Dear Apache users,
I am trying to debug an error in an Apache LDAPS connection, against Windows Active Directory:
[authnz_ldap:info] [pid 14680270:tid 515] [client 172.24.12.217:52072] AH01695: auth_ldap authenticate: user pdonaghy authentication failed; URI /favicon.ico [LDAP: ldap_simple_bind() failed][Can't contact LDAP server]
Many entries for this error point to a problem with the certificate chain. But as far as I can see, the certificate chain is valid - I have checked it using openssl s_client. I have also disabled the Apache certification validation: LDAPVerifyServerCert off
I have setup detailed logging in Apache: LDAPLibraryDebug 7 and LogLevel debug but I am still not getting the detailed cause of the error. For example:
** ld 3048d718 Outstanding Requests:
* msgid 1, origid 1, status InProgress
outstanding referrals 0, parent count 0
ld 3048d718 request count 1 (abandoned 0)
** ld 3048d718 Response Queue:
Empty
ld 3048d718 response count 0
ldap_chkResponseList ld 3048d718 msgid 1 all 0
ldap_chkResponseList returns ld 3048d718 NULL
ldap_int_select
read1msg: ld 3048d718 msgid 1 all 0
ldap_simple_bind
ldap_sasl_bind
ldap_send_initial_request
ldap_send_server_request
ldap_free_request (origid 1, msgid 1)
ldap_free_connection 1 1
ldap_free_connection: actually freed
ldap_create
[Tue Jan 21 12:57:46.650655 2014] [ldap:debug] [pid 15335652:tid 772] util_ldap.c(370): AH01278: LDAP: Setting referrals to Off.
ldap_err2string
[Tue Jan 21 12:57:46.650687 2014] [authnz_ldap:info] [pid 15335652:tid 772] [client
172.24.13.177:64607] AH01695: auth_ldap authenticate: user dgfd authentication failed; URI /favicon.ico [LDAP: ldap_simple_bind() failed][Can't contact LDAP server]
Does anyone know of a way to get further debug information about the certificate chain processing within Apache?
The OS is Aix 7.1, and the opensource components are as follows:
apr-1.4.8-1
apr-devel-1.4.8-1
apr-util-1.5.2-1
apr-util-db4-1.5.2-1
apr-util-freetds-1.5.2-1
apr-util-gdbm-1.5.2-1
apr-util-ldap-1.5.2-1
apr-util-odbc-1.5.2-1
apr-util-sqlite-1.5.2-1
httpd-2.4.7-1
mod_ssl-2.4.7-1
openssl-1.0.1e-2
openssl-devel-1.0.1e-2
openssl-doc-1.0.1e-2
openldap-2.4.23-0.3
openldap-clients-2.4.23-0.3
Thank you for any help.
Peter Donaghy.
