monline

I tried to set up LDAPS (LDAP + SSL) based authentication in a Drupal site, but it didn't want to work. Here's how I managed to solve the issue.

In case of the Sun/Oracle JVM (JRE/JDK) the SSL certificates are store in this keystore: /etc/java-6-sun/security/cacerts. To update it, use the keytool utility that comes with the JRE/JDK.

The LDAPClientAuthentication page in the Ubuntu Community wiki describes the basic setup pretty well. However if you bring encryption (SSL/TLS) into the game, it's a quite different story.

The devil is in the details ...
If you connect through SSL, you've to use the following parameters in config.php:
Notice that the host parameter contains the port too and the port parameter contains 0 (zero).

I'm testing Ubuntu 8.04 at my working place before we deploy it as a terminal server for our colleagues.
The server has a single Intel Core2 Quad CPU and Ubuntu was installed using the amd64 architecture.
Up til now I saw no drawback from choosing the amd64 arch., but Sun's Java plugin came in the picture just to cause me some headache.

With Apache 1.3.x it was easy: just install the apache-ssl package and you're all set up. However, this way you had to maintain two separate configs, one for the apache Debian package and one for the apache-ssl package. With Apache 2.x the *-ssl package disappeared and now you can easily maintain a single Apache config including both the normal HTTP and the SSL listeners and virtualhosts.

I've found a bug in KDE's Konqueror. If you access a webserver solely through its hostname (no FQDN, eg. a server on a small company intranet) and you try to reach it via SSL (https://) and that server has a self-signed certificate with a common name equal to its hostname, then Konqueror will keep bugging you with a confirmation dialog with the following message: Konqueror - Server Authentication
You have indicated that you wish to accept this certificate, but it is not issued to the server who is presenting it. Do you wish to continue loading?

It doesn't make a difference if you told Konqueror to accept the certificate forever. It'll keep asking you the same thing again and again.