Installing LTB SSP

Installing LTB SSP (Self Service Password) in a Windows
Environment
This document is intended as a quick “how to” and assumes that the reader has enough
technical skills to perform many of the functions without any detailed instructions.
1) Setup a simple Web Server.

Install Windows7 and run all appropriate updates. The windows 7 machine will be used
as a web server to host the LTB SSP scripts.
2) Use WAMP
I will be using WAMP (Windows, Apache, MySQL, and PHP) from:
http://www.wampserver.com/en/
I used version 2.2 , 32bit, w/PHP 5.3.13
Install WAMP with all the default settings. You may have to install the Microsoft Visual
C++ Redistributable Package before you can install WAMP. This is documented on the
WAMP web site. http://www.wampserver.com/en/
3) Make sure the WAMP PHP install has LDAP support.

In my setup, this required me to copy a file into the system32 folder of the Windows7
workstation. I had to copy libsasl.dll from the default location to the system32 directory.
Alternatively, you could probably just make sure that the directory with libsasl.dll is in
the system path.
After this file was copied, I restarted the Windows7 machine. I was then able to turn on
LDAP support from within the WAMP – PHP console and verify PHP-LDAP support
from the phpinfo() page.
4) Make sure your AD server has a certificate.
This is required for LDAPS connections. In an AD environment, you must use LDAPS
(Secure LDAP) to change passwords.
First, check and see if you already have certificates installed.
a) On your LDAP (Active Directory) Domain Controller select Start>mmc.exe
b) Select File>Add/Remove Snap-in,
c) Highlight “Certificates”, press “Add” then select “Computer Account” from
the pop up window, and select “Local Computer”, and “Finish”.
You should end up at a screen like this.
d) Expand the Certificates out to see “Personal” Certs.
e) If you already have Certificates here, look under the “Intended Purpose”
column, if it says “Client Authentication”……you are all set.
f) IMPORTANT : Notice (and document) the FQDN that your cert is issues to.
You will need this name. Any LDAPS connections made to this server MUST
use this name as the “server name”.
If you do not have Certificates already installed

The following article gives instructions on how to create a self signed Certificate.
http://technet.microsoft.com/en-us/library/ff710475(v=ws.10).aspx
If the above directions are not clear enough, Google the term “windows server 2008 r2
generate self-signed certificate”
You must have a certificate for “Client Authentication” for a LDAPS connection to work.
No LDAPS connection = No LTB SSP.
5) Test LDAP conductivity

Test LDAP conductivity from the Windows7 web server to the Active Directory LDAP
server.
Download ldp.exe from:
http://www.computerperformance.co.uk/w2k3/utilities/ldp.htm
You can use this utility to verify both LDAP and LDAPS connections to the Active
Directory LDAP server.
For LDAPS connection tests you MUST use the EXACT SAME NAME as in the “Issued
to” column in section 4-f (above).
Make sure you can connect and bind using both LDAP and LDAPS.
6) Install the LTB Self Service Password files to the WAMP “www” directory.
Simply unzip, and copy the files over.
7) Create a ldap.conf file
Create a directory structure and file named ldap.conf at C:\OpenLDAP\sysconf\

Add a single line to the file
“TLS_REQCERT allow”
Save and exit.
(I’m unsure if this step is truly necessary, but, it’s how I did it, and SSP works for me…
your mileage may vary)
8) Browse to the webservers SSP install dir
If everything is working you should get the default page.
9) Modify the config.inc.php

Follow the installation instructions at the LTB SSP web site.
The rest of the setup is well documented, and fairly simple.
$ldap_url = "ldaps://myserver.almaschools.net”;
$ldap_binddn = "CN=Administrador,CN=Users,DC=Almaschools,DC=net”;
$ldap_bindpw = “mypassword”;
$ldap_base = "OU=Almaschools,DC=Almaschools,DC=net ";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter ="(&(objectClass=user)(sAMAccountName={login})(!
(userAccountControl:1.2.840.113556.1.4.803:=2)))";
# Active Directory mode

# true: use unicodePwd as password field
# false: LDAPv3 standard behavior
$ad_mode = true;
NOTICE that I use my FQDN as found in the Certificate setup in my ldaps

connection string. For me, this was the key to getting LDAPS to work correctly.
The most difficult part of getting the LTB SSP application running was the setup and
verification of LDAPS. Once that was achieved, everything else fell into place.

Installing LTB SSP

Uploaded by

Copyright:

Available Formats

Installing LTB SSP

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Installing LTB SSP

Uploaded by

Copyright:

Available Formats

Installing LTB SSP (Self Service Password) in a Windows

1) Setup a simple Web Server.

I used version 2.2 , 32bit, w/PHP 5.3.13

3) Make sure the WAMP PHP install has LDAP support.

d) Expand the Certificates out to see “Personal” Certs.

If you do not have Certificates already installed

5) Test LDAP conductivity

7) Create a ldap.conf file

Create a directory structure and file named ldap.conf at C:\OpenLDAP\sysconf\

8) Browse to the webservers SSP install dir

If everything is working you should get the default page.

9) Modify the config.inc.php

# Active Directory mode

NOTICE that I use my FQDN as found in the Certificate setup in my ldaps

You might also like