Verifying client certificate while adding StartTLS and LDAPS option in LDAP - c++

Question

I am writing an application which will allow user to login to the app using LDAP settings.
Sample program without Start TLS/LDAPS support:
#include <windows.h>
#include <winldap.h>
int main(){
LDAP *ldap =NULL;
int returnCode = -1;
int version = LDAP_VERSION3;
ldap = ldap_init(hostName, PORT);
if (ldap == NULL) {
printf("Failed to init LDAP connection");
return FALSE;
}
returnCode = ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, (void*)&version);
if (returnCode != LDAP_SUCCESS) {
cout<<"LDAP: Could not set options. Error: "<< returnCode <<" "<< ldap_err2string(returnCode);
ldap_unbind(ldap);
return FALSE;
}
returnCode = ldap_connect(ldap, NULL);
if (returnCode != LDAP_SUCCESS) {
printf("LDAP: Could not establish connection. Error: %d %s", returnCode, ldap_err2string(returnCode));
ldap_unbind(ldap);
return FALSE;
}
returnCode = ldap_bind_s(ldap, binddn, bindpwd, LDAP_AUTH_SIMPLE);
if (returnCode != LDAP_SUCCESS) {
printf("LDAP: Could not establish connection. Error: %d %s", returnCode, ldap_err2string(returnCode));
ldap_unbind(ldap);
return FALSE;
}
}
StartTLS can be implemented using ldap_start_tls_s function. But I want to verify the certificate before allowing the connections. Any suggestions?

Answer 1

The StarTLS is an extended LDAP operation and must be sent after you have established the connection. However, the server and/or client certificates verifications are part of the TLS protocol. So when you use ldap_start_tls_s function, it will be performed automatically.
If you want to verify the server certificate at the time of the connection, you should use LDAP over SSL, and connect to the LDAPS port. You can use the ldap_sslinit() method for that.