[Solved] Can't authenticate against LDAP using LE

TheGoliath · 2017-12-29 17:19:32

Hi, I've set up a new OpenLDAP-server instance a few days ago. I followed the guides on the arch wiki. The authentication works with the pure ldap protocol, iirc, but it doesn't want to do the same on the ldaps protocol. The ldapsearch throws the following errors.
I've replaced my distinguished names with the example one's.

>> ldapsearch -x -H ldaps://localhost:636 -D cn=Manager,dc=example,dc=org -v -d 1
ldap_url_parse_ext(ldaps://localhost:636)
ldap_initialize( ldaps://localhost:636/??base )
ldap_create
ldap_url_parse_ext(ldaps://localhost:636/??base)
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:636
ldap_new_socket: 3
ldap_prepare_socket: 3
ldap_connect_to_host: Trying ::1 636
ldap_pvt_connect: fd: 3 tm: -1 async: 0
attempting to connect: 
connect success
TLS trace: SSL_connect:before SSL initialization
TLS trace: SSL_connect:SSLv3/TLS write client hello
TLS trace: SSL_connect:SSLv3/TLS write client hello
TLS trace: SSL_connect:SSLv3/TLS read server hello
TLS certificate verification: depth: 1, err: 20, subject: /C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3, issuer: /O=Digital Signature Trust Co./CN=DST Root CA X3
TLS certificate verification: Error, unable to get local issuer certificate
TLS trace: SSL3 alert write:fatal:unknown CA
TLS trace: SSL_connect:error in error
TLS: can't connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (unable to get local issuer certificate).
ldap_err2string
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

My slapd.conf

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/run/openldap/slapd.pid
argsfile	/run/openldap/slapd.args

# Load dynamic backend modules:
# modulepath	/usr/lib/openldap
# moduleload	back_mdb.la
# moduleload	back_ldap.la

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#	by self write
#	by users read
#	by anonymous auth
#
access to attrs=userPassword,givenName,sn,photo
        by self write
        by anonymous auth
        by dn.base="cn=Manager,dc=example,dc=org" write
        by * none

access to *
        by self read       
        by dn.base="cn=Manager,dc=example,dc=org" write
        by * read

# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# MDB database definitions
#######################################################################

database	mdb
maxsize		1073741824
suffix		"dc=example,dc=org"
rootdn		"cn=Manager,dc=example,dc=org"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw    {SSHA}7/bs+pUT+5KN4unJm4Wc+JA4tpchqC3f
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory	/var/lib/openldap/openldap-data
# Indices to maintain
index	objectClass	eq
index   uid             pres,eq
index   mail            pres,sub,eq
index   cn              pres,sub,eq
index   sn              pres,sub,eq
index   dc              eq

# Certificate/SSL Section
TLSCipherSuite DEFAULT
TLSCipherSuite HIGH:MEDIUM:-SSLv2:-SSLv3
TLSCertificateFile /etc/letsencrypt/live/example.org/cert.pem
TLSCertificateKeyFile /etc/letsencrypt/live/example.org/privkey.pem
TLSCACertificateFile /etc/letsencrypt/live/example.org/chain.pem
TLSCACertificatePath /usr/share/ca-certificates/trust-source

ldap.conf

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE   dc=example,dc=org
URI    ldap://localhost
TLS_CACERTDIR /usr/share/ca-certificates/trust-source

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
sudoers_base ou=sudoers,dc=AFOLA

The whole thing works, if I add the "TLS_REQCERT allow" flag in the ldap.conf

Where do I have to specify the Lets Encrypt CA (I know, that it can't validate the CA, but how to tell ldap to do it properly or which additional parameters have to be set?)

Cheers,
The Goliath

Last edited by TheGoliath (2018-09-22 20:04:11)

progandy · 2017-12-29 18:45:59

There is a probably working answer on serverfault: https://serverfault.com/a/834565
(which seems to be readily available in the first few results of a web search)

Last edited by progandy (2017-12-29 18:46:56)

TheGoliath · 2018-09-22 20:03:05

Yeah. Sorry for my faulty behavior.
It was indeed some misconfiguration. Using a whole new setup these days.
But still thanks
/Solved

Cheers,
TheGoliath

Hint: Reading the wiki is a good approach

Arch Linux

#1 2017-12-29 17:19:32

[Solved] Can't authenticate against LDAP using LE

#2 2017-12-29 18:45:59

Re: [Solved] Can't authenticate against LDAP using LE

#3 2018-09-22 20:03:05

Re: [Solved] Can't authenticate against LDAP using LE

Board footer