Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to configure OpenLDAP on Ubuntu using the the Ubuntu server guide. I have enabled Start TLS with a certificate generated using my own CA certificate (since it is for internal use). I enforced Start TLS on the database using olcSecurity (set to tls=1). LDAP clients in general have no problem connecting it the server once I set the TLS_CACERT to the path of my CA certificate in /etc/ldap/ldap.conf, except for phpLDAPadmin. I have enabled TLS in phpLDAPadmin confiuguration (/etc/phpldapadmin/config.php):

$servers->setValue('server','tls',true);

phpLDAPadmin throws a bunch of errors (culled from the post-login page, posted at the end). Does anyone know how to get phpLDAPadmin to play nice with Start TLS, or allow an exception to it?

Errors:

Array
(
    [class] => N/A
    [function] => debug_dump
    [file] => /usr/share/phpldapadmin/lib/functions.php
    [line] => 700
    [debug] => Array
        (
            [Incoming MSG] => Array
                (
                    [title] => Could not start TLS. (My LDAP Server)
                    [body] => Error: Could not start TLS. Please check your LDAP server configuration.
                    [type] => error
                )

            [existing] => Array
                (
                    [0] => Array
                        (
                            [title] => Could not start TLS. (My LDAP Server)
                            [body] => Error: Could not start TLS. Please check your LDAP server configuration.
                            [type] => error
                        )

                    [1] => Array
                        (
                            [title] => Authenticate to server
                            [body] => Successfully logged into server.
                            [type] => info
                        )

                )

        )
)

PHP Debug Backtrace
File    /usr/share/phpldapadmin/lib/functions.php (444)
    Function    error (a:5:{i:0;s:22:"Redirect Loop Detected";i:1;s:4:"no...)
File    /usr/share/phpldapadmin/lib/functions.php (701)
    Function    debug_dump_backtrace (a:2:{i:0;s:22:"Redirect Loop Detected";i:1;b:1;})
File    /usr/share/phpldapadmin/lib/ds_ldap.php (560)
    Function    system_message (a:1:{i:0;a:3:{s:5:"title";s:37:"Could not start TL...)
File    /usr/share/phpldapadmin/lib/ds_ldap.php (186)
    Function    startTLS (a:1:{i:0;i:0;})
File    /usr/share/phpldapadmin/lib/ds_ldap.php (354)
    Function    connect (a:2:{i:0;s:4:"user";i:1;b:0;})
File    /usr/share/phpldapadmin/lib/ds_ldap.php (2104)
    Function    query (a:2:{i:0;a:5:{s:4:"base";s:26:"dc=cse,dc=iitb,dc=a...)
File    /usr/share/phpldapadmin/lib/ds_ldap.php (2028)
    Function    getDNAttrValues (a:3:{i:0;s:26:"dc=cse,dc=iitb,dc=ac,dc=in";i:1;N;i...)
File    /usr/share/phpldapadmin/lib/Tree.php (186)
    Function    getDNAttrValue (a:2:{i:0;s:26:"dc=cse,dc=iitb,dc=ac,dc=in";i:1;s:1...)
File    /usr/share/phpldapadmin/lib/Tree.php (62)
    Function    addEntry (a:1:{i:0;s:26:"dc=cse,dc=iitb,dc=ac,dc=in";})
File    /usr/share/phpldapadmin/lib/page.php (227)
    Function    getInstance (a:1:{i:0;i:1;})
File    /usr/share/phpldapadmin/lib/page.php (418)
    Function    tree (a:0:{})
File    /usr/share/phpldapadmin/htdocs/cmd.php (78)
    Function    display (a:0:{})

This was originally posted on Ask Ubuntu, but didn't receive any answers, and I figure that this problem is not about Ubuntu per se, so I am asking here.

share|improve this question

2 Answers 2

You have to edit the /etc/ldap/ldap.conf on the server and add

TLS_REQCERT never

This workaround is posted here How do I solve ldap_start_tls() “Unable to start TLS: Connect error” in PHP.

share|improve this answer
up vote 0 down vote accepted

I discovered that this was a case of PEBKAC. The TLS certificate had the hostname of the server, whereas I was setting localhost in phpLDAPadmin. The hostname mismatch was causing the errors.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.