SSL and AD

[geert.van.muylem at utimaco.be]

Hi,


I'm trying to use python-ldap to make an ssl connection to an Active 
Directory (2000)
However I get always the server down error...
It seems to fail at client authentication at the end....

Can anyone help?

Thanks,

Geert

Here is my code:

import sys,ldap

def ConnectSSL():

    ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
    ldapmodule_trace_level = 1
    ldapmodule_trace_file = sys.stderr

    # Set path name of file containing all CA certificates
    # needed to validate server certificates
 
ldap.set_option(ldap.OPT_X_TLS_CACERTFILE,'/home/gvm/Temp/PYSSL/rootca.pem')
    ldap.set_option(ldap.OPT_X_TLS_CERTFILE, 
'/home/gvm/Temp/PYSSL/endor-crt.pem')
 
ldap.set_option(ldap.OPT_X_TLS_KEYFILE,'/home/gvm/Temp/PYSSL/endor-key.pem')
 
    # Set LDAP protocol version used
    ldap.protocol_version=ldap.VERSION3

    lconn=ldap.initialize("ldaps://eowyn.doom.be/")
    lconn.simple_bind_s ('Administrator at doom.be','system')
    lconn.unbind_s()

Here is the trace output:

ldap_create
ldap_url_parse_ext(ldaps://eowyn.doom.be/)
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP eowyn.doom.be:636
ldap_new_socket: 5
ldap_prepare_socket: 5
ldap_connect_to_host: Trying 192.168.1.5:636
ldap_connect_timeout: fd: 5 tm: -1 async: 0
TLS trace: SSL_connect:before/connect initialization
TLS trace: SSL_connect:SSLv2/v3 write client hello A
TLS trace: SSL_connect:SSLv3 read server hello A
TLS certificate verification: depth: 1, err: 0, subject: 
/C=BE/L=Hoogstraten/O=CATrust/OU=PKI/CN=CAS_SK, issuer: 
/C=BE/L=Hoogstraten/O=CATrust/OU=PKI/CN=CAS_SK
TLS certificate verification: depth: 0, err: 0, subject: 
/C=BE/L=Hoogstraten/O=CATrust/OU=PKI/CN=eowyn.doom.be, issuer: 
/C=BE/L=Hoogstraten/O=CATrust/OU=PKI/CN=CAS_SK
TLS trace: SSL_connect:SSLv3 read server certificate A
TLS trace: SSL_connect:SSLv3 read server certificate request A
TLS trace: SSL_connect:SSLv3 read server done A
TLS trace: SSL_connect:SSLv3 write client certificate A
TLS trace: SSL_connect:SSLv3 write client key exchange A
TLS trace: SSL_connect:SSLv3 write certificate verify A
TLS trace: SSL_connect:SSLv3 write change cipher spec A
TLS trace: SSL_connect:SSLv3 write finished A
TLS trace: SSL_connect:SSLv3 flush data
TLS trace: SSL_connect:failed in SSLv3 read finished A
TLS: can't connect.
ldap_err2string
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "PySSL.py", line 46, in ConnectSSL
    lconn.simple_bind_s ('Administrator at doom.be','system')
  File "/usr/lib/python2.4/site-packages/ldap/ldapobject.py", line 175, in 
simple_bind_s
    msgid = self.simple_bind(who,cred,serverctrls,clientctrls)
  File "/usr/lib/python2.4/site-packages/ldap/ldapobject.py", line 169, in 
simple_bind
    return 
self._ldap_call(self._l.simple_bind,who,cred,EncodeControlTuples(serverctrls),EncodeControlTuples(clientctrls))
  File "/usr/lib/python2.4/site-packages/ldap/ldapobject.py", line 94, in 
_ldap_call
    result = func(*args,**kwargs)
ldap.SERVER_DOWN: {'desc': "Can't contact LDAP server"}
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20061017/9d607aab/attachment.html>