nerdexam
Linux_Foundation

LFCS · Question #183

When using the auth_ldap module with Apache 1.3, the log displays several messages containing "protocol error". Which of the following steps should be followed to fix the problem?

The correct answer is A. AuthLDAPStartTLS must be set to on. Apache 1.3's auth_ldap module reporting "protocol error" often indicates a failure to establish a secure TLS connection with the LDAP server. Setting AuthLDAPStartTLS to on forces the module to upgrade the connection to TLS, resolving secure communication issues.

Submitted by naveen.iyer· Apr 18, 2026Service Configuration

Question

When using the auth_ldap module with Apache 1.3, the log displays several messages containing "protocol error". Which of the following steps should be followed to fix the problem?

Options

  • AAuthLDAPStartTLS must be set to on.
  • BLDAPv2 should be disallowed.
  • CLDAPv3 should be allowed.
  • DThe Apache module must be turned on in slapd.conf.
  • EThe apache_auth.schema must be included in slapd.conf.

How the community answered

(30 responses)
  • A
    70% (21)
  • B
    7% (2)
  • C
    3% (1)
  • D
    17% (5)
  • E
    3% (1)

Why each option

Apache 1.3's `auth_ldap` module reporting "protocol error" often indicates a failure to establish a secure TLS connection with the LDAP server. Setting `AuthLDAPStartTLS` to `on` forces the module to upgrade the connection to TLS, resolving secure communication issues.

AAuthLDAPStartTLS must be set to on.Correct

When the Apache `auth_ldap` module reports a "protocol error," particularly when interacting with an LDAP server that enforces or expects secure communication, it frequently means the TLS negotiation failed. Setting `AuthLDAPStartTLS On` explicitly instructs Apache to initiate a StartTLS operation, upgrading the plain LDAP connection to a secure TLS connection, which resolves these protocol-level communication errors.

BLDAPv2 should be disallowed.

Disallowing LDAPv2 (by setting `AuthLDAPVersion 3`) might be necessary for compatibility but typically wouldn't manifest as a "protocol error" related to secure connection negotiation.

CLDAPv3 should be allowed.

Allowing LDAPv3 via `AuthLDAPVersion 3` ensures the correct protocol version is used, but a "protocol error" is more indicative of a security layer negotiation failure rather than a basic version mismatch.

DThe Apache module must be turned on in slapd.conf.

The Apache module is configured in Apache's configuration files (e.g., `httpd.conf`), not in `slapd.conf`, which is the configuration file for the OpenLDAP server itself.

EThe apache_auth.schema must be included in slapd.conf.

The `apache_auth.schema` defines attributes for LDAP entries used by Apache and is included in `slapd.conf` for the LDAP server, but its inclusion does not directly resolve a "protocol error" in the Apache client's connection attempt.

Concept tested: Apache LDAP StartTLS configuration

Source: https://httpd.apache.org/docs/1.3/mod/mod_auth_ldap.html

Topics

#Apache#LDAP#Authentication#TLS/SSL

Community Discussion

No community discussion yet for this question.

Full LFCS Practice