Apache Fortress End-to-End Web App Security Tutorial

Navigation Links

OpenLDAP SSL

This section enables slapd LDAPS for usage in this tutorial. More general purpose info can be found here, on the project website: Enabling TLS on slapd.

Steps to Enable

Gather the server-side crypto artifacts created during Managing PKI Keys for OpenLDAP ssl:
- ca-cert.pem is the ca certificate file
- server-cert.pem is the server certificate
- server-key.pem is the server private key

Update openldap's config (slapd.conf or dynamic config) to point to these files and they must be accessible by slapd process at runtime:
```
                    
### SSL Configuration
TLSCACertificateFile  /path/to/ca-cert.pem
TLSCertificateFile    /path/to/server-cert.pem
TLSCertificateKeyFile /path/to/server-key.pem
                    
                
```
Note: If setup openldap using the apache fortress openldap quickstart, README-QUICKSTART-SLAPD.md, these artifacts can be automatically applied.

Modify the slapd startup script to listen on LDAPS port (default 636) during startup. e.g. here's how to enable for both LDAP and LDAPS listening over any hostname:
```
                    
"ldap:/// ldaps:///"
                    
                
```
Notes:
- The common name listed in the server-side certificate must match the hostname used on clientside during connections or verfication will fail.
- The ldap server must be listening to the same host name in the certificate as well.
- For proper security, the listener should be scoped to only the hosts and ports necessary.
- If setup openldap using the apache fortress openldap quickstart, README-QUICKSTART-SLAPD.md, the startup script will be automatically modified.
- More info here: Running slapd

Restart the slapd process.

Check the status of server process. From system command prompt (as apacheds user):

[student@FTDEMO01]$ ps -ef | grep slapd root 00:00:09 /opt/symas/lib64/slapd -u root -g root ... -h ldap://localhost:389 ldaps://fortressdemo2.com:636

Verify slapd server restarted successfully and is now listening over LDAPS port.

This is free and unencumbered software released into the public domain.