dsconfigldap in 10.7 ( not really casper related )

Jak
New Contributor III

Hi list,

Not really Casper related, but I need to tap into the wealth of knowledge here

10.7.2 client build.

Bind to OD server (10.6.8) via GUI works as expected. MCXs applied. Happy days

Bind to OD server via dsconfigldap, the bind succeeds, the computer object is in the OD, but the GUI
Displays 'This server is not responding'

Forward and reverse DNS are good

Via terminal (ssl on) dsconfigldap, the debug chucks this up:

2011-11-08 10:44:41.090 GMT - 243.2183, Node: /LDAPv3/ldaps://<ldaps://10.91.10.84><myodserver>Module: AppleODClient - unable to create connection to OD LDAP server - ldap_search_ext_s for the rootDSE failed with error 'server connection failed' (-1) error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed (unable to get local issuer certificate)

I've put <myodserver> for security reasons (its an FQDN really)

Now I have a self certified cert, I get the same result if its trusted on untrusted.

And with SSL on or off.

Any thought wise people of Casper list?

Thanks,

Jak.

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the addressee of this e-mail please do not copy or forward it or otherwise use it or any part of it in any form whatsoever. If you have received this email in error please notify the system manager on Information.Security at burberry.com.

References in this Data to "Burberry" are references to Burberry Group
plc, a company incorporated in England and Wales with registered number
03458224 whose registered office is at Horseferry House, Horseferry Road, London, SW1P 2AW
and where the context requires, includes its subsidiaries and
associated undertakings.

1 REPLY 1

Not applicable

Hi Jak,

On 10 November 2011 22:12, Jak Piper <Jak.Piper at burberry.com> wrote:

Had a similar issue. Try this:

sed -i .original 's/TLS_REQCERT.*demand/TLS_REQCERT
never/'/etc/openldap/ldap.conf

killall -u root "DirectoryService"
Cheers,
Doug