Libldap-ruby with TLS connection

ruby-talk
1

Hi,

Has anybody any experience with libldap-ruby? There’s an
example file, how to make connections with TLS, but it
does’n work to me. The error message is similar to the
prbleme if I use ldapsearch at a unix prompt and forget
to include CA certificate file to the ldap.conf:

ssage:~$ irb1.8        
irb(main):001:0> require 'ldap'
=> true
irb(main):002:0> LDAP::LDAP_VENDOR_NAME
=> "OpenLDAP"
irb(main):003:0> conn = LDAP::SSLConn.new("10.3.130.61", 3892, true)
LDAP::ResultError: Connect error
	from (irb):3:in `initialize'
	from (irb):3:in `new'
	from (irb):3
irb(main):004:0> _

Yes, “10.3.130.61” and port 3892 is correct. Certs are OK, ldapsearch
with -ZZ is ready. The TLS example in the package:

-- ruby -- ### bind-ssl.rb

This file is a part of test scripts of LDAP extension module.

$test = File.dirname($0)
require “#{$test}/conf”

  	# -*- ruby -*-		### conf.rb ###
  	
  	require 'ldap'
  	
  	$HOST = 'localhost'
  	begin
  	  $PORT = ARGV[0].to_i || LDAP::LDAP_PORT
  	  $SSLPORT = ARGV[1].to_i || LDAP::LDAPS_PORT
  	rescue
  	  $PORT = LDAP::LDAP_PORT
  	  $SSLPORT = LDAP::LDAPS_PORT
  	end

require “ldap”

case LDAP::LDAP_VENDOR_NAME
when /^OpenLDAP/i
# true means we use start_tls extension.
conn = LDAP::SSLConn.new($HOST, $PORT, true)
when /^Netscape/i
conn = LDAP::SSLConn.new($HOST, $SSLPORT,
false, File.expand_path(“~/.netscape/cert7.db”))
conn.set_option(LDAP::LDAP_OPT_PROTOCOL_VERSION, 3)
else
raise(RuntimeError, “unknown vendor”)
end

v = conn.get_option(LDAP::LDAP_OPT_PROTOCOL_VERSION)
printf(“protocol version = #{v}\n”)

conn.bind{
conn.perror(“bind”)
}

My questions are:

  • How to create TLS connections in Ruby?
  • If client library verifies the servers certificate, where
    can I put the CA’s certificate? ldap.conf is ok?
  • Is there any documentation about libruby-ldap except the
    few examples in the package itself? Where?
···

–
Thanks,
bSanyI

2

Bedo Sandor said:

  • How to create TLS connections in Ruby?

Use the class SSLConn.
I think your code should work, so I will look into it.
Can you see server’s logs? I’d like to see them.

  • If client library verifies the servers certificate, where
    can I put the CA’s certificate? ldap.conf is ok?

Conn#set_option() may help you, and its usage is almost
same as ldap_set_option() in OpenLDAP APIs.
However, I didn’t fully test it.

  • Is there any documentation about libruby-ldap except the
    few examples in the package itself? Where?

There is no documentation.

Regards,

···

–
Takaaki Tateishi ttate@ttsky.net