APACHE/PHP authentication to LDAP RHDS server

[Bric]

I’ve been having some issues getting PHP working with secure LDAP authentication. I’m posting this in the hopes someone has been more successful then I am and can help me figure this out or at the very least determine if this is indeed broken and should open a support call with HP.

This is what I’m working with

“Server A”:
OS v. B.11.31 september 2009 rel.
hpuxws22Apache B.2.2.8.05 HP-UX Apache-based Web Server
LDAPUX B.04.20 LDAP-UX Integration

Authenticating against ”Server B” running

Red Hat Directory Server v8.0.4 on B.11.23

I have imported the cacert on Server A. I can successfully authenticate using simple binds on port 389 using PHP. I can also perform a ldapsearch binding on port 636 and connect successfully. I’ve also had people authenticate securely to it using java as well.

For example:
/opt/ldapux/bin/ldapsearch -h serverb -p 636 -b "o=xxx" -D "uid=diradmin,ou=unix,o=xxx" -w - -P /etc/opt/ldapux/cert8.db "uid=*" will perform successfully and return all the uid it found.

The problem happens when I try to ssl authentication to the RHDS using PHP. The RHDS is configured to use TLS so start ssl. The function used to do this should be ldap_start_tls (http://php.net/manual/en/function.ldap-start-tls.php) . This function does not seem to be defined in the standard LDAP.so php librabry that is included in the apache bundle. It generates this error message “Fatal error: Call to undefined function ldap_start_tls()” . I’ve toyed with changing to specifying ldaps://server in an ldap_connect functions like I’ve seen talked about on the web but for some reason when using this it tries to use the apache keystore instead of the ldapux one which gives me a “conn=180 op=-1 fd=68 closed - Peer does not recognize and trust the CA that issued your certificate “ on the RHDS access log. This makes no sense because if my LDAPUX on serverA didn’t trust server B I wouldn’t be able to bind to it with my ldapsearch query.
To me this seems like a library problem but I thought I’d check here to see if anyone had any insight into something I might of missed.

Thanks for you help.