我的机构想要使用 OpenLDAP 配置我们的一台 Ubuntu 服务器，以便与我们的 SSO 提供商 Okta 交互，使用他们拥有的服务器端代理将用户从他们的云服务配置到 LDAP。我一直在努力让我们的 LDAP 服务器与 Okta 对话，最近 Okta 的一名支持人员告知我的配置失败，因为我的服务器正在发送 TLSv1.1 数据包，而他们的服务器正在响应 TLSv1.2 数据包。出于这个原因，以及为了我们用户的安全，我想强制 LDAP 至少使用 TLSv1.2，但是，当我尝试将 ldap_modify 与以下 ldif 文件一起使用时：
dn: cn=config
add: olcTLSCipherSuite
olcTLSCipherSuite: ALL:!TLSv1:TLSv1.2:TLSv1.3:!NULL
LDAP 抛出错误：
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
即使使用更简单的密码列表，我也会遇到相同的错误，例如：
olcTLSCipherSuite: ALL
我相信我的 SSL 配置正确并且似乎正在运行（即我可以使用 OpenSSL 从外部连接到它）并且我的证书标识如下：
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca-certificates.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/sasl2/my-ldap.crt
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/sasl2/my-ldap.key
并且 openldap 用户对所有这些都具有读取权限。
我不知道从这里去哪里，并且对 LDAP 的了解几乎不足以对正在发生的事情做出有根据的猜测。对于任何人可以提供的任何建议，我将不胜感激！我在 (-1) 处启用了 LDAP 的日志记录，并将转储下面 ldap_modify 命令的一些输出。
Feb 13 14:47:27 poster slapd[20666]: #011#011one value, length 32
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 MOD dn="cn=config"
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 MOD attr=olcTLSCipherSuite
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: result not in cache (olcTLSCipherSuite)
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: add access to "cn=config" "olcTLSCipherSuite" requested
Feb 13 14:47:27 poster slapd[20666]: => acl_get: [1] attr olcTLSCipherSuite
Feb 13 14:47:27 poster slapd[20666]: => acl_mask: access to entry "cn=config", attr "olcTLSCipherSuite" requested
Feb 13 14:47:27 poster slapd[20666]: => acl_mask: to value by "gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth", (=0)
Feb 13 14:47:27 poster slapd[20666]: <= check a_dn_pat: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
Feb 13 14:47:27 poster slapd[20666]: <= acl_mask: [1] applying manage(=mwrscxd) (stop)
Feb 13 14:47:27 poster slapd[20666]: <= acl_mask: [1] mask: manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: => slap_access_allowed: add access granted by manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: => access_allowed: add access granted by manage(=mwrscxd)
Feb 13 14:47:27 poster slapd[20666]: slap_queue_csn: queueing 0x7f58dc103a30 20200213194727.142704Z#000000#000#000000
Feb 13 14:47:27 poster slapd[20666]: oc_check_required entry (cn=config), objectClass "olcGlobal"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "objectClass"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "cn"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcArgsFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcPidFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCACertificateFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCertificateFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCertificateKeyFile"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcToolThreads"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "structuralObjectClass"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "entryUUID"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "creatorsName"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "createTimestamp"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcLogLevel"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "olcTLSCipherSuite"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "entryCSN"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "modifiersName"
Feb 13 14:47:27 poster slapd[20666]: oc_check_allowed type "modifyTimestamp"
Feb 13 14:47:27 poster slapd[20666]: send_ldap_result: conn=1017 op=1 p=3
Feb 13 14:47:27 poster slapd[20666]: send_ldap_result: err=80 matched="" text=""
Feb 13 14:47:27 poster slapd[20666]: send_ldap_response: msgid=2 tag=103 err=80
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=1 RESULT tag=103 err=80 text=
Feb 13 14:47:27 poster slapd[20666]: slap_graduate_commit_csn: removing 0x7f58dc103a30 20200213194727.142704Z#000000#000#000000
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 1 descriptor
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]: 12r
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: daemon: read active on 12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_get(12)
Feb 13 14:47:27 poster slapd[20666]: connection_get(12): got connid=1017
Feb 13 14:47:27 poster slapd[20666]: connection_read(12): checking for input on id=1017
Feb 13 14:47:27 poster slapd[20666]: op tag 0x42, time 1581623247
Feb 13 14:47:27 poster slapd[20666]: ber_get_next on fd 12 failed errno=0 (Success)
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_read(12): input error=-2 id=1017, closing.
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_closing: readying conn=1017 sd=12 for close
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 1 descriptor
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]: connection_close: deferring conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=2 do_unbind
Feb 13 14:47:27 poster slapd[20666]: conn=1017 op=2 UNBIND
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_resched: attempting closing conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: connection_close: conn=1017 sd=12
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: removing 12
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on 2 descriptors
Feb 13 14:47:27 poster slapd[20666]: daemon: activity on:
Feb 13 14:47:27 poster slapd[20666]:
Feb 13 14:47:27 poster slapd[20666]: conn=1017 fd=12 closed
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=8 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=9 active_threads=0 tvp=zero
Feb 13 14:47:27 poster slapd[20666]: daemon: epoll: listen=10 active_threads=0 tvp=zero
叹。问题是我对 CipherSuite 属性使用 OpenSSL 语法，而不是 GnuTLS 语法。尽管我之前尝试过 GnuTLS，但肯定是有一个错字导致它第一次无法加载到配置中，这让我确信这不是问题（即我学习 LDAP 的整个经历，哈哈）。最终工作的 .ldif 配置是：
这是此处找到的 RHEL TLS 强化指南中推荐的规范。