ACMELDAP with Active Directory

[Thomas Pauli]

Since we are urged by our auditors to introduce a strict password policy in our company, we established an W2003 Active Directory Server which handles the authorization requests for most our customer logins. A lot of our users still use interactive logins on a range of OpenVMS systems, which are not synchronized with Active Directory and require different passwords. We aim to authenticate non-core users on these systems external via ACME and LDAP.
To check this out we installed a DS10 alpha with OpenVMS V8.3, Update V2, TCP/IP V5.6, added VMS83A_ACMELDAP-V0200 and V83_ACMELDAP_STD, and tried to establish an ACME LDAP server.
We created a sys$manager:ldapacme.ini, had a logical ldapacme$init pointing to it and use these commands:
$ def/syst/exec ldapacme$init sys$manager:ldapacme.ini
$ def/syst/exec ldapacme$no_tls true
$ set noon
$ set server acme /exit
$ dele/nolog/noconf sys$manager:acme$server.log;*
$ set server acme /start
$ set server acme /trace=10
$ set server acme /conf=(name=VMS)
$ set server acme /conf=(name=LDAP,fac=LDAPACME,cred=VMS)
$ set server acme /enable=name=vms
$ set server acme /enable=name=ldap
$ type sys$manager:acme$server.log;*
We were only partially sucessful, since we only got this:
ACME Agent id: 2 State: Initialized
Name: "LDAP"
Image: "DISK$SYSFEP:[VMS$COMMON.SYSLIB]LDAPACME$LDAP_ACMESHR.EXE;1"
Identification: "LDAPACME Agent V1.0-BL2"
Information: "ldap_agent initialized, waiting to be enabled"
Domain of Interpretation: Yes
Execution Order: 0
The log file contains lines like
%ACME-I-TRACE, trace event from "ACME_ReadControlMBX: Enable received" on 18-AP?
-ACME-I-THREAD, thread: id = 1, type = CONTROL
%ACME-I-TRACE, trace event from "ACME_EnableServer: ERROR" on 18-APR-2007 07:18?
-ACME-I-THREAD, thread: id = 1, type = CONTROL
-ACME-I-EXITSTATUS, exiting with status = %X074ABEB2

Has somebody an idea what's possibly wrong?

[John Gillings]

Thomas,
According to the status:

$ exit %X074ABEB2
%ACME-E-INCOMPATSTATE, server state is incompatible with requested operation



Note that the /TRACE value is a bitmask. Value 10 will trace "general" and "ast" operations only. You may wish to enable more things. To enable everything use /TRACE=2047 (to make things clearer when dealing with bitmasks, it might be better to use hex /TRACE=%X7FF)

[Thomas Pauli]

Thanks for that hint, but I am still not wiser! I included the new log file generated with /TRACE=%x7FF - perhaps there is someon who can see what's wrong.

[John Gillings]

Thomas,
You have a different status:

-ACME-I-GETCLIENTF, client message acquisition failure, status = %X074AD83A

$ exit %X074AD83A
%ACME-E-NOMSGFND, no acceptable message found

Anything in the log files from the directory server?

[Thomas Pauli]

I've got a TCPTRACE running which shows absolutely nothing. The server seems not to be ready to try to connect yet.

[john Dite]

I assume you are planning the LDAP server available on OpenVMS. If not, how are you planning to define the required schema on the external LDAP server?

Have you started/configured the OpenVMS LDAP/Directory Server?

If you check for the DXD$DSA_SERVER process then that will tell you that an attempt was made to start the Directory server.

If you have DECnet+ installed the following NCL command will show you the status:

$MC NCL SHOW DSA ALL STATUS

Then see if the LDAP Port has been set:

$MC NCL SHOW DSA LDAP PORT

[Thomas Pauli]

The external Server is an existing MS Windows 2003 Server. The current problem is how to start the ACME LDAP server, connecting and questioning the external LDAP server will be the next one...

[john Dite]

Thomas

can you show us the contents of your sys$manager:ldapacme.ini file.

[john Dite]

Thomas,

the existing ACME LDAP Server is based on the OpenVMS Enterprise Directory V5.5+ (?). You will have to install this kit and then depending whether you have DECnet installed or not use either a JAVA or the NCL utility to initally set up the directory.

I'm sure this is all described in the accompanying documentation.

As I have said before, if you're planning to use an external LDAP server you'll have to find a way to integrate the ACME schema files on the remote LDAP server.

[Richard Whalen]

You might want to consider Process Software's VAM product. http://www.process.com/VMSauth/index.html
It has the necessary glue between loginout and Active Directory.