Trying to determine if LDAP over SSL is working using LDP.exe

hi,

i wanted confirm ldap on ssl working on our domain controller.  when connect using ldp.exe on windows 7 computer, following output:

ld = ldap_sslinit("dc1.domain.com", 636, 1);

error 0 = ldap_set_option(hldap, ldap_opt_protocol_version, 3);

error 0 = ldap_connect(hldap, null);

error 0 = ldap_get_option(hldap,ldap_opt_ssl,(void*)&lv);

host supports ssl, ssl cipher strength = 128 bits

established connection dc1.domain.com.

retrieving base dsa information...

getting 1 entries:

dn: (rootdse)

<unnecessary details>

it looks working, wasn't sure if error 0's mean there sort of problem.

also, when run simple bind credentials, following output:

res = ldap_simple_bind_s(ld, 'myuseraccount-at-domaindotcom', <unavailable>); // v.3

authenticated as: 'domain\myuseraccount'.

finally, when run bind logged on user (with encrypt traffic after bind checked), following output:

53 = ldap_set_option(ld, ldap_opt_encrypt, 1)

res = ldap_bind_s(ld, null, &ntauthidentity, negotiate (1158)); // v.3

{ntauthidentity: user='null'; pwd=<unavailable>; domain = 'null'}

authenticated as: 'domain\myuseraccount'.

i followed instructions found in microsoft article kb-321051 ldap on ssl working valid 3rd party certificate on 1 of our windows 2008 r2 domain controllers.  however, when test active directory authentication on our watchguard management server after importing the ca certificate, test fails.  in order use active directory authentication, ldaps (ldap on ssl) must enabled in active directory domain , not 100% sure enabled properly.

any advice or additional insight appreciated.

thanks!

1. the cert should imported dcs "personal" certificate, not "trusted root certificates"
2. windows should not need intermediate certificates, watchguard might (but doesn't seems problem atm)
3. based on logs posted, seems dns problem, dns settings dose watch guard have internal interface? dose point dc(s)?

---

enfo zipper
christoffer andersson – principal advisor
http://blogs.chrisse.se - directory services blog

Windows Server  >  Security