Bug 436536 - can't connect to secure LDAP server for auth
Summary: can't connect to secure LDAP server for auth
Alias: None
Product: Fedora
Classification: Fedora
Component: bugzilla
Version: 8
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: John Berninger
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2008-03-07 19:23 UTC by cje
Modified: 2009-01-09 06:07 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-01-09 06:07:57 UTC

Attachments (Terms of Use)

Description cje 2008-03-07 19:23:26 UTC
Description of problem:
my LDAP server supports TLS for encrypted connections and demands a certain
level of encryption before it will authorise.

bugzilla's LDAP auth module does start_tls with defaults which doesn't force the
required level of encryption.  so the connection fails.

i've modified the line to:
        my $mesg = $self->{ldap}->start_tls(verify => 'none', ciphers =>

at the end of /usr/share/bugzilla/Bugzilla/Auth/Verify/LDAP.pm by copying the
string of all supported encryptions from openssl.  there must be a better way
but this works.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
Actual results:

Expected results:

Additional info:

Comment 1 Matthew Miller 2008-10-15 14:30:52 UTC
Which version of bugzilla was this with?

Comment 2 cje 2008-10-15 16:43:20 UTC
bugzilla-3.0.2-6.fc8 but the code's the same in bugzilla CVS.

i probably shouldn't have that "verify => 'none'" in there.

the key problem as i see it is that, according to http://search.cpan.org/~gbarr/perl-ldap-0.38/lib/Net/LDAP.pod#start_tls the default for ciphers is "ALL", which "permits all ciphers, even those that don't encrypt" whereas what we probably want is the default behaviour from Net::LDAPS which, according to http://search.cpan.org/~gbarr/perl-ldap/lib/Net/LDAP/Security.pod, will "by default use all the algorithms built into your copy of OpenSSL, except for ones considered to use "low" strength encryption, and those using export strength encryption"

so, possibly, the change should be in perl-LDAP?  my version of that is perl-LDAP-0.34-3.fc7.

mind you, if we've specified something a bit stronger on our server then we'll want to override that too.  i wonder why that start_tls can't auto-negotiate.

*** pause to do some googling ***

someone seems to have hit this problem elsewhere: http://www.dreamincode.net/forums/blog/nova_dragoon/index.php?showentry=396

Comment 3 cje 2008-10-15 16:52:38 UTC
FWIW pam, PHP, postfix, dovecot, evolution, ldapsearch and apache (mod_ldap) all talk to that LDAP server just fine without any cipher configuration - so fingers should probably be pointed at perl-LDAP.

Comment 4 Matthew Miller 2008-10-15 22:24:43 UTC
Hmmm. So this is probably best addressed upstream in bugzilla's own bugzilla.

As an alternate workaround: can you point at ldaps (port 636) instead of using starttls?

Comment 5 cje 2008-10-16 00:40:53 UTC
maybe, or it should be addressed to the perl-LDAP people.  or we could figure out a better fix here and submit a patch upstream?

John, any comment on this?

for now i'm okay adding my ciphers mod each time bugzilla gets upgraded so i don't need the ldaps alternative - thanks for the suggestion though.

Comment 6 Bug Zapper 2008-11-26 10:04:09 UTC
This message is a reminder that Fedora 8 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 8.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '8'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 8's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 8 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

Comment 7 Bug Zapper 2009-01-09 06:07:57 UTC
Fedora 8 changed to end-of-life (EOL) status on 2009-01-07. Fedora 8 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.