Encrypted secure LDAP communication
Last updated
ProcMan Admin Guide V6.0.0
Last updated
If the user login shall work via encrypted secure LDAP communication (LDAPS), there have to be set some system environment variables to configure the LDAPS communication and after that the Web Server has to be restarted (e.g. in Windows’s Services dialog restart the HORIZONT HTTP Server service). On Unix/Linux the setting of the system variables works as well, but the preferred way is to set appropriate options in the ldap.conf file (see the description for this later in this chapter).
The most important environment variables which take effect on the secure LDAP communication are LDAPTLS_REQCERT, LDAPTLS_CACERT, LDAPTLS_CERT and LDAPTLS_KEY. If there are also other settings required by a particular installation please refer to and search for ldap.conf for more information.
No server certificate verification required
If server certificate verification by the client is not required, set the environment variable LDAPTLS_REQCERT=never
Server certificate verification required
If server certificate verification by the client is required, copy the certificate of the server certificate’s authority provided by the customer to a file on the ProcMan server (e.g. C:\Programs\HORIZONT\ldap\server_ca.crt). If the server certificate has been issued using an intermediate authority certificate, which self has been signed by a parent authority certificate, copy all the chain of the intermediate authority certificate and all its ancestor authority certificates in arbitrary order in a single file on the ProcMan server.
Set the environment variables LDAPTLS_REQCERT=try and LDAPTLS_CACERT=<file>, where <file> is the file with its absolute path containing the certificate of the server certificate’s authority (or chain of authority certificates) previously copied to the ProcMan server.
Client certificate verification required
Beside the server certificate verification by the client, also client certificate verification by the server can be required for the secure LDAP communication in some installations. In this case a client certificate file and its private key file provided by the customer and issued by an authority known to the server has to be copied to files on the ProcMan server (e.g. C:\Programs\HORIZONT\ldap\client.crt and C:\Programs\HORIZONT\ldap\client.key). Beware that the key file has to be protected to avoid its misuse.
Set the environment variables LDAPTLS_CERT=<cert_file> and LDAPTLS_KEY=<key_file>, where <cert_file> is the client certificate file and <key_file> is the private key file, with their absolute paths, previously copied to the ProcMan server.
On Unix/Linux the preferred way is to set appropriate options in the ldap.conf file, rather than use the system variables. In a HWF installation the ldap.conf file is placed in /opt/horizont/hwf/etc/ldap.conf. The configuration options corresponding to the system variables described above are TLS_REQCERT, TLS_CACERT, TLS_CERT and TLS_KEY. The required options can be added by editing the ldap.conf file.
Example (ldap.conf):