Netware 5.1, mod_edir, Apache 2.0

Question

I've been fighting with this for over a week now. Here's my setup
Novell 5.1 server SP7
eDirectory 8.7.3.9
Apache 2.0.59 Netware
mod_edir 1.0.13
The configuration MUST use LDAPS
Whenever I try to login when the "require edir-user" parameter is specified in the httpd.conf, I get the following error
[error] [client 172.24.1.13] failed to create identity for cn=TPatton.ou=users,o=canada on server myserver. err: 115 errno: 0
or
[error] [client 172.24.1.13] failed to create identity for cn=TPatton.ou=users,o=canada on server myserver. err: 115 errno: 1
However, if I change the parameter to "require valid-user", then I'm able to login without issue. However, I need to enforce the ACL of the folders, which is why I'm using mod_edir.
Also, it should be noted that on this same server I successfully installed Apache 1.3 w/ mod_nds, and it works like a charm. But due to the age of Apache 1.3, and the potential for an OS upgrade, I wanted to get this working under Apache 2.0 w/ mod_edir
This occurs with ALL users. I have even created new users with ConsoleOne to ensure the UID was set properly, and it doesn't seem to make a difference. This also occurs, regardless if I have the apache server running in authenticated mode. It also occurs if I replace my query with UID instead of CN. I'm running out of ideas.
Here are all the logs, in debug mode, and my config file at the bottom. You can see in the log where the first LDAP authentication works, but when mod_edir tries to authenticate me, it fails.
Any advice would be greatly appreciated
Apache Log (in debug mode)
Attempting to create a server identity. Result Code: 0
[debug] mod_auth_ldap.c(785): [2] auth_ldap url parse: `ldaps://myserver:636/ou=users,o=canada?cn?sub'
[debug] mod_auth_ldap.c(806): [2] auth_ldap url parse: Host: myserver
[debug] mod_auth_ldap.c(808): [2] auth_ldap url parse: Port: 636
[debug] mod_auth_ldap.c(810): [2] auth_ldap url parse: DN: ou=users,o=canada
[debug] mod_auth_ldap.c(812): [2] auth_ldap url parse: attrib: cn
[debug] mod_auth_ldap.c(814): [2] auth_ldap url parse: scope: subtree
[debug] mod_auth_ldap.c(819): [2] auth_ldap url parse: filter: (null)
[debug] mod_auth_ldap.c(877): LDAP: auth_ldap using SSL connections
[notice] LDAP: Built with Novell LDAP SDK
[notice] LDAP: SSL support available
Attempting to create a server identity. Result Code: 0
[debug] util_ldap.c(1690): Initialisation of global mutex sys:/tmp/T-000044.TMP in child process 2 successful.
[notice] Apache/2.0.59 (NETWARE) configured -- resuming normal operations
[info] Server built: Jul 27 2006 16:14:33
Virtual Server log (debug)
[debug] mod_auth_ldap.c(337): [client 172.24.1.13] [28] auth_ldap authenticate: using URL ldaps://myserver:636/users,o=canada?cn?sub
[debug] mod_auth_ldap.c(411): [client 172.24.1.13] [28] auth_ldap authenticate: accepting tpatton
[debug] mod_edir.c(184): [client 172.24.1.13] MOD_eDIR user DN: cn=TPatton.users,o=canada
[debug] mod_edir.c(189): [client 172.24.1.13] server path root is VOL2:
[error] [client 172.24.1.13] failed to create identity for cn=TPatton.users,o=canada on server myserver. err: 115 errno: 0
[debug] mod_auth_ldap.c(729): [client 172.24.1.13] [28] auth_ldap authorise: authorisation denied
httpd.conf
LoadModule ldap_module modules/utilldap.nlm
LDAPTrustedCA SYS:\SYSTEM\RootCert.der
LDAPTrustedCAtype DER_FILE
LoadModule auth_ldap_module modules/authldap.nlm
LoadModule edir_module modules/mod_edir.nlm
eDirCacheTimeout 0
<VirtualHost 172.24.1.12:443>
ServerAdmin [email protected]
DocumentRoot "VOL2:/Test_Apache"
ServerName 172.24.1.12
ErrorLog logs/host.example.com-error_log
CustomLog logs/host.example.com-access_log common
<Directory VOL2:/Test_Apache>
AuthName A_Protected_Place
AuthType Basic
AuthLDAPURL "ldaps://myserver:636/ou=users,o=canada?cn?sub"
require edir-user
Options Indexes MultiViews
Order allow,deny
Allow from all
</Directory>
</VirtualHost>

