.2.9 (recompiled to enable ldap and
> authnz_ldap).

Any chance your PHP is causing some other LDAP library to be loaded?
Same symptom without mod_php?

--
Eric Covener
covener [at] gmail

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 4, 2009, 7:19 AM

Post #16 of 19 (1682 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Eric Covener wrote:
> On Wed, Nov 4, 2009 at 9:45 AM, Sandro Tosi <sandro.tosi [at] register> wrote:
>
>> Sandro Tosi wrote:
>>
>>> Hello,
>>> we are enabling LDAP auth on our apache stack. Starting from
>>> apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
>>>
>>>
>> Just to give more information in order to (hopefully) solve this, the same
>> problem happens also using apache 2.2.9 (recompiled to enable ldap and
>> authnz_ldap).
>>
>
> Any chance your PHP is causing some other LDAP library to be loaded?
> Same symptom without mod_php?
>
Oh god you're right! removing the load of php from apache (and
commenting almost every virtualhost than default), LDAP auth is working!!

Now, running

# ldd modules/libphp5.so | egrep "ldap|ssl|sas"
libssl.so.0 => /usr/X11R6/lib/libssl.so.0 (0xb725d000)

and

# ldd modules/mod_ldap.so | egrep "ldap|ssl|sas"
libldap-2.3.so.0 => /usr/lib/libldap-2.3.so.0 (0xb804b000)
libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb7eb1000)
libssl.so.0 => /usr/lib/libssl.so.0 (0xb7e71000)

could the problem be the different libssl (and I really don't know why
they're different)? in particular because libphp is loaded _before_
mod_ldap ?

Regards,
Sandro

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 9, 2009, 2:58 AM

Post #17 of 19 (1500 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Hello Eric,
do you have some other suggestions on this topic? We're open to any
input or test you'd like us to do.

Thanks in advance,
Sandro

Sandro Tosi wrote:
> Eric Covener wrote:
>
>> On Wed, Nov 4, 2009 at 9:45 AM, Sandro Tosi <sandro.tosi [at] register> wrote:
>>
>>
>>> Sandro Tosi wrote:
>>>
>>>
>>>> Hello,
>>>> we are enabling LDAP auth on our apache stack. Starting from
>>>> apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
>>>>
>>>>
>>>>
>>> Just to give more information in order to (hopefully) solve this, the same
>>> problem happens also using apache 2.2.9 (recompiled to enable ldap and
>>> authnz_ldap).
>>>
>>>
>> Any chance your PHP is causing some other LDAP library to be loaded?
>> Same symptom without mod_php?
>>
>>
> Oh god you're right! removing the load of php from apache (and
> commenting almost every virtualhost than default), LDAP auth is working!!
>
> Now, running
>
> # ldd modules/libphp5.so | egrep "ldap|ssl|sas"
> libssl.so.0 => /usr/X11R6/lib/libssl.so.0 (0xb725d000)
>
> and
>
> # ldd modules/mod_ldap.so | egrep "ldap|ssl|sas"
> libldap-2.3.so.0 => /usr/lib/libldap-2.3.so.0 (0xb804b000)
> libsasl2.so.2 => /usr/lib/libsasl2.so.2 (0xb7eb1000)
> libssl.so.0 => /usr/lib/libssl.so.0 (0xb7e71000)
>
> could the problem be the different libssl (and I really don't know why
> they're different)? in particular because libphp is loaded _before_
> mod_ldap ?
>
> Regards,
> Sandro
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd
>
>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

sandro.tosi at register

Nov 13, 2009, 7:49 AM

Post #18 of 19 (1360 views)
Permalink

Re: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

Just to follow this up for people that might have the same problem: it
turns out it was because

- php was *not* compiled with ldap options
- php was loaded *before* mod_ldap and modp_authnz_ldap

A simple solution was to import mod_{authnz,}_ldap before php. The right
solution though is to add

--with-ldap-sasl --with-ldap

configure options to php. After that, in any order the above modules are
imported, apache and LDAP can communicate and authenticate users.

