https://bz.apache.org/bugzilla/show_bug.cgi?id=66490
Bug ID: 66490 Summary: ldap_simple_bind fails with "Can't contact LDAP server" when using ldaps on OpenLDAP Product: Apache httpd-2 Version: 2.4.54 Hardware: PC OS: Linux Status: NEW Severity: normal Priority: P2 Component: mod_authnz_ldap Assignee: bugs@httpd.apache.org Reporter: apa...@kyoshiro.org Target Milestone: --- Hi, When enabling ldaps for basic auth on a virtual host, I get these errors: [Sat Feb 25 15:41:29.574636 2023] [authnz_ldap:debug] [pid 96357:tid 123171499845376] mod_authnz_ldap.c(548): [client 10.0.0.12:54546] AH01691: auth_ldap authenticate: using URL ldaps://ldap.hostname/ou=users,dc=domain,dc=org?uid?sub?(objectClass=posixAccount) [Sat Feb 25 15:41:29.612716 2023] [authnz_ldap:info] [pid 96357:tid 123171499845376] [client 10.0.0.12:54546] AH01695: auth_ldap authenticate: user REDACTED authentication failed; URI / [LDAP: ldap_simple_bind() failed][Can't contact LDAP server] This is the config snippet: <Location /> AuthBasicProvider ldap AuthLDAPURL ldaps://ldap.hostname/ou=users,dc=domain,dc=org?uid?sub?(objectClass=posixAccount) #AuthLDAPRemoteUserAttribute cn AuthLDAPInitialBindAsUser on AuthLDAPInitialBindPattern (.+) cn=$1,ou=users,dc=domain,dc=org Require valid-user </Location> When I use ldap:// scheme instead of ldaps, it works as expected. The hostname ldap.hostname is defined in /etc/hosts and resolves to 127.0.0.1. When I try to connect locally with ldapsearch using ldaps:// URI it works too, be it with ldaps://ldap.hostname/ or ldaps://127.0.0.1/ $ ldapsearch -H ldaps://ldap.hostname/ -b "ou=users,dc=domain,dc=org" -D "cn=webserver,ou=users,dc=domain,dc=org" -W "(objectClass=posixAccount)" ... # search result search: 3 result: 0 Success When stracing the Apache processes, I see a few occurrences of these: [pid 96407] connect(45, {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress) [pid 96407] poll([{fd=45, events=POLLOUT|POLLERR|POLLHUP}], 1, 10000) = 1 ([{fd=45, revents=POLLOUT}]) [pid 96407] getpeername(45, {sa_family=AF_INET, sin_port=htons(636), sin_addr=inet_addr("127.0.0.1")}, [128->16]) = 0 [pid 96407] fcntl(45, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) [pid 96407] fcntl(45, F_SETFL, O_RDWR) = 0 [pid 96407] shutdown(45, SHUT_RDWR) = 0 [pid 96407] close(45) = 0 I'm using Debian version 2.4.54-1~deb11u1 of Apache2 server. Any ideas on what I could have missed here? Thank you! -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org For additional commands, e-mail: bugs-h...@httpd.apache.org