From: Xeno Campanoli <xeno.campanoli@...>
Date: 2009-05-27T07:10:37+09:00
Subject: Something Not going with my LDAP using SSL

I have the following working with cleartext LDAP:

#!/usr/bin/ruby
#

require 'ldap'

begin
     ldap_host = 'myldaphost'
     ldap_port = 389
     ldap_conn = LDAP::Conn.new(ldap_host,ldap_port)
     puts "trace 2 ldap_conn:  #{ldap_conn.class}"
#   ldap_conn.set_option( LDAP::LDAP_OPT_PROTOCOL_VERSION, 3 )
     puts "trace 3 ldap_conn:  #{ldap_conn.class}"
     bind_dn = "uid=#{ARGV[0]},ou=People,ou=Corporate,dc=x,dc=com"
     password_dn = "#{ARGV[1]}"
     ldap_conn.bind(bind_dn,password_dn)
     puts "trace 4 ldap_conn:  #{ldap_conn.class}"
rescue
     puts "trace 5 oops"
end

# end of test
----snip---

But when I try to run it with SSL, I get a failure saying "Can't connect LDAP 
Server".  My admin says it is not seeing the certificate.  I need to either 
accept the certificate or turn certification off, but for the life of me I am 
looking at the rdoc and I cannot find methods for either.  Perhaps I just don't 
understand the vocabulary or something, but I would expect this to be simple. 
My SSL version is as follows, and gets the diagnosic I gave above:
#!/usr/bin/ruby
#

require 'ldap'

begin
     ldap_host = 'myldaphost'
     ldap_port = 636
     ldap_conn = LDAP::SSLConn.new(ldap_host,ldap_port)
     puts "trace 2 ldap_conn:  #{ldap_conn.class}"
     ldap_conn.set_option( LDAP::LDAP_OPT_PROTOCOL_VERSION, 3 )
     puts "trace 3 ldap_conn:  #{ldap_conn.class}"
     bind_dn = "uid=#{ARGV[0]},ou=People,ou=Corporate,dc=x,dc=com"
     password_dn = "#{ARGV[1]}"
     ldap_conn.bind(bind_dn,password_dn)
     puts "trace 4 ldap_conn:  #{ldap_conn.class}"
rescue
     puts "trace 5 oops, #{$!}"
end

# end of test
----snip---
Here is the output:
u@h:$ ./t7.rb un 'pw'
trace 2 ldap_conn:  LDAP::SSLConn
trace 3 ldap_conn:  LDAP::SSLConn
trace 5 oops, Can't contact LDAP server
u@h:$

On the first one, with the proper u/p I get the trace 4.  Anyway, please can 
someone suggest what I may be leaving out, or what is the method for specifying 
certs or no certs, both would be nice.

Thanks ahead of time.

Sincerely, Xeno