LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

TLS Support
Starting with LDAP-UX Client Services B.04.10, the product supports a new extension operation
of TLS (Transport Security Socket) protocol called startTLS to secure communication between
LDAP clients and the Windows Active Directory Server. An encrypted session can be established
on an un-encrypted port, 389. If an encrypted port is used, it will fail to establish the secure
connection. The TLS protocol provides administrators better flexibility for using TLS in their
environment by allowing the use of an un-encrypted LDAP port for communication between
the clients and the server. LDAP-UX supports TLS with password as the credential, using either
simple bind or SASL GSSAPI authentication to ensure confidentiality and data integrity between
clients and servers.
The LDAP-UX Client Services supports Microsoft Windows 2003 or 2003 R2 Active Directory
Server (ADS), Netscape Directory Server (NDS) 6.x and Red Hat Directory Server 7.0/7.1 over
TLS.
Configuration Parameters
LDAP-UX Client Services provides the following parameter in the /etc/opt/ldapux/ldapux_client.conf
file to support TLS.
enable_starttls This integer variable controls whether the TLS feature is enabled or
disabled. The valid values of this parameter are 1 and 0. If you choose
to enable TLS, set this parameter to 1. To disable TLS, set this variable
to 0. By default, TLS is disabled. If the enable_startTLS parameter is
undefined or does not exist, it is processed as the TLS feature is disabled.
If you want to use SSL or TLS, you must perform the following tasks before you run the setup
program:
• Ensure to have the certificate database files, cert8.db or cert7.db and key3.db, on your client
system. See “Configuring the LDAP-UX Client to Use SSL or TLS”for details.
• If you choose to enable TLS, set the enable_starttls parameter to 1 in the
/etc/opt/ldapux/lldapux_client.conf file. To use SSL, set enable_starttls to 0. By default,
TLS is disabled.
Configuring the LDAP-UX Client to Use SSL or TLS
You can choose to enable SSL or TLS with LDAP-UX when you run the setup program. If you
want to use SSL or TLS, you must install Certificate Authority (CA) certificate on your LDAP-UX
Client and configure your LDAP directory server to support SSL or TLS before you run the setup
program.
NOTE: If you already have the certificate database files, cert7.db or cert8.db and key3.db, on your
client for your HP-UX applications, you can simply create a symbolic link /etc/opt/ldapux/cert7.db
that points to cert7.db or /etc/opt/ldapux/cert8.db that points to cert8.db and /etc/opt/ldapux/key3.db
that points to key3.db.
Steps to Download the CA Certificate from Windows 2000 CA Server
Downloading the certificate database from the Netscape Communicator is one way to set up the
certificate batabase into your LDAP-UX Client.
The following steps show you an example on how to download the Certificate Authority (CA)
certificate from Windows 2000 Certificate Authority Server using Netscape Communicator 4.75:
1. Log in to your system as root.
2. Use Netscape Communicator to connect to your Certificate Authority Server. The following
shows an example of using a link to connect to your CA Server:
http://ADS servername/CertSrv
50 Installing LDAP-UX Client Services