Thanks,
Sandro

Sandro Tosi wrote:
> Hello,
> we are enabling LDAP auth on our apache stack. Starting from
> apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
>
> The configure line we used for apache is:
>
> $ ./configure --prefix=/usr/local/apache --mandir=/path/to/man
> --with-ssl=/path/to/openssl-0.9.8g-16052008 --enable-mods-shared=all
> --enable-ssl --enable-so --with-ldap --enable-authnz-ldap --enable-ldap
>
> and the one for php is:
>
> ./configure --prefix=/usr/local/php --mandir=/usr/local/php/man
> --with-mysql=/path/to/mysql --with-apxs2=/usr/local/apache/bin/apxs
> --with-oci8=/shared/oracle/OraHome1 --with-curl --with-mhash
> --with-imap=/path/to/imap-2007b --with-openssl --with-gd --with-zlib
> --with-ttf --with-t1lib --with-mcrypt=/path/to/libmcrypt
> --enable-shared=max --enable-mbstring --enable-inline-optimization
> --enable-magic-quotes --enable-sigchild --enable-soap
> --enable-gd-native-ttf --with-jpeg-dir=/usr/lib --with-xpm-dir=/usr/lib
> --with-png-dir=/usr/lib --with-freetype-dir=/usr/lib
>
> Build and install went fine.
>
> We also installed openldap-client-2.3.27 and set "TLS_REQCERT never"
> into /etc/openldap/ldap.conf .
>
> And now starts the problem :( We configured httpd.conf to contain
>
> LoadModule ldap_module modules/mod_ldap.so
> LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
> ...
> LDAPVerifyServerCert Off
>
> Then we set a dir with .htaccess similar to this:
>
> AuthType Basic
> AuthName "<name>"
> AuthBasicProvider ldap
> AuthzLDAPAuthoritative Off
> AuthLDAPBindDN uid=<uid>,ou=<ou>,ou=<ou>,dc=<dc>,dc=<dc>
> AuthLDAPBindPassword <pwd>
> AuthLDAPURL ldaps://<address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
> require valid-user
>
> If I then try to access a page under that .htaccess, then I'm prompted
> for username and password, but then I'm redirected to a 500 page and in
> error.log I can read
>
> [Mon Nov 02 10:59:38 2009] [warn] [client 127.0.0.1] [10522] auth_ldap
> authenticate: user stosi authentication failed; URI /index.html [.LDAP:
> ldap_set_option failed. Could not set LDAP_OPT_X_TLS to
> LDAP_OPT_X_TLS_HARD][Operations error]
>
> We are stuck in this situation since days :( we searched the internet
> for the above error message, but except for a couple of posts on
> issues.apache.org (that don't help) there is nothing else but complains
> about how obscure that error is.
>
> I think there's something related to SSL and how recent apache (it seems
> from 2.2.12?) handle it: in fact, we had to move SSLCertificateFile into
> httpd.conf and set explicitly "SSLEngine On" where needed (while before
> it was a bit implicitly).
>
> I appreciate any help, cause we are out of any idea on how to move on.
>
> Regards,
> Sandro
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd
>
>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Emmanuel.Bailleul at telindus

Nov 13, 2009, 8:57 AM

Post #19 of 19 (1369 views)
Permalink

RE: LDAP: ldap_set_option failed. Could not set LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD [In reply to]

