LFCS · Question #183
When using the auth_ldap module with Apache 1.3, the log displays several messages containing "protocol error". Which of the following steps should be followed to fix the problem?
The correct answer is A. AuthLDAPStartTLS must be set to on. Apache 1.3's auth_ldap module reporting "protocol error" often indicates a failure to establish a secure TLS connection with the LDAP server. Setting AuthLDAPStartTLS to on forces the module to upgrade the connection to TLS, resolving secure communication issues.
Question
Options
- AAuthLDAPStartTLS must be set to on.
- BLDAPv2 should be disallowed.
- CLDAPv3 should be allowed.
- DThe Apache module must be turned on in slapd.conf.
- EThe apache_auth.schema must be included in slapd.conf.
How the community answered
(30 responses)- A70% (21)
- B7% (2)
- C3% (1)
- D17% (5)
- E3% (1)
Why each option
Apache 1.3's `auth_ldap` module reporting "protocol error" often indicates a failure to establish a secure TLS connection with the LDAP server. Setting `AuthLDAPStartTLS` to `on` forces the module to upgrade the connection to TLS, resolving secure communication issues.
When the Apache `auth_ldap` module reports a "protocol error," particularly when interacting with an LDAP server that enforces or expects secure communication, it frequently means the TLS negotiation failed. Setting `AuthLDAPStartTLS On` explicitly instructs Apache to initiate a StartTLS operation, upgrading the plain LDAP connection to a secure TLS connection, which resolves these protocol-level communication errors.
Disallowing LDAPv2 (by setting `AuthLDAPVersion 3`) might be necessary for compatibility but typically wouldn't manifest as a "protocol error" related to secure connection negotiation.
Allowing LDAPv3 via `AuthLDAPVersion 3` ensures the correct protocol version is used, but a "protocol error" is more indicative of a security layer negotiation failure rather than a basic version mismatch.
The Apache module is configured in Apache's configuration files (e.g., `httpd.conf`), not in `slapd.conf`, which is the configuration file for the OpenLDAP server itself.
The `apache_auth.schema` defines attributes for LDAP entries used by Apache and is included in `slapd.conf` for the LDAP server, but its inclusion does not directly resolve a "protocol error" in the Apache client's connection attempt.
Concept tested: Apache LDAP StartTLS configuration
Source: https://httpd.apache.org/docs/1.3/mod/mod_auth_ldap.html
Topics
Community Discussion
No community discussion yet for this question.