https://github.com/lldap/lldap logo
Powered by
pratat - Setting up ldaps. First all , I am s...
# troubleshooting
p
Setting up ldaps. First all , I am so glad to come across LLDAP. I am using docker installation and got the web portal working. LDAP with port 3890 works as well. Is there any step by step guide for me on how to get LDAPS working ?
a
message has been deleted
n
You need to generate TLS certificates, and point LLDAP to them. That's about it 🙂
p
Thank u for the prompt response. This is using the OpenSSL command ?
n
Yep, that's one way to do it
You can also get them from letsencrypt
p
Ok I will go figure it out
Hello , I have generated the certificate crt and key using OpenSSL. In the .toml configuration file I have point the cert. Docker is up and running however I am still unable to ldapsearch on ldaps//xxx:6360
Docker logs showing WARNING: A key_seed was given, we will ignore the server key and generate one from the seed !
Any idea where am I doing it wrong ?
n
Can you show the entire logs? This warning is normal
p
volumes: lldap_data: driver: local services: lldap: image: lldap/lldap:stable ports: # For LDAP, not recommended to expose, see Usage section. - "3890:3890" # For LDAPS (LDAP Over SSL), enable port if LLDAP_LDAPS_OPTIONS__ENABLED set true, look env below - "6360:6360" # For the web front-end - "17170:17170" volumes: - "lldap_data:/data" # Alternatively, you can mount a local folder # - "./lldap_data:/data" environment: - UID=1000 - GID=5000 - TZ=Asia/Singapore - LLDAP_JWT_SECRET='=&0YfhBa<mo#z-)ch[xrP~[8IA/4NNhL' - LLDAP_KEY_SEED='8Ir0Ar-Cc40MZh8]MYG1wAG2-iJJAVH^' - LLDAP_LDAP_BASE_DN=dc=example,dc=com # If using LDAPS, set enabled true and configure cert and key path - LLDAP_LDAPS_OPTIONS__ENABLED=true - LLDAP_LDAPS_OPTIONS__CERT_FILE=/data/server_signed_cert.crt - LLDAP_LDAPS_OPTIONS__KEY_FILE=/data/server_key.key # You can also set a different database: # - LLDAP_DATABASE_URL=mysql://mysql-user:password@mysql-server/my-database # - LLDAP_DATABASE_URL=postgres://postgres-user:password@postgres-server/my-database
docker config as above
should i be edit the lldap_config.toml instead ?
n
This error is unusual: [error]: stream error: Request parse error: Invalid Header provided
p
well , if i use a normal Chrome browse , i cant log into the portal. If i use the incognito mode , i can log in
thats ok
i am more concern on the ldaps
n
That's weird
Can you switch it off, enable verbose logging, switch it on, send an LDAPS request, and share the logs with that one request?
p
via the lldap_config.toml ?
i guess this is the main issue ERROR 🚨 [error]: [LDAPS] Service Error: received fatal alert: BadCertificate
Do u have any guide how i can generate the certificates ?
n
It's just a generic SSL certificate, open SSL can generate it
I see 2 errors though: I think your test sent a LDAP query to the LDAPS port. How did you send the query?
