topic Re: Expedition LDAP Error in Expedition Discussions

Expedition LDAP Error

ACountyMike — Tue, 14 Jun 2022 14:42:40 GMT

I'm trying to configure an Expedition deployment on a supported Ubuntu 20.04 VM, but consistently get a "Can't contact LDAP server" error. I have php-ldap installed and enabled (php -m). I can also bind the ldap server from the VM cli using ldapsearch, but the Expedition application can't connect. There are not any error messages printed in the apache logs or in the logs table in the pandbRBAC database. I have not been able to find any documentation so far that has helped to get this resolved. I'm not sure where to go from here.

Re: Expedition LDAP Error

lychiang — Tue, 14 Jun 2022 15:47:39 GMT

Can you please verify you have are running php 7.0 , also has php7.0-ldap installed, if not, you need to install the correct package version by:

1. login to expedition server CLI as expedition user.

2. Update package indexes with the command: sudo apt update

3. Install the correct php-ldap version: sudo apt install php7.0-ldap

4. Restart expedition web server: sudo apache2ctl restart

Re: Expedition LDAP Error

ACountyMike — Tue, 14 Jun 2022 16:26:19 GMT

I updated php7.0-common and all the installed php7.0 extensions ( php7.0-bcmath php7.0-bz2 php7.0-cli php7.0-common php7.0-curl php7.0-gd php7.0-json php7.0-ldap php7.0-mbstring php7.0-mcrypt php7.0-mysql php7.0-opcache php7.0-readline php7.0-soap php7.0-xml php7.0-zip). I'm now on the latest php7.0-common and php7.0-ldap. No change to ldap auth or error message.

Re: Expedition LDAP Error

lychiang — Tue, 14 Jun 2022 16:46:00 GMT

Can you do $php -version

you should see only 7.0

Re: Expedition LDAP Error

ACountyMike — Tue, 14 Jun 2022 16:56:01 GMT

That's correct. v7.0.33-58

Re: Expedition LDAP Error

ACountyMike — Thu, 16 Jun 2022 14:12:42 GMT

I solved this and wanted to add my solution for posterity. The server had been configured with an SSL certificate signed by our local CA, but the CA root and intermediate certificates had not been installed on the host. Installing the certificates fixed the issue. Additional tips: the Apache log level can be increased to sow more log messages and validate ldap in addition to ldaps.