当 ldap.OPT_X_TLS_REQUIRE_CERT 设置为 ldap.OPT_X_TLS_NEVER 时出现 Python LDAP TLS 错误

Question

使用 python-ldap 时，我将 ldap.OPT_X_TLS_REQUIRE_CERT 设置为 ldap.OPT_X_TLS_NEVER，但我仍然收到 TLS 错误。我试过 ldap.set_option 和你在下面看到的版本。两者都会产生相同的错误。

class adldap_connection:
    def __init__(self, configuration, secure):
        self.configuration = configuration
        self.secure = secure
        self.ldap_host_template = string.Template(self.configuration['host'])
        if self.secure:
            self.ldap_host = self.ldap_host_template.substitute(port=self.configuration['secure_port'])
        else:
            self.ldap_host = self.ldap_host_template.substitute(port=self.configuration['standard_port'])

    def __enter__(self):
        try:
            self.ld = ldap.initialize(self.ldap_host)
            if self.configuration['verify_ssl']['verify']:
                self.ld.set_option(ldap.OPT_X_TLS_CACERTFILE, self.configuration['verify_ssl']['use'])
                print "ldap.OPT_X_TLS_CACERTFILE = %d" % ldap.OPT_X_TLS_CACERTFILE
            else:
                self.ld.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
                print "ldap.OPT_X_TLS_REQUIRE_CERT = %d" % ldap.OPT_X_TLS_REQUIRE_CERT
                print "ldap.OPT_X_TLS_NEVER = %d" % ldap.OPT_X_TLS_NEVER
                #ldap.set_option(ldap.OPT_X_TLS_NEWCTX, 0)

            self.ld.simple_bind_s(self.configuration['binduser'], self.configuration['bindpassword'])
        except ldap.LDAPError, error_message:
            print "Couldn't Connect. %s " % error_message
            print "Using CA: %s" % self.configuration['verify_ssl']['use']
            if (self.configuration['verify_ssl']['use']):
                print "File exists: %s" % os.path.exists(self.configuration['verify_ssl']['use'])
        return self.ld

    def __exit__(self, exc_type, exc_value, traceback):
        self.ld.unbind_s()

我得到这个异常

ldap.OPT_X_TLS_REQUIRE_CERT = 24582
ldap.OPT_X_TLS_NEVER = 0
Couldn't Connect. {'info': "TLS error -8179:Peer's Certificate issuer is not recognized.", 'desc': "Can't contact LDAP server"}

Answer 1

来自 python-ldap 邮件列表:

If you want to set connection-specific TLS parameters you must use

self.ld.set_option(ldap.OPT_X_TLS_NEWCTX, 0)

as last call to setoption() with TLS parameter.

我最终得到了这个，它适用于这两种情况

    try:
        self.ld = ldap.initialize(self.ldap_host)
        if self.configuration['verify_ssl']['verify']:
            self.ld.set_option(ldap.OPT_X_TLS_CACERTFILE, self.configuration['verify_ssl']['use'])
        else:
            self.ld.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
        self.ld.ldap.set_option(ldap.OPT_X_TLS_NEWCTX, 0)