[Openca-Users] LDAP problem

小锋黎 Tue, 13 Dec 2005 18:17:06 -0800

Hello everybody,
I have successfully installed CA and RA on two separate machines.Now I want to install LDAP on a third machine.I only have Openldap running on that machine, but not any Openca component such as LDAP. When I update the certificates to ldap server on RA, an error come with "There is no special DN specified" and "Connection refused by server".

In addition, the Openca-Guide said there are mainly two files needed configuration on RA.One is ldap.conf, the other is online.conf. But I can't find the online.conf in OPENCADIR/etc/servers/ yet.My Openca version is 0.9.2.4.

My questions are: Should I have to install any Openca component such as the ldap module on the LDAP server? What's the problem with the error I specified above? Where is the online.conf, is it important to the ldap configuration?

My configuration is as follows(if needed):

=======================================

ldap.conf on ldap server

BASE o=security_lab,c=CN

=======================================

slapd.conf on ldap server

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /usr/local/openldap/etc/openldap/schema/core.schema
include         /usr/local/openldap/etc/openldap/schema/corba.schema
include         /usr/local/openldap/etc/openldap/schema/cosine.schema
include        /usr/local/openldap/etc/openldap/schema/inetorgperson.schema
include         /usr/local/openldap/etc/openldap/schema/misc.schema
include         /usr/local/openldap/etc/openldap/schema/openldap.schema
include         /usr/local/openldap/etc/openldap/schema/nis.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org

pidfile /usr/local/openldap/var/run/slapd.pid
argsfile /usr/local/openldap/var/run/slapd.args

# Load dynamic backend modules:
# modulepath    /usr/local/openldap/libexec/openldap
# moduleload    back_bdb.la
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# BDB database definitions
#######################################################################

database        bdb
suffix          "o=security_lab,c=CN"
rootdn          "cn=root,o=security_lab,c=CN"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw          {SSHA}HGqUY0jdkXUQQd9dVQhRowaKZedSOXhT
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /usr/local/openldap/var/openldap-data
# Indices to maintain
index   objectClass     eq

============================================

ldap.conf on RA

LDAP "yes"
LDAP_CRL_Issuer ""
LDAP_CA_DN ""

## Crypto Section
## ==============
openssl         "/usr/local/openssl/bin/openssl"
sslconfig       "/usr/local/openra/openca/etc/openssl/openssl.cnf"
MakePath        "/usr/bin/make"

## General Section
## ===============

DEFAULT_LANGUAGE "C"
DEFAULT_CHARSET "iso-8859-1"

CgiLibPath              "/usr/local/openra/openca/lib/functions"
CgiServerType           "ldap"
CgiServerName          "ldap"

ModuleID 2
ModuleShift 9

HtdocsUrlPrefix "/ldap"

SessionDir /usr/local/openra/openca/var/session/cookie
SessionLifetime 1200

DBmodule        "DBI"
AccessControlConfiguration "/usr/local/openra/openca/etc/access_control/ldap.xml"
SoftwareConfiguration      "/usr/local/openra/openca/etc/config.xml"
RoleConfiguration          "/usr/local/openra/openca/etc/rbac/roles.xml"

ModuleConfiguration        "/usr/local/openra/openca/etc/rbac/modules.xml"
TokenConfiguration         "/usr/local/openra/openca/etc/token.xml"
LogConfiguration           "/usr/local/openra/openca/etc/log.xml"
MenuConfiguration          "/usr/local/openra/openca/etc/menu.xml"
LDAPConfiguration          "/usr/local/openra/openca/etc/ldap.xml"

TempDir "/usr/local/openra/openca/var/tmp"
MaxReturnedItems 20

ADDITIONAL_REQUEST_ATTRIBUTES "requestercn" "email" "department" "telephone"
ADDITIONAL_ATTRIBUTES_DISPLAY_VALUE "Name (first and Last name)" "Email" "Department"
"Telephone"
ADDITIONAL_REQUEST_ATTRIBUTES_STRING_TYPE "LATIN1_LETTERS" "EMAIL" "LATIN1_LETTERS" "LATIN
1_LETTERS"

CmdRefs_viewCert "LDAP" "VIEW_CSR"
REQUIRE_PASSWD_PUBLIC "NO"

## Images Section
## ==============
ValidSigImage "/ldap/images/validSig.png"
SigErrorImage "/ldap/images/sigError.png"

## Certificates and CRLs Section
## =============================

CACertificate           "/usr/local/openra/openca/var/crypto/cacerts/cacert.pem"
CACertificateDER        "/usr/local/openra/openca/var/crypto/cacerts/cacert.der"
CACertificateCRT        "/usr/local/openra/openca/var/crypto/chain/cacert.crt"
CACertsDir              "/usr/local/openra/openca/var/crypto/cacerts"
CertsDir                "/usr/local/openra/openca/var/crypto/certs"
ChainDir                "/usr/local/openra/openca/var/crypto/chain"
CRLDir                  "/usr/local/openra/openca/var/crypto/crls"

##
## Role management Section
## -----------------------

RBAC_DIR          "/usr/local/openra/openca/etc/rbac"
RBAC_MODULE       "RA_1"
ROLES_DIR         "roles"
RIGHTS_DIR        "rights"
SCRIPT_CONFIG_DIR "scripts"

====================================================

config.xml on RA

<option>
            <name>ldap_host</name>
            <value>202.116.76.112</value>
        </option>
        <option>
            <name>ldap_port</name>
            <value>389</value>
        </option>
        <option>
            <name>ldaproot</name>
            <value>cn=root,o=security_lab,c=CN</value>
        </option>
        <option>
            <name>ldaprootpwd</name>
            <value>pkigroup</value>
        </option>
        <option>
            <name>useLDAP</name>
            <value>yes</value>
        </option>
        <option>
            <name>update_ldap_automatic</name>
            <value>yes</value>
        </option>

__________________________________________________
赶快注册雅虎超大容量免费邮箱?
http://cn.mail. yahoo.com

[Openca-Users] LDAP problem

Reply via email to