ldap.set_option(ldap.OPT_X_TLS_CACERTFILE...) error

[sallas]

Hi,

I have a simple LDAPS script:

#!/usr/bin/python2.3
import sys
import ldap
 
if __name__ == '__main__':
        ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
        ldapmodule_trace_level = 1
        ldapmodule_trace_file = sys.stdout
        ldap.set_option(ldap.OPT_X_TLS_ALLOW,1)
        ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, "/etc/ssl/certs/f64d9715.0")
 

executing fine on one server, however having it on another server throws the following error:

 
  File "./test2.py", line 12, in ?
    ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, "/etc/ssl/certs/f64d9715.0")
  File "/usr/lib/python2.3/site-packages/ldap/functions.py", line 104, in set_option
    _ldap_function_call(_ldap.set_option,option,invalue)
  File "/usr/lib/python2.3/site-packages/ldap/__init__.py", line 62, in _ldap_function_call
    result = apply(func,args,kwargs)
ldap.LDAPError: {'errnum': -1}

I have validated the certificate is correct using an openSSL command (get a "Verify return code: 0 (ok)"). The only difference I can see is that the one that is working is using openSSL 0.9.7e and Python 2.3.5, while the one not working is using openSSL 0.9.6c and Python 2.3.4. Is this enough to cause an error? I have been unable to find any requirements for ldap.OPT_X_TLS_CACERTFILE. Unfortunately upgrading the openSSL and Python is a big job considering the amount of testing of existing python scripts on the server, so I need to make sure this is the issue.
TIA.

[bartonc]

Hi,

I have a simple LDAPS script:

#!/usr/bin/python2.3
import sys
import ldap
 
if __name__ == '__main__':
        ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
        ldapmodule_trace_level = 1
        ldapmodule_trace_file = sys.stdout
        ldap.set_option(ldap.OPT_X_TLS_ALLOW,1)
        ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, "/etc/ssl/certs/f64d9715.0")
 

executing fine on one server, however having it on another server throws the following error:

 
  File "./test2.py", line 12, in ?
    ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, "/etc/ssl/certs/f64d9715.0")
  File "/usr/lib/python2.3/site-packages/ldap/functions.py", line 104, in set_option
    _ldap_function_call(_ldap.set_option,option,invalue)
  File "/usr/lib/python2.3/site-packages/ldap/__init__.py", line 62, in _ldap_function_call
    result = apply(func,args,kwargs)
ldap.LDAPError: {'errnum': -1}

I have validated the certificate is correct using an openSSL command (get a "Verify return code: 0 (ok)"). The only difference I can see is that the one that is working is using openSSL 0.9.7e and Python 2.3.5, while the one not working is using openSSL 0.9.6c and Python 2.3.4. Is this enough to cause an error? I have been unable to find any requirements for ldap.OPT_X_TLS_CACERTFILE. Unfortunately upgrading the openSSL and Python is a big job considering the amount of testing of existing python scripts on the server, so I need to make sure this is the issue.
TIA.

That's not a very friendly error message.
The current version of ldap installs as a package and is probably available for 2.3.
In 2.4, using this (not so clean, but quick test):

#!/usr/bin/python2.4
import sys
from ldap import *
 
if __name__ == '__main__':
    set_option(OPT_DEBUG_LEVEL,255)
    ldapmodule_trace_level = 1
    ldapmodule_trace_file = sys.stdout
    set_option(OPT_X_TLS_ALLOW,1)
    set_option(OPT_X_TLS_CACERTFILE, "/etc/ssl/certs/f64d9715.0")
 

I received no errors.
I believe that keeping your software up-to-date is worth the work (that way, things like this are less likely to occure.

[sallas]

Thanks Bartonc, I may have to set up a Test machine so as to trial with the 'old' library versions to prove this is the issue.
Yes, it would be best to keep all software libraries up to date. Unfortunately I'm not the UNIX programmer/owner of this server (am doing their job of modifying scripts to connect to my MS Active Directory) and have been informed that there have been no system upgrades as they cause issues with other applications on the server (sigh).

[bartonc]

Thanks Bartonc, I may have to set up a Test machine so as to trial with the 'old' library versions to prove this is the issue.
Yes, it would be best to keep all software libraries up to date. Unfortunately I'm not the UNIX programmer/owner of this server (am doing their job of modifying scripts to connect to my MS Active Directory) and have been informed that there have been no system upgrades as they cause issues with other applications on the server (sigh).

You are welcome. You can call me "Barton".