LDAP_SSL_SET_SUITEB_MODE

Edit online

Use the ldap_ssl_set_suiteb_mode API in an LDAP application to set Suite B mode.

Purpose

You can use the ldap_ssl_set_suiteb_mode() API in LDAP client utilities to set a Suite B mode value in a client environment. When you set Suite B mode in a client utility, the API sets Suite B mode internally in the GSKit environment. You must call this API before you issue a bind or any other operations that connects to the server.

Synopsis

#include <ldap.h>

int ldap_ssl_set_suiteb_mode( 
                char *suitebEnv)

Input parameters

suitebEnv
Specifies the address of the value to set with ldap_ssl_set_suiteb_mode().

Session settings

In IBM® Security Verify Directory, version 6.3, Fix Pack 17 or later, you can set Suite B mode in an LDAP client with the ldap_ssl_set_suiteb_mode() API. You must call the ldap_ssl_set_suiteb_mode() API with an appropriate value to set Suite B mode before you initialize GSKit environment with the gsk_envrionment_init call.

You can set Suite B mode after the ICC version of the libraries is set in the GSKit environment. You must also set the FIPS-140 certified cryptographic modules in the GSKit environment. The ldap_ssl_set_suiteb_mode() API internally configures the cryptographic modules. The ldap_ssl_set_suiteb_mode() API might fail if the settings cannot be configured in the GSKit environment.

You must pass the LDAP_OPT_SUITEB_MODE parameter to the ldap_ssl_set_suiteb_mode() API to set Suite B mode. The following values are valid for the LDAP_OPT_SUITEB_MODE parameter:

  • 128
  • 192

Before you prepare an LDAP connection, you must call the ldap_ssl_set_suiteb_mode() API and set the Suite B environment.

After you set Suite B mode in an LDAP client environment, you must connect to the secure port of a directory server with an LDAP client.

Note: An LDAP client uses the TLS 1.2 protocol to secure communication with a directory server. All other protocols, such as SSLv3, TLS 1.0, and TLS 1.1 are not supported.

Errors

If an error occurs, Suite B mode is not set. To obtain a detailed error report, you must run the application in debug mode and check the debug traces.

Examples

To configure Suite B mode for an LDAP client, use the following example:
char *suitebEnv=NULL;
if (ssl == 1){
      suitebEnv = getenv("LDAP_OPT_SUITEB_MODE");
      if (suitebEnv != NULL){
         ldap_ssl_set_suiteb_mode(suitebEnv);
      }
   }