SethG's questions

This is related to the question I asked last week. The issue is that suddenly, my apache server was unable to connect to my LDAP (Active Directory) server for sites that require authentication. After much digging, I discovered that the SSL certificate for the LDAP/AD server expired when this happened. I have been trying to create a new SSL cert for the LDAP/AD server and installing that on the apache server and have been having no luck. At this point, I need someone who can go through the process for me step-by-step as it would appear I am missing something fundamental in making this all work.

At this point, I can't even get an LDAP connection from apache (using mod_ldap) even without SSL.

I have been using openldap both on the Windows server (LDAP/AD host) and the linux apache server, creating certs on both sides to no avail. I can't seem to get what I need from docs I've found online and just need a simple howto to make this all work. Anything that will help me make sense of this mess would be greatly appreciated.

Thanks. Seth

Suddenly, yesterday, one of my apache servers became unable to connect to my LDAP (AD) server. I have two sites running on that server, both of which use LDAP to auth against my AD server when a user logs in to either site. It had been working fine two days ago. For reasons unknown, as of yesterday, it stopped working. The error log only says this:

auth_ldap authenticate: user foo authentication failed; URI /FrontPage [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server], referer: http://mysite.com/

I thought perhaps my self-signed SSL cert had expired, so I created a new one for mysite.com, but not for the server hostname itself, and the problem persisted. I enabled debug-level logging. It shows the full SSL transaction with the LDAP server, and it appears to complete without errors until the very end when I get the "Can't contact LDAP server" message. I can run ldapsearch from the commandline on this server, and I can login to it, which also uses LDAP, so I know that the server can connect to and query the LDAP/AD server. It is only apache that cannot connect.

Googling for an answer has turned up nothing, so I'm asking here. Can anybody provide insight to this problem?

Here's the LDAP section from the apache config:

<Directory "/web/wiki/">
    Order allow,deny
    Allow from all
    AuthType Basic
    AuthName "Login"
    AuthBasicProvider ldap
    AuthzLDAPAuthoritative off
    #AuthBasicAuthoritative off
    AuthLDAPUrl ldaps://domain.server.ip/dc=full,dc=context,dc=server,dc=name?sAMAccountName?sub
    AuthLDAPBindDN cn=ldapbinduser,cn=Users,dc=full,dc=context,dc=server,dc=name
    AuthLDAPBindPassword password
    require valid-user
</Directory>

I am using LDAP+kerberos to authenticate against Active Directory on Windows 2003 R2. My krb5.conf and ldap.conf appear to be correct (according to pretty much every sample I found on the 'net). I can login to the host with both password and ssh keys. When I run getent passwd, all my ldap user accounts are listed with all the important attributes. When I run getent group, all the ldap groups and their gid's are listed, but no group members. If I run ldapsearch and filter on any group, the members are all listed with the "member" attribute. So the data is there for the taking, it's just not being parsed properly. It would appear that I simply am using an incorrect mapping in ldap.conf, but I can't see it. I've tried several variations and all give the same result.

Here is my current ldap.conf:

host <ad-host1-ip> <ad-host2-ip>
base dc=my,dc=full,dc=dn
uri ldap://<ad-host1> ldap://<ad-host2>
ldap_version 3
binddn <mybinddn>
bindpw <mybindpw>
scope sub
bind_policy hard 
nss_reconnect_tries 3
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 8
nss_reconnect_maxconntries 3
nss_map_objectclass posixAccount User
nss_map_objectclass posixGroup Group
nss_map_attribute uid sAMAccountName
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute cn cn
nss_map_attribute gecos displayName
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute uniqueMember member
pam_filter objectcategory=User
pam_login_attribute sAMAccountName
pam_member_attribute member
pam_password ad

Here's the kicker: this config works 100% fine on a different linux box with a different distro. It does not work on the distro I am planning on switching to. I have installed from source the versions of pam_ldap and nss_ldap on the new box to match the old box, which fixed another problem I was having with this setup.

Other relevant info is the original AD box was Windows 2003. It's mirror died a horrible hardware death so I'm trying to add two more 2003-R2 servers to the mirror tree and ultimately drop the old 2003 box. The new R2 boxes appear to have joined the DC forest properly.

What do I need to do to get groups working? I've exhausted all the resources I could find and need a different angle. Any input is appreciated.

Status update, 7/31/09

I have managed to tweak my config file to get full info from the AD and performance is nice and snappy. I replaced the back-rev'd copies of pam_ldap and nss_ldap with the current ones for the distro I'm using, so it's back to a standard out-of-the-box install. Here's my current config:

host <ad-host1-ip> <ad-host2-ip>
base dc=my,dc=full,dc=dn
uri ldap://<ad-host1> ldap://<ad-host2>
ldap_version 3
binddn <mybinddn>
bindpw <mybindpw>
scope sub
bind_policy soft 
nss_reconnect_tries 3
nss_reconnect_sleeptime 1
nss_reconnect_maxsleeptime 8
nss_reconnect_maxconntries 3
nss_connect_policy oneshot
referrals no
nss_map_objectclass posixAccount User
nss_map_objectclass posixGroup Group
nss_map_attribute uid sAMAccountName
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute cn cn
nss_map_attribute gecos displayName
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute uniqueMember member
pam_filter objectcategory=CN=Person,CN=Schema,CN=Configuration,DC=w2k,DC=cis,DC=ksu,DC=edu
pam_login_attribute sAMAccountName
pam_member_attribute member
pam_password ad
ssl off
tls_checkpeer no
sasl_secprops maxssf=0

The remaining problem now is when you run the groups command, not all subscribed groups are listed. Some are (one or two), but not all. Group memberships are still honored, such as file and printer access. getent group foo still shows that the user is a member of group foo. So it appears to be a presentation bug, and does not interfere with normal operation.

It also appears that some (I have not determined exactly how many) group searches do not resolve correctly, even though the group is listed. eg, when you run "getent group bar", nothing is returned, but if you run "getent group|grep bar" or "getent group|grep <bar_gid>" you can see that it indeed listed and your group name and gid are correct.

This still seems like an LDAP search or mapping error, but I can't figure out what it is. I'm a heckuva lot closer than earlier in the week, but I'd really like to get this last detail ironed out.