title: HOW-TO: LDAP bind+authenticate using python-ldap
body: <p>Could you please advise on how to troubleshoot the attempt below;
  am trying to bind to a ldap server, but in vain,
  when I do </p>
  
  <pre><code>openssl s_client -CApath /etc/pki/ca-trust/source/anchors/ -connect ...:636
  </code></pre>
  
  <p>It succeeds :</p>
  
  <pre><code> Verify return code: 0 (ok)
  </code></pre>
  
  <p>That is from system-side, but when I try to do a bind via python-ldap module : </p>
  
  <pre><code>In [1]: import ldap
  
  In [2]: l = ldap.initialize('ldaps://...:636')
  
  In [3]:  ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_ALLOW)
  
  In [4]: l.set_option(ldap.OPT_X_TLS_CACERTFILE,"/etc/pki/ca-trust/source/anchors/cacert.pem")
  
  In [5]: l.set_option(ldap.OPT_X_TLS_NEWCTX,0)
  
  In [6]: l.simple_bind_s("...", "...")
  ---------------------------------------------------------------------------
  SERVER_DOWN                               Traceback (most recent call last)
  &lt;ipython-input-6-a59dae8ba541&gt; in &lt;module&gt;()
  ----&gt; 1 l.simple_bind_s("...", "...")
  
  /usr/lib64/python2.7/site-packages/ldap/ldapobject.pyc in simple_bind_s(self, who, cred, serverctrls, clientctrls)
      205     simple_bind_s([who='' [,cred='']]) -&gt; None
      206     """
  --&gt; 207     msgid = self.simple_bind(who,cred,serverctrls,clientctrls)
      208     resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
      209     return resp_type, resp_data, resp_msgid, resp_ctrls
  
  /usr/lib64/python2.7/site-packages/ldap/ldapobject.pyc in simple_bind(self, who, cred, serverctrls, clientctrls)
      199     simple_bind([who='' [,cred='']]) -&gt; int
      200     """
  --&gt; 201     return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
      202 
      203   def simple_bind_s(self,who='',cred='',serverctrls=None,clientctrls=None):
  
  /usr/lib64/python2.7/site-packages/ldap/ldapobject.pyc in _ldap_call(self, func, *args, **kwargs)
       97     try:
       98       try:
  ---&gt; 99         result = func(*args,**kwargs)
      100         if __debug__ and self._trace_level&gt;=2:
      101           if func.__name__!="unbind_ext":
  
  SERVER_DOWN: {'info': 'TLS error -8157:Certificate extension not found.', 'desc': "Can't contact LDAP server"}
  
  
  
  In [1]: import ldap
  
  In [2]: l = ldap.initialize('ldaps://...:636')
  
  In [3]: l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_ALLOW)
  
  In [4]: l.set_option(ldap.OPT_X_TLS_CACERTFILE,"/etc/pki/ca-trust/source/anchors/cacert.pem")
  
  In [5]: l.protocol_version = ldap.VERSION3
  
  In [6]: l.set_option(ldap.OPT_REFERRALS, 0)
  
  In [7]: l.simple_bind_s("...", "...")
  ---------------------------------------------------------------------------
  SERVER_DOWN                               Traceback (most recent call last)
  &lt;ipython-input-7-a59dae8ba541&gt; in &lt;module&gt;()
  ----&gt; 1 l.simple_bind_s("...", "...")
  
  /usr/lib64/python2.7/site-packages/ldap/ldapobject.pyc in simple_bind_s(self, who, cred, serverctrls, clientctrls)
      205     simple_bind_s([who='' [,cred='']]) -&gt; None
      206     """
  --&gt; 207     msgid = self.simple_bind(who,cred,serverctrls,clientctrls)
      208     resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
      209     return resp_type, resp_data, resp_msgid, resp_ctrls
  
  /usr/lib64/python2.7/site-packages/ldap/ldapobject.pyc in simple_bind(self, who, cred, serverctrls, clientctrls)
      199     simple_bind([who='' [,cred='']]) -&gt; int
      200     """
  --&gt; 201     return self._ldap_call(self._l.simple_bind,who,cred,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))
      202 
      203   def simple_bind_s(self,who='',cred='',serverctrls=None,clientctrls=None):
  
  /usr/lib64/python2.7/site-packages/ldap/ldapobject.pyc in _ldap_call(self, func, *args, **kwargs)
       97     try:
       98       try:
  ---&gt; 99         result = func(*args,**kwargs)
      100         if __debug__ and self._trace_level&gt;=2:
      101           if func.__name__!="unbind_ext":
  
  SERVER_DOWN: {'info': "TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", 'desc': "Can't contact LDAP server"}
  </code></pre>