我的机构希望使用 OpenLDAP 配置我们的一台 Ubuntu 服务器，以便与我们的 SSO 提供商 Okta 交互，使用他们用于将用户从云服务配置到 LDAP 的服务器端代理。我一直在努力让我们的 LDAP 服务器与 Okta 通信，最近 Okta 的一位支持人员告诉我，我的配置失败了，因为我的服务器发送的是 TLSv1.1 数据包，而他们的服务器响应的是 TLSv1.2 数据包。出于这个原因，也为了我们用户的安全，我想强制 LDAP 至少使用 TLSv1.2，但是，当我尝试使用 ldap_modify 和以下 ldif 文件时：
dn: cn=config
add: olcTLSCipherSuite
olcTLSCipherSuite: ALL:!TLSv1:TLSv1.2:TLSv1.3:!NULL
LDAP 抛出错误：
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
即使使用更简单的密码列表，我也会遇到同样的错误，例如：
olcTLSCipherSuite: ALL
我相信我的 SSL 已正确配置并且似乎正在运行（即我可以使用 OpenSSL 从外部连接到它）并且我的证书标识如下：
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca-certificates.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/sasl2/my-ldap.crt
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/sasl2/my-ldap.key
并且 openldap 用户对所有这些都具有读取权限。
我不知道接下来该怎么做，而且我对 LDAP 的了解还不够多，无法对正在发生的事情做出有根据的猜测。如果有人能提供任何建议，我将不胜感激！我已将 LDAP 的日志记录启用为 (-1)，并将转储下面 ldap_modify 命令的一些输出。
Feb 13 14:47:27 poster slapd[20666]: #011#011one value, length 32
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 MOD dn="cn=config"
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 MOD attr=olcTLSCipherSuite
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: result not in cache (olcTLSCipherSuite)
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: add access to "cn=config" "olcTLSCipherSuite" requested
Feb 13 14:47:27 poster slapd[20666]: => acl_get: [1] attr olcTLSCipherSuite
Feb 13 14:47:27 poster slapd[20666]: => acl_mask: access to entry "cn=config", attr "olcTLSCipherSuite" requested
Feb 13 14:47:27 poster slapd[20666]: => acl_mask: to value by "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", (=0)
Feb 13 14:47:27 poster slapd[20666]: <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
Feb 13 14:47:27 poster slapd[20666]: <= acl_mask: [1] applying manage(=mwrscxd) (stop)
Feb 13 14:47:27 poster slapd[20666]: <= acl_mask: [1] mask: manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: => slap_access_allowed: add access granted by manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: add access granted by manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: slap_queue_csn: queueing 0x7f58dc103a30 20200213194727.142704Z#000000#000#000000
Feb 13 14:47:27 poster slapd[20666]: oc_check_required entry (cn=config), objectClass "olcGlobal"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "objectClass"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "cn"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcArgsFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcPidFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCACertificateFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCertificateFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCertificateKeyFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcToolThreads"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "structuralObjectClass"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "entryUUID"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "creatorsName"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "createTimestamp"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcLogLevel"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCipherSuite"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "entryCSN"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "modifiersName"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "modifyTimestamp"
Feb 13 14:47:27 poster slapd[20666]: send_ldap_result: conn=1017 op=1 p=3
Feb 13 14:47:27 poster slapd[20666]: send_ldap_result: err=80 matched="" text=""
Feb 13 14:47:27 poster slapd[20666]: send_ldap_response: msgid=2 tag=103 err=80
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 RESULT tag=103 err=80 text=
Feb 13 14:47:27 poster slapd[20666]: slap_graduate_commit_csn: removing 0x7f58dc103a30 20200213194727.142704Z#000000#000#000000
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 1 descriptor
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]: 12r
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: daemon: read active on 12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_get(12)
Feb 13 14:47:27 poster slapd[20666]: connection_get(12): got connid=1017
Feb 13 14:47:27 poster slapd[20666]: connection_read(12): checking for input on id=1017
Feb 13 14:47:27 poster slapd[20666]: op tag 0x42, time 1581623247
Feb 13 14:47:27 poster slapd[20666]: ber_get_next on fd 12 failed errno=0 (Success)
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_read(12): input error=-2 id=1017, closing.
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_closing: readying conn=1017 sd=12 for close
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 1 descriptor
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]: connection_close: deferring conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=2 do_unbind
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=2 UNBIND
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_resched: attempting closing conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_close: conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: removing 12
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 2 descriptors
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: conn=1017 fd=12 closed
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
答案1
唉。问题在于我使用的是 OpenSSL 语法作为 CipherSuite 属性，而不是 GnuTLS 语法。虽然我以前尝试过 GnuTLS，但一定是打字错误导致它第一次无法加载到配置中，这让我确信这不是问题（即我整个学习 LDAP 的经历，哈哈）。最终起作用的 .ldif 配置是：
dn: cn=config
changetype: modify
add: olcTLSCipherSuite
olcTLSCipherSuite: SECURE256:+SECURE128:-VERS-TLS-ALL:+VERS-TLS1.2:+VERS-DTLS1.2:-RSA:-DHE-DSS:-CAMELLIA-128-CBC:-CAMELLIA-256-CBC