Is it possible to pass extra data to VERIFYSERVERCERT?

Question

This was also asked on SO. The Win32 LDAP API has an option to set a certificate verification callback with

ldap_set_option(connection, LDAP_OPT_SERVER_CERTIFICATE, &callback);  

where callback is a VERIFYSERVERCERT function pointer. Is there any way to get extra, per-connection data into this function? Or if not, is the callback guaranteed to be invoked on the same thread as ldap_connect so that I can put extra data in thread-local storage?

My goal is to pass a memory-backed certificate store to hAdditionalStore in CertGetCertificateChain, so some other way to do that would also work.

Answer 1

Hi @Shane S

Yes the callback function is called in the same thread as the one that executed the ldap_connect. The callback function is passed the following parameters PLDAP, PCCERT_CONTEXT. You can then perform the required validation on the certificate, and as the return value from the callback function will be used to confirm the connection, you have full control over the verification process. I've used this functionality to delivery additional certificate validation checks for LDAPS connection explained in this article.

Gary.