The second one came from the check health, and that's where you got the bad certificate
p
ldapsearch -x -b "dc=example,dc=com" -H ldaps://phpldapadmin.example.com:6360 -D "uid=admin,ou=people,dc=example,dc=com" -W
i did that
some how there is a background query running
2024-10-13T07:31:54.232679831+00:00 DEBUG ┝━ 🐛 [debug]: | response: SearchResultEntry(LdapSearchResultEntry { dn: "", attributes: [LdapPartialAttribute { atype: "objectClass", vals: ["top"] }, LdapPartialAttribute { atype: "vendorName", vals: ["LLDAP"] }, LdapPartialAttribute { atype: "vendorVersion", vals: ["lldap_0.5.0"] }, LdapPartialAttribute { atype: "supportedLDAPVersion", vals: ["3"] }, LdapPartialAttribute { atype: "supportedExtension", vals: ["1.3.6.1.4.1.4203.1.11.1"] }, LdapPartialAttribute { atype: "supportedControl", vals: [] }, LdapPartialAttribute { atype: "supportedFeatures", vals: ["1.3.6.1.4.1.4203.1.5.1"] }, LdapPartialAttribute { atype: "defaultNamingContext", vals: ["dc=example,dc=com"] }, LdapPartialAttribute { atype: "namingContexts", vals: ["dc=example,dc=com"] }, LdapPartialAttribute { atype: "isGlobalCatalogReady", vals: ["false"] }] }) 2024-10-13T07:31:54.232704901+00:00 DEBUG ┕━ 🐛 [debug]: | response: SearchResultDone(LdapResult { code: Success, matcheddn: "", message: "", referral: [] }) 2024-10-13T07:31:54.234641678+00:00 DEBUG HTTP request [ 10.7µs | 100.00% ] method: "GET" | uri: "/health" 2024-10-13T07:31:54.234653648+00:00 DEBUG ┕━ 🐛 [debug]: | status_code: 200 2024-10-13T07:31:54.235309347+00:00 ERROR 🚨 [error]: TLS alert received: AlertMessagePayload { level: Fatal, description: BadCertificate, } | log.target: "rustls::conn" | log.module_path: "rustls::conn" | log.file: "/__w/lldap/lldap/${GITHUB_WORKSPACE}/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rustls-0.20.8/src/conn.rs" | log.line: 1327 2024-10-13T07:31:54.235736093+00:00 ERROR 🚨 [error]: [LDAPS] Service Error: received fatal alert: BadCertificate
n
Yeah, that's the checkhealth
p
ok
n
From docker
p
then i cant figure out what's wrong with the cert then.
n
It's showing you that http works, LDAP works, and ldaps doesn't
p
ok
n
How did you generate the certificate? What command did you run?
(if the algorithm is too old/unsecure it won't be supported by rustls)
p
i was following this guide
n
Yeah, aes128 is unsecure
Use "-algorithm ed25519"
p
ok let me try it out
n
That'll teach you to follow a random medium blog! :p
p
sorry for being a nobody 😦
n
Ah, no, it was just a joke, don't worry
p
i know 😛
n
I'm also the kind to Google my question and click on the first link
Try this to generate the private key
p
thank u . let me test it out now
2024-10-13T07:47:15.878773728+00:00 DEBUG 🐛 [debug]: decided upon suite TLS13_AES_256_GCM_SHA384 | log.target: "rustls::server::hs" | log.module_path: "rustls::server::hs" | log.file: "/__w/lldap/lldap/${GITHUB_WORKSPACE}/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rustls-0.20.8/src/server/hs.rs" | log.line: 382 2024-10-13T07:47:15.882315161+00:00 INFO LDAP session [ 173µs | 99.32% / 100.00% ] 2024-10-13T07:47:15.882687775+00:00 INFO ┕━ LDAP request [ 1.18µs | 0.68% ] 2024-10-13T07:47:15.882881747+00:00 ERROR 🚨 [error]: [LDAPS] Service Error: while handling incoming messages: while receiving LDAP op: unexpected end of file
i am still getting badcert from the healthcheck
n
That usually means an LDAP query to LDAPS port, but it's not gonna be the case from the checkhealth
But that's not badcert
p
ok
i have generate the new cert
openssl genpkey --algorithm ed25519 -out private.pem openssl req -new -days 3650 -key private.pem -out server_cert_name.csr openssl x509 -in server_cert_name.csr -out server_signed_cert_name.crt -req -signkey private.pem -days 3650
there are commands i use
-rw------- 1 1000 5000 119 Oct 13 15:43 private.pem -rw-r--r-- 1 1000 5000 725 Oct 13 15:44 server_signed_cert_name.crt
which is in the data folder
n
And you updated the env variables to point to these?
