Tuesday, May 25, 2010

ldap_sasl_bind_s failed

On syncrepl consumer:

May 25 09:46:27 ldap01-vm slapd2.4[19787]: slap_client_connect: URI=ldaps://ldap04c1-vm.yahweh.net DN="uid=slaveuser,cn=special,o=yahweh" ldap_sasl_bind_s failed (-1)

On syncrepl provider:

May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: slap_listener_activate(8):
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: >>> slap_listener(ldaps:///)
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: conn=1091 fd=15 ACCEPT from IP=10.5.0.35:36495 (IP=0.0.0.0:636)
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_get(15)
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_get(15): got connid=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_read(15): checking for input on id=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_get(15)
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_get(15): got connid=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_read(15): checking for input on id=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_read(15): unable to get TLS client DN, error=49 id=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: conn=1091 fd=15 TLS established tls_ssf=256 ssf=256
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_get(15)
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_get(15): got connid=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_read(15): checking for input on id=1091
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: ber_get_next on fd 15 failed errno=0 (Success)
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: connection_close: conn=1091 sd=15
May 21 14:05:06 ldap04c1-vm slapd2.4[25213]: conn=1091 fd=15 closed (connection lost)
May 21 14:05:12 ldap04c1-vm slapd2.4[25213]: slap_listener_activate(8):
May 21 14:05:12 ldap04c1-vm slapd2.4[25213]: >>> slap_listener(ldaps:///)


Fix:

add tls_reqcert=never, to syncrepl directives on the consumer:

syncrepl rid=101
provider=ldaps://ldap04c1.yahweh.net
tls_reqcert=never

1 comment:

multifake said...

I'd prefer to have cert checks, so the question would be how to teach slapd about the CA cert in use.