Subject: LDAPS and non-anonymous binds supported in Pine?

From: Derek Diget <[email-masked]>
Date: Mon, 25 Aug 2003 12:00:12 -0400 (EDT)

My company just started refusing anonymous binds from outside the
firewall to our company LDAP address book.  To access the address book
from outside the firewall we now have to bind over SSL and authenticate
with a DN.  From looking through the doc tree in the source as well as
Google web and groups, I can not find any information on Pine being able
to work in our new environment.  Is that correct?  If Pine can support
non-anonymous binds over SSL, can you point me to some docs on how to
set it up.  (This is for both UNIX Pine as well as PC-Pine and we
already build UNIX Pine with SSL, LDAP and Kerberos support so it is not
a "need to be built with..." issue.)

Thanks.

-- 
Derek

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Kenneth Crudup <[email-masked]>
Date: Tue, 26 Aug 2003 00:15:09 -0700 (PDT)

On Mon, 25 Aug 2003, Derek Diget wrote:

> to work in our new environment.  Is that correct?

As of the time I asked last year, that appears to be right.

Shame, too- 'cause I'd *really* prefer to use the company's address
book (but at the same time, wondering why they're so anal about it,
as they should at least allow anonymous access *within* the local net).

	-Kenny

-- 
Kenneth R. Crudup  Sr. SW Engineer, Scott County Consulting, Los Angeles
H: 3801 E. Pacific Coast Hw #9, Long Beach, CA 90804-2014 (888) 454-8181
W: 2052 Alton Parkway, Irvine, CA 92606-4905	     (949) 252-1111-X240

---

From: othermark <[email-masked]>
Date: Tue, 26 Aug 2003 15:33:31 +0000 (UTC)

In article <[email-masked]>, 
> as they should at least allow anonymous access *within* the local net).

I had this same problem, but solved it.  Here's how:

1. I installed stunnel on my client machine (www.stunnel.org), create
   a cert and use a similar config to:

# stunnel.conf
cert=/usr/local/etc/stunnel.pem

client=yes

#debug=7
#foreground=yes

pid=/var/run/stunnel.pid

[ldaps]
accept=389
connect=your.ldap.server_here:636

   And startup your stunnel service.

2. Modify the pine source code.  This really only works if you are 
   doing a lookup against 1 ldap server, but it would be simple to
   add a loop through multiple credentials.

   - edit pine/bldaddr.c
   - find the ldap_lookup() function, and the ldap_simple_bind_s()
     function call (in 4.56 this is at line 5344).
   - change the NULL, NULL arguments to the login DN and password.
     for example:

	 if(ldap_simple_bind_s(ld, NULL, NULL) != LDAP_SUCCESS){

	 becomes

	 if(ldap_simple_bind_s(ld, 
	    "cn=Joe User,cn=Users,dc=Company,dc=Domain,dc=com",
	    "mypassword") != LDAP_SUCCESS){

   - save the file off.
   - compile

3. Run your new pine exe

4. Config your directory server entry to point to localhost:389,
   and the correct search base.

5. Enjoy ssl and authenticated ldaps access from pine.

That being said, it _really_ should not be that hard to add this to
the UI, so that instead of passing NULL NULL, a user DN/password is
passed.   A person with more spare time than I could make up a patch
following the other numerous pine patches to at least add authenticated
ldap support to the mailer.   A person with even more spare time than
that could leverage the existing imaps code and maybe the service
parsing syntax to add ssl support to that.

---
Mark
atkin901 at NOSPAM yahoo dot com
(!wired)?(coffee++):(wired);