No more server.key?
p
i updated in lldap_config.toml (but not the docker yml) [ldaps_options] ## Whether to enable LDAPS. enabled=true ## Port on which to listen. port=6360 ## Certificate file. cert_file="/data/server_signed_cert_name.crt" ## Certificate key file. key_file="/data/private.pem"
n
When you start LLDAP with verbose logs, it prints out the effective config at the top
That's the best way to know what it actually loaded
p
> Setup permissions.. > Starting lldap.. Loading configuration from /data/lldap_config.toml Configuration: Configuration { ldap_host: "0.0.0.0", ldap_port: 3890, http_host: "0.0.0.0", http_port: 17170, jwt_secret: SECRET, ldap_base_dn: "dc=example,dc=com", ldap_user_dn: UserId( "admin", ), ldap_user_email: "", ldap_user_pass: SECRET, database_url: "sqlite:///data/users.db?mode=rwc", ignored_user_attributes: [], ignored_group_attributes: [], verbose: true, key_file: "/data/private_key", key_seed: Some( SECRET, ), smtp_options: MailOptions { enable_password_reset: false, from: None, reply_to: None, server: "localhost", port: 587, user: "", password: SECRET, smtp_encryption: Tls, tls_required: None, }, ldaps_options: LdapsOptions { enabled: true, port: 6360, cert_file: "/data/server_signed_cert_name.crt", key_file: "/data/private.pem", }, http_url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some( Domain( "localhost", ), ), port: None, path: "/", query: None, fragment: None, }, server_setup: None, } WARNING: Unsecure default admin password is used. WARNING: A key_seed was given, we will ignore the server_key and generate one from the seed!
looks likes it loaded
n
Good! (Though next time, put anything you paste between triple backticks
Copy code
`
(I should downgrade the second warning to a notice, this is the expected behavior)
(and/or print a way to silence it)
p
ok
n
Then sorry, but I'm running out of ideas why your certificate is not working
p
😦
thank you for your help
n
Maybe try some other commands to generate the certificate? I'm no openssl expert, so maybe a different combo of algorithm and certificate generation incantation would work
p
will do so
Some updates. it seem like the cert is working. and i can get it working via windows ldap tools with ssl.
however , i am still unable to get it working with ldapsearch command via linux
n
And the healthcheck?
p
all cleared
n
Great! Then it's probably the certificate check in ldapsearch
Can you disable it?
(that's because the certificate is self signed)
p
openssl req -x509 -nodes -newkey rsa:2048 -keyout lldap.key -x509 -days 365 -out lldap.crt
i dont know how to disable the check
n
It's an ldapsearch option
p
googling.
i dont find any option
n
p
no luck
n
What error do you get?
p
2024-10-13T09:13:12.640529535+00:00 INFO LDAP session [ 203µs | 98.92% / 100.00% ] 2024-10-13T09:13:12.649497245+00:00 ERROR ┝━ 🚨 [error]: Message is not constructed 2024-10-13T09:13:12.649502905+00:00 INFO ┕━ LDAP request [ 2.19µs | 1.08% ] 2024-10-13T09:13:12.649716627+00:00 ERROR 🚨 [error]: [LDAP] Service Error: while handling incoming messages: while receiving LDAP op: ldapmsg invalid
n
And on the ldapsearch side?
What's the command and the output?
p
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
n
And the command?
p
let me try something
ldapsearch -x -b "dc=example,dc=com" -H ldaps://phpldapadmin.example.com:6360 -D "uid=admin,ou=people,dc=example,dc=com" -W Enter LDAP Password: ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
i am so sorry
i know that issue now
PEBKAC
its all working now
problem is i am using ldaps with the wrong port
=\
i thank you for your help throughout your morning
n
I actually checked that, and you configured LDAPS with port 6360, and queried it on port 6360. Did I miss something?
p
U didn’t. Its me . I run ldaps with 3890 . 🫣
2 Views
PreviousNext
Powered by