基本上遵循了中的说明https://support.google.com/a/answer/9089736(SSSD(其他linux发行版((介绍如何在ubuntu客户端上设置谷歌安全LDAP。我的sssd.conf
配置如下:
[sssd]
debug_level = 7
domains = mydomain.com
[pam]
debug_level = 7
[nss]
debug_level = 7
[domain/mydomain.com]
debug_level = 7
cache_credentials = true
ldap_tls_cert = /var/google_ldap.crt
ldap_tls_key = /var/google_ldap.key
ldap_uri = ldaps://ldap.google.com:636
ldap_search_base = dc=mydomain,dc=com
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307bis
ldap_user_uuid = entryUUID
enumerate = false
ldap_tls_cipher_suite = NORMAL:!VERS-TLS1.3`
sssd日志、nss日志和pam日志都正常,并且所有sssd服务都在运行/侦听。然而,当执行ldapsearch查询LDAPTLS_CERT=/var/google_ldap.crt LDAPTLS_KEY=/var/google_ldap.key ldapsearch -H ldaps://ldap.google.com:636 -b dc=mydomain,dc=com '(mail=my.name@mydomain.com)' -d 7
时,我得到以下输出:
ldap_url_parse_ext(ldaps://ldap.google.com:636)
ldap_create
ldap_url_parse_ext(ldaps://ldap.google.com:636/??base)
ldap_pvt_sasl_getmech
ldap_search
put_filter: "(objectclass=*)"
put_filter: simple
put_simple_filter: "objectclass=*"
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP ldap.google.com:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying 216.239.32.58:636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect:
connect success
TLS: peer cert untrusted or revoked (0x42)
TLS: can't connect: (unknown error code).
ldap_msgfree
ldap_err2string
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
additional info: (unknown error code)
运行openssl s_client -connect ldap.google.com:636 -CAfile /etc/ssl/certs/ca-certificates.crt
会根据ldap.google.com验证我的证书。所以我对错误日志很困惑。
问题与我的客户端设置无关,而是Google LDAP本身的配置问题。