On May 17th I posted a bug in Mozilla’s bugzilla trouble ticket system,
regarding X.509 certificates which aren’t retrieved via LDAP on a connection
which requires credentials. This has been biting me quite a bit and I’ve
finally found a solution.
I offer limited LDAP directory services to clients who connect over SSL. The
service is limited in as much as the number and types of attributes which are
returned to the clients are limited as well as the number of entries. To this
effect, an OpenLDAP proxy server with a back-ldap backend fronts the
connections from the Internet as proxies them in to an internal directory
server (also OpenLDAP).
The configuration of the proxy is quite simple and well documented in slapd-
ldap. Here is my configuration:
When an authenticated client performs an LDAP search, all works well. This can
be tested with the ldapsearch utility (do remember to use -H
ldaps://hostname) or by configuring Mozilla Thunderbird appropriately and
setting credentials for the bind (DN of the user and password).
Upon performing address-book queries, Thunderbird contacts the server, binds
as the user and does it search. Upon composing a new message in Thunderbird,
the logs on the LDAP proxy show the request:
Iff the user now chooses to encrypt that message, upon hitting the Security
button in the compose window, Thunderbird tries to fetch the userCertificate
for that address. Notice how the LDAP server logs an anonymous bind!
In order for this anonymous bind to get through, I’ve added an ACL to the
proxy configuration as seen above; this allows the proxy to return the binary
userCertificate to the client.