AD auth for nagiosxi using SSL/Secure AD port

[kubben]

I would like to add our CA authority to our nagiosxi installs so i can run nagiosxi against our Active Directory servers on a secure port.

i went over this:

http://assets.nagios.com/downloads/nagi ... ponent.pdf

and after reading it added our CA cert exported from the signing auth server in pem format (x509) to the /etc/openldap/cacerts.pem file
edited the /etc/openldap/ldap.conf file to include

TLS_CACERT /etc/openldap/cacerts.pem

noting in the source document: http://www.vitki.net/book/page/how-acce ... -php-linux

Now tell OpenLDAP about your certificate verification means. Edit the /etc/openldap/ldap.conf file and add lines like these:

TLS_CACERTDIR /etc/openldap/cacerts
TLS_CACERT /etc/openldap/cacerts.pem
You are not required to use both bundle file and hashed directory at the same time, either method is sufficient.

however, once httpd was restarted, i received this error:

PHP Notice: Undefined variable: port in /usr/local/nagiosfusion/html/includes/components/active_directory/active_directory.inc.php on line 252

and i noticed the input line on line 252 was commented out.

so i uncommented it, and restarted, and on the manage components, Active Directory Integration, settings page i now had a field to type in the port. i have tried both 636 and 3269, both of which are listening.

openssl s_client -connect myadserver.com:3269 -CAfile /etc/openldap/cacerts.pem

and

openssl s_client -connect myadserver.com:636 -CAfile /etc/openldap/cacerts.pem

return with:

Verify return code: 0 (ok)

what else needs to be done for this to work?

(i have tried putting the cert in the certdir as well; same result.)

[kubben]

ah. we've been using round robin DNS with each AD server having specific SSL certs per server. while some applications will ignore the ssl cert not matching, apparently xi does not. using a specific server, SSL enabled LDAP access to AD works.

this is likely more a architecture issue on our end. anyone feel free to suggest alternative ways to accomplish this without tying to a specific AD server.

[scottwilkerson]

I havent tested this but you may be able to get around it using the Answer here
http://stackoverflow.com/questions/3866 ... -using-php

[kubben]

ah, thanks scott.