Answer 1

Hi,
probably a late reply, but here some hints:
1. update NW 5.1 to SP8
2. update LiBC to lastest available, f.e. download:
http://www.gknw.net/nwdevnet/nwlib6j.exe
extract this on your server, but before you install replace the LibC with
this one:
http://www.gknw.net/nwdevnet/libc-20080131.zip
3. if you have aliased users then dont use mod_edir 1.0.13, but instead go
back to 1.0.12.
Also, since you anyway have no other Novell Apache products on the NW 5.1 box
I would use Apache 2.2.x.
HTH, Gnter.
tjpatton <[email protected]> wrote in news:tjpatton.3d27zd@no-
mx.forums.novell.com:
>
> I've been fighting with this for over a week now. Here's my setup
>
> Novell 5.1 server SP7
> eDirectory 8.7.3.9
> Apache 2.0.59 Netware
> mod_edir 1.0.13
>
> The configuration MUST use LDAPS
>
> Whenever I try to login when the "require edir-user" parameter is
> specified in the httpd.conf, I get the following error
>
> [error] [client 172.24.1.13] failed to create identity for
> cn=TPatton.ou=users,o=canada on server myserver. err: 115 errno: 0
>
> or
>
> [error] [client 172.24.1.13] failed to create identity for
> cn=TPatton.ou=users,o=canada on server myserver. err: 115 errno: 1
>
> However, if I change the parameter to "require valid-user", then I'm
> able to login without issue. However, I need to enforce the ACL of the
> folders, which is why I'm using mod_edir.
>
> Also, it should be noted that on this same server I successfully
> installed Apache 1.3 w/ mod_nds, and it works like a charm. But due to
> the age of Apache 1.3, and the potential for an OS upgrade, I wanted to
> get this working under Apache 2.0 w/ mod_edir
>
> This occurs with ALL users. I have even created new users with
> ConsoleOne to ensure the UID was set properly, and it doesn't seem to
> make a difference. This also occurs, regardless if I have the apache
> server running in authenticated mode. It also occurs if I replace my
> query with UID instead of CN. I'm running out of ideas.
>
> Here are all the logs, in debug mode, and my config file at the bottom.
> You can see in the log where the first LDAP authentication works, but
> when mod_edir tries to authenticate me, it fails.
>
> Any advice would be greatly appreciated
>
> ***
> Apache Log (in debug mode)
>
> Attempting to create a server identity. Result Code: 0
> [debug] mod_auth_ldap.c(785): [2] auth_ldap url parse:
> `ldaps://myserver:636/ou=users,o=canada?cn?sub'
> [debug] mod_auth_ldap.c(806): [2] auth_ldap url parse: Host: myserver
> [debug] mod_auth_ldap.c(808): [2] auth_ldap url parse: Port: 636
> [debug] mod_auth_ldap.c(810): [2] auth_ldap url parse: DN:
> ou=users,o=canada
> [debug] mod_auth_ldap.c(812): [2] auth_ldap url parse: attrib: cn
> [debug] mod_auth_ldap.c(814): [2] auth_ldap url parse: scope: subtree
> [debug] mod_auth_ldap.c(819): [2] auth_ldap url parse: filter: (null)
> [debug] mod_auth_ldap.c(877): LDAP: auth_ldap using SSL connections
> [notice] LDAP: Built with Novell LDAP SDK
> [notice] LDAP: SSL support available
> Attempting to create a server identity. Result Code: 0
> [debug] util_ldap.c(1690): Initialisation of global mutex
> sys:/tmp/T-000044.TMP in child process 2 successful.
> [notice] Apache/2.0.59 (NETWARE) configured -- resuming normal
> operations
> [info] Server built: Jul 27 2006 16:14:33
>
> ***
> Virtual Server log (debug)
>
> [debug] mod_auth_ldap.c(337): [client 172.24.1.13] [28] auth_ldap
> authenticate: using URL ldaps://myserver:636/users,o=canada?cn?sub
> [debug] mod_auth_ldap.c(411): [client 172.24.1.13] [28] auth_ldap
> authenticate: accepting tpatton
> [debug] mod_edir.c(184): [client 172.24.1.13] MOD_eDIR user DN:
> cn=TPatton.users,o=canada
> [debug] mod_edir.c(189): [client 172.24.1.13] server path root is
> VOL2:
> [error] [client 172.24.1.13] failed to create identity for
> cn=TPatton.users,o=canada on server myserver. err: 115 errno: 0
> [debug] mod_auth_ldap.c(729): [client 172.24.1.13] [28] auth_ldap
> authorise: authorisation denied
>
> ***
> httpd.conf
>
> LoadModule ldap_module modules/utilldap.nlm
> LDAPTrustedCA SYS:\SYSTEM\RootCert.der
> LDAPTrustedCAtype DER_FILE
> LoadModule auth_ldap_module modules/authldap.nlm
> LoadModule edir_module modules/mod_edir.nlm
> eDirCacheTimeout 0
>
> <VirtualHost 172.24.1.12:443>
> ServerAdmin [email protected]
> DocumentRoot "VOL2:/Test_Apache"
> ServerName 172.24.1.12
> ErrorLog logs/host.example.com-error_log
> CustomLog logs/host.example.com-access_log common
>
> <Directory VOL2:/Test_Apache>
> AuthName A_Protected_Place
> AuthType Basic
> AuthLDAPURL "ldaps://myserver:636/ou=users,o=canada?cn?sub"
> require edir-user
> Options Indexes MultiViews
> Order allow,deny
> Allow from all
> </Directory>
> </VirtualHost>
> ***
>
>