Hi, I've found a strange behaviour of python-ldap when working with TLS encrypted connections. I'm not sure if this is a problem of the python bindings or of libldap or in my head ;-)
In my first scenario I was trying to set up a TLS encrypted connection with a specific CA certificate that was set in the ldap.conf file (TLS_CACERT). >>> import ldap >>> l = ldap.ldapobject.SmartLDAPObject(uri='LDAP://qamaster.windom2008.univention.test:389', who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', start_tls=2, tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem') >>> l.started_tls 0 In that case the connection is not encrypted. When I replace LDAP:// with ldap:// in the URI the connection is encrypted. >>> l = ldap.ldapobject.SmartLDAPObject(uri='ldap://qamaster.windom2008.univention.test:389', who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', start_tls=2, tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem') >>> l.started_tls 1 It look likes a TLS connection is not set up if the URI starts with LDAP:// In the second scenario I've tried to set up a TLS encrypted connection with a CA certificate that was not set in the ldap.conf file. >>> l = ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univention.test:389', who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', start_tls=2, tls_cacertfile='/etc/univention/connector/ad/ad_cert_20091221_153053.pem') ... ldap.CONNECT_ERROR: {'info': 'error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed', 'desc': 'Connect error'} It seems that the argument tls_cacertfile is ignored, because if I set the CA certificate file with the set_option function the connection works and is encrypted. ldap.set_option( ldap.OPT_X_TLS_CACERTFILE, '/etc/univention/connector/ad/ad_cert_20091221_153053.pem' ) l = ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univention.test:389', who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', start_tls=2 ) >>> l.started_tls 1 software versions: python 2.4.6 libldap 2.4.15 python-ldap 2.3.5 Is there any mistake in my reasoning or is this a known behaviour? best regards Andreas -- Andreas Büsching Open Source Software Engineer Univention GmbH Linux for your business Mary-Somerville-Str.1 28359 Bremen Tel. : +49 421 22232-0 Fax : +49 421 22232-99 <buesch...@univention.de> http://www.univention.de Geschäftsführer: Peter H. Ganten HRB 20755 Amtsgericht Bremen Steuer-Nr.: 71-597-02876
signature.asc
Description: This is a digitally signed message part.
------------------------------------------------------------------------------ This SF.Net email is sponsored by the Verizon Developer Community Take advantage of Verizon's best-in-class app development support A streamlined, 14 day to market process makes app distribution fast and easy Join now and get one step closer to millions of Verizon customers http://p.sf.net/sfu/verizon-dev2dev
_______________________________________________ Python-LDAP-dev mailing list Python-LDAP-dev@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
