`<div dir="ltr">On 26 Aug 2013, at 11:42:52 -0700, Paul B. Henson wrote:<br><br>... However, in OmniOS r151006 (omnios-b281e50) the ldapsearch test<br>fails when using TLS (-Z or -ZZ switches used) with:<br><br> ldap_simple_bind: Can't contact LDAP server<br>
<br>It looks like Brian's problem might be that he has an MD5 cert on his ldap server, and the latest release of omnios includes nss 3.14.3, which has by default dropped support for md5 certs:<a href="https://developer.mozilla.org/en-US/docs/NSS/NSS_3.14_release_notes">https://developer.mozilla.org/en-US/docs/NSS/NSS_3.14_release_notes</a><br>
This might be worth retroactively adding to the release notes as a compatibility change? <br>[...]<br><br>If the same workaround resolves the issue under omnios, then<br><br># svccfg -s network/ldap/client:default setenv NSS_HASH_ALG_SUPPORT +MD5<br>
<br>should make the ldap client work, I believe all ldap connections are<br>routed through the cache manager.<br><br>For the sake of the archives, setting the environment variable just for <br>network/ldap/client did not work. However, setting it globally in <br>
/etc/default/init and rebooting did.<br><br><br><br>Suffering from exactly the same problem (LDAP bind failing after upgrading from r151004 to r151006), I tried your recipe; my /etc/default/init now contains:<br><br>TZ="Europe/Brussels"<br>
CMASK=022<br>NSS_HASH_ALG_SUPPORT=+MD5<br><br>but it did not make any difference after reboot, e.g.: <br><br> # ldapsearch -h <a href="http://ldap.xxx.net">ldap.xxx.net</a> -p 636 -Z -v -P /var/ldap/cert8.db -D "cn=Directory Manager" -b "dc=xxx,dc=net" "cn=Thierry Bingen"<br>
ldapsearch: started Mon Sep 2 15:29:40 2013<br> ldap_init( <a href="http://ldap.xxx.net">ldap.xxx.net</a>, 636 )<br> ldap_simple_bind: Can't contact LDAP server<br><br>while the exact same command given on an r151004 gives:<br>
<br> ldapsearch: started Mon Sep 2 15:32:20 2013<br> ldap_init( <a href="http://ldap.xxx.net">ldap.xxx.net</a>, 636 )<br> filter pattern: cn=Thierry Bingen<br> returning: ALL<br> filter is: (cn=Thierry Bingen)<br>
version: 1<br> dn: cn=Thierry Bingen,ou=People,dc=xxx,dc=net<br> uid: tbingen<br>etc.<br><br>The LDAP server has not changed for a (long) while. It is opends@2.2.0-0.111 running on oi_148. MD5 seems to be its prime (only?) choice... <br>
<br>Any other advice?<br><br>Thanks, <br><br>T.<br></div>
`