Re: Help needed, binding moodle to LDAP

[RalfGesellensetter <rgx@gmx.de>]

Hej Pere,

thanks for this quick reply...!

Am Montag, 13. Februar 2012 schrieb Petter Reinholdtsen:
> [Ralf Gesellensetter]
> > Any clue? Is browsing less than authing? Can I easily test if
> > external auth would work?
> 
> Authentication require SSL with fairly strong encryption.  Is this
> enabled on Moodle?  Browsing is allowed without SSL.

Well, I checked browsing on both ports (ldap & ldaps), but couldn't 
tell if ssl was used.
> 
> In debian-edu-config/share/debian-edu-config/tools/gosa-sync, I find
> this fragment used to verify a password:
> 
>   ldapwhoami -x -Z -y $TMPFILE -D $USERDN

I will check this tool from package ldap-utils:

ldapwhoami  -h $HOST -D 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' 
ldap_bind: Server is unwilling to perform (53)
        additional info: unauthenticated bind (DN with no password) disallowed

With debug level 9, I get:

$ ldapwhoami  -h skolelinux.pab-club.it -D 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' -X guest -d9
ldap_create
ldap_url_parse_ext(ldap://skolelinux.pab-club.it)
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP skolelinux.pab-club.it:389
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 84.36.13.84:389
ldap_pvt_connect: fd: 3 tm: -1 async: 0
ldap_open_defconn: successful
ldap_send_server_request
ber_scanf fmt ({it) ber:
ber_scanf fmt ({) ber:
ber_flush2: 64 bytes to sd 3
ldap_result ld 0x8075128 msgid 1
wait4msg ld 0x8075128 msgid 1 (infinite timeout)
wait4msg continue ld 0x8075128 msgid 1 all 1
** ld 0x8075128 Connections:
* host: skolelinux.pab-club.it  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon Feb 13 21:22:22 2012


** ld 0x8075128 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x8075128 request count 1 (abandoned 0)
** ld 0x8075128 Response Queue:
   Empty
  ld 0x8075128 response count 0
ldap_chkResponseList ld 0x8075128 msgid 1 all 1
ldap_chkResponseList returns ld 0x8075128 NULL
ldap_int_select
read1msg: ld 0x8075128 msgid 1 all 1
ber_get_next
ber_get_next: tag 0x30 len 9 contents:
read1msg: ld 0x8075128 msgid 1 message type search-entry
wait4msg continue ld 0x8075128 msgid 1 all 1
** ld 0x8075128 Connections:
* host: skolelinux.pab-club.it  port: 389  (default)
  refcnt: 2  status: Connected
  last used: Mon Feb 13 21:22:22 2012


** ld 0x8075128 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x8075128 request count 1 (abandoned 0)
** ld 0x8075128 Response Queue:
 * msgid 1,  type 100
  ld 0x8075128 response count 1
ldap_chkResponseList ld 0x8075128 msgid 1 all 1
ldap_chkResponseList returns ld 0x8075128 NULL
ldap_int_select
read1msg: ld 0x8075128 msgid 1 all 1
ber_get_next
ber_get_next: tag 0x30 len 12 contents:
read1msg: ld 0x8075128 msgid 1 message type search-result
ber_scanf fmt ({eAA) ber:
read1msg: ld 0x8075128 0 new referrals
read1msg:  mark request completed, ld 0x8075128 msgid 1
request done: ld 0x8075128 msgid 1
res_errno: 0, res_error: <>, res_matched: <>
ldap_free_request (origid 1, msgid 1)
adding response ld 0x8075128 msgid 1 type 101:
ldap_parse_result
ber_scanf fmt ({iAA) ber:
ber_scanf fmt (}) ber:
ldap_get_values
ber_scanf fmt ({x{{a) ber:
ldap_msgfree
ldap_err2string
ldap_sasl_interactive_bind_s: No such attribute (16)


> 
> You should be able to use a similar construct to verify that LDAP bind
> works.
> 
> Another idea would be a missing SSL certificate for the server.  See
> /etc/init.d/fetch-ldap-cert for the details on how that is fetched and
> stored on clients.

Okay, maybe php is missing ssl-module? 
> 
> Good luck. :)

Cheers
Ralf
> 
>