> -----Message d'origine-----
> De : Sandro Tosi [mailto:sandro.tosi [at] register]
> Envoyé : vendredi 13 novembre 2009 16:49
> À : users [at] httpd
> Objet : Re: [users [at] http] LDAP: ldap_set_option failed. Could not set
> LDAP_OPT_X_TLS to LDAP_OPT_X_TLS_HARD
>
> Just to follow this up for people that might have the same problem: it
> turns out it was because
>
> - php was *not* compiled with ldap options
> - php was loaded *before* mod_ldap and modp_authnz_ldap
>
> A simple solution was to import mod_{authnz,}_ldap before php. The right
> solution though is to add
>
> --with-ldap-sasl --with-ldap
>
> configure options to php. After that, in any order the above modules are
> imported, apache and LDAP can communicate and authenticate users.
>
> Thanks,
> Sandro
>
> Sandro Tosi wrote:
> > Hello,
> > we are enabling LDAP auth on our apache stack. Starting from
> > apache/2.2.9+php/5.2.8 we are upgrading to apache/2.2.14+php/5.2.11 .
> >
> > The configure line we used for apache is:
> >
> > $ ./configure --prefix=/usr/local/apache --mandir=/path/to/man
> > --with-ssl=/path/to/openssl-0.9.8g-16052008 --enable-mods-shared=all
> > --enable-ssl --enable-so --with-ldap --enable-authnz-ldap --enable-ldap
> >
> > and the one for php is:
> >
> > ./configure --prefix=/usr/local/php --mandir=/usr/local/php/man
> > --with-mysql=/path/to/mysql --with-apxs2=/usr/local/apache/bin/apxs
> > --with-oci8=/shared/oracle/OraHome1 --with-curl --with-mhash
> > --with-imap=/path/to/imap-2007b --with-openssl --with-gd --with-zlib
> > --with-ttf --with-t1lib --with-mcrypt=/path/to/libmcrypt
> > --enable-shared=max --enable-mbstring --enable-inline-optimization
> > --enable-magic-quotes --enable-sigchild --enable-soap
> > --enable-gd-native-ttf --with-jpeg-dir=/usr/lib --with-xpm-dir=/usr/lib
> > --with-png-dir=/usr/lib --with-freetype-dir=/usr/lib
> >
> > Build and install went fine.
> >
> > We also installed openldap-client-2.3.27 and set "TLS_REQCERT never"
> > into /etc/openldap/ldap.conf .
> >
> > And now starts the problem :( We configured httpd.conf to contain
> >
> > LoadModule ldap_module modules/mod_ldap.so
> > LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
> > ...
> > LDAPVerifyServerCert Off
> >
> > Then we set a dir with .htaccess similar to this:
> >
> > AuthType Basic
> > AuthName "<name>"
> > AuthBasicProvider ldap
> > AuthzLDAPAuthoritative Off
> > AuthLDAPBindDN uid=<uid>,ou=<ou>,ou=<ou>,dc=<dc>,dc=<dc>
> > AuthLDAPBindPassword <pwd>
> > AuthLDAPURL ldaps://<address>/dc=<dc>,dc=<dc>?uid?sub?(objectClass=*)
> > require valid-user
> >
> > If I then try to access a page under that .htaccess, then I'm prompted
> > for username and password, but then I'm redirected to a 500 page and in
> > error.log I can read
> >
> > [Mon Nov 02 10:59:38 2009] [warn] [client 127.0.0.1] [10522] auth_ldap
> > authenticate: user stosi authentication failed; URI /index.html [.LDAP:
> > ldap_set_option failed. Could not set LDAP_OPT_X_TLS to
> > LDAP_OPT_X_TLS_HARD][Operations error]
> >
> > We are stuck in this situation since days :( we searched the internet
> > for the above error message, but except for a couple of posts on
> > issues.apache.org (that don't help) there is nothing else but complains
> > about how obscure that error is.
> >
> > I think there's something related to SSL and how recent apache (it seems
> > from 2.2.12?) handle it: in fact, we had to move SSLCertificateFile into
> > httpd.conf and set explicitly "SSLEngine On" where needed (while before
> > it was a bit implicitly).
> >
> > I appreciate any help, cause we are out of any idea on how to move on.
> >
> > Regards,
> > Sandro
> >
> > ---------------------------------------------------------------------
> > The official User-To-User support forum of the Apache HTTP Server
> Project.
> > See <URL:http://httpd.apache.org/userslist.html> for more info.
> > To unsubscribe, e-mail: users-unsubscribe [at] httpd
> > " from the digest: users-digest-unsubscribe [at] httpd
> > For additional commands, e-mail: users-help [at] httpd
> >
> >
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe [at] httpd
> " from the digest: users-digest-unsubscribe [at] httpd
> For additional commands, e-mail: users-help [at] httpd

Thanks for the feedback.

Emmanuel

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe [at] httpd
" from the digest: users-digest-unsubscribe [at] httpd
For additional commands, e-mail: users-help [at] httpd

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads