How to connect to LDAP over Secure Port 636 from Oracle

Aniket Narvankar

We are using LDAP to find the list of active users. From DB we are connecting to LDAP. The DB Servers are on Linux Azure Cloud.
From DB Servers to LDAP Servers we raised a Azure Firewall request for both port 636(Encrypted Port) and 389(Non Encrypted Port). Firewall rules are in place and connectivity is working. Now from DB able to connect to LDAP over port 389 but not able to connect to LDAP over port 636. For port 636 it gives following error DBMS_LDAP Still Fails: ORA-31202: DBMS_LDAP: LDAP client/server error: SSL handshake failed
What needs to be done for this,please can someone suggest?

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Aniket Narvankar2y ago
What is SID = ORCL?
0
Mohammad Hussain2y ago
Please try this:
- Verify that the LDAP server has a valid SSL/TLS certificate issued by a trusted Certificate Authority (CA). If it's using a self-signed certificate, import the certificate into Oracle database's wallet to trust it.
- Check that the SSL/TLS protocols and cipher suites configured on the LDAP server match what Oracle supports. You may need to enable additional ciphers on the LDAP side.
- Confirm there are no intermediary devices like firewalls or proxies that could be terminating the SSL connection before it reaches the LDAP server.
- Check the LDAP server logs to see if there are any SSL-related errors logged when the Oracle database attempts to connect. Enable SSL debug logging.
- Validate that the TNSNAMES.ORA entry used from Oracle is correctly specifying SSL usage and the LDAP server's hostname matches the certificate. For example:
```
ORCL = 
  (DESCRIPTION = 
    (ADDRESS_LIST = 
      (ADDRESS = (PROTOCOL = TCPS)(HOST = ldapserver.example.com)(PORT = 636)) 
    )
    (CONNECT_DATA =
      (SID = ORCL)
    )
  )
```
- Test connectivity using OpenSSL client on DB server to isolate the problem:
```
openssl s_client -connect ldapserver.example.com:636
```
This should allow you to verify if SSL handshake works outside of Oracle, or fails there too indicating a server-side or network issue.
0
Aniket Narvankar2y ago
How to import ssl certificate of ldap server into oracle wallet? please guide.
we need to go on oracle db server and do this?

After performing below steps getting error as
DECLARE
l_session DBMS_LDAP.session;
retval PLS_INTEGER;
BEGIN
l_session := DBMS_LDAP.init('ldap.example.com', 636);
retval := DBMS_LDAP.open_ssl(l_session,'file:/u01/app/oracle/LDAP_WALLET/','pwd',2);
retval := DBMS_LDAP.SIMPLE_BIND_S(l_session,'domain\username','pwd');
END;
/

unable to open wallet
please suggest what more needs to be done
+2
Jayraj Chhaya2y ago
To connect to LDAP over the secure port 636 from Oracle, you need to ensure that the necessary configurations are in place. Here are the steps you can follow:
1. Verify SSL/TLS Configuration: Ensure that the SSL/TLS configuration is correctly set up on both the LDAP server and the Oracle database server. Check if the SSL certificate is valid and trusted by the Oracle server.
2. Import SSL Certificate: Import the SSL certificate of the LDAP server into the Oracle Wallet. The Oracle Wallet is a secure container that stores SSL certificates and keys used for secure connections. You can use the orapki utility to import the certificate.
3. Configure Oracle Wallet: Configure the Oracle Wallet to use the imported SSL certificate. This involves setting the SSL_CLIENT_AUTHENTICATION parameter in the sqlnet.ora file to TRUE and specifying the location of the wallet.
4. Test Connection: Test the connection to the LDAP server over port 636 using the DBMS_LDAP package. Here's an example of how to use the package to connect:
```
DECLARE
  l_session DBMS_LDAP.session;
BEGIN
  l_session := DBMS_LDAP.init('ldap.example.com', 636);
  -- Perform LDAP operations using the session
  DBMS_LDAP.unbind_s(l_session);
END;
```
Make sure to replace 'ldap.example.com' with the actual LDAP server hostname or IP address.
- Troubleshoot Errors: If you encounter any errors, such as the ORA-31202: DBMS_LDAP: LDAP client/server error: SSL handshake failed error you mentioned, check the Oracle database server logs and the LDAP server logs for more information. Ensure that the SSL/TLS configurations match on both sides and that the necessary firewall rules are in place.
0