Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-5202: Failed to start slapd with ldap TLS support via Centrify ldapproxy

Centrify DirectControl ,  

12 April,16 at 10:57 AM

Applies to: Centrify DirectControl version 5.2.2 (Suite 2015) and higher on all platforms.
 
Problem:
 
Failed to start slapd with ldap TLS support when started via centrify-ldapproxy
 
 
Cause:

When slapd is started via centrify-ldapproxy script with ldap TLS support (-h ldaps:///), the process starts without the added ldap TLS support parameters.

Example:

Good: /usr/share/centrifydc/libexec/slapd -h ldaps:///
Bad: /usr/share/centrifydc/bin/centrify-ldapproxy start -h ldaps:///
  

Workaround(for versions of DirectControl <5.2.3):

There are three options to work around this issue:
 
1. Provide a script where user (root) can modify the startup method to add the required '-h ldaps:///'
 
2. Create a trigger file within /etc/centrifydc/openldap which will allow the startup method to interrogate and choose '-h ldap:///' or '-h ldaps:///'
 
3. Correlation of (2), you may be able to reference a standalone configuration file to pick up all needed startup parameters.


Resolution:

As of Suite 2015.1, there is an added option in the startup script for ldapproxy: "STARTUP_OPTS". The service's startup script will source this option and pass the indicated startup options to slapd.

Example:To add the option for TLS support, the following method can be used:

Solaris:
# svccfg -s centrify-ldapproxy setprop 'slapd/STARTUP_OPTS=("-h" "ldaps:///")'

-- Demo -- 
root@vantaa-sol11:/usr/share/centrifydc/bin# svccfg -s centrify-ldapproxy setprop 'slapd/STARTUP_OPTS=("-h" "ldaps:///")'
root@vantaa-sol11:/usr/share/centrifydc/bin# centrify-ldapproxy start
Centrify-ldapproxy Service started.
root@vantaa-sol11:/usr/share/centrifydc/bin# ps -ef|grep slap
    root  9740     1   0 11:11:16 ?           0:00 /usr/share/centrifydc/libexec/slapd -h ldaps:///
----------


RHEL/Debian/HPUX/SUSE/other:
# echo "STARTUP_OPTS=\"-h ldaps:///\"" >> /etc/rc.config.d/centrify-ldapproxy

-- Demo --
[root@au_64rhel5 init.d]# echo "STARTUP_OPTS=\"-h ldaps:///\"" >> /etc/sysconfig/centrify-ldapproxy
[root@au_64rhel5 init.d]# /etc/init.d/centrify-ldapproxy start
Starting Centrify ldapproxy:                               [  OK  ]
[root@au_64rhel5 init.d]# ps -ef|grep slap
    root     16645     1  0 11:15 ?        00:00:00 /usr/share/centrifydc/libexec/slapd -h ldaps:///
----------

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.