LDAP over SSL authentication not working

[grenzi]

Hello everybody,

I've just installed and updated the Expedition VM and I'm trying to configure LDAP (Active Directory) authentication. It works fine when contacting the domain controller over port tcp/389 without SSL, but it doesn't work if I set SSL (and port tcp/636, of course). The domain controller uses a self signed certificate for the LDAP service. I tryed to import the CA certificate on the Expedition VM at /etc/ssl/cert. but nothing changed. I know that the domain controller is well configured for LDAP over SSL, since I already use this type of authentication for other services, including admin authentication on Palo Alto firewalls. Any suggestion?

Thank you in advance

[grenzi]

Solved by adding

TLS_REQCERT     never

into /etc/ldap/ldap.conf

Hope this helps someone else.

[bagherib]

Excellent, thanks for sharing.

[sjanita]

thank you for posting grenzi

[Sean_Small · Accepted solution]

The accepted solution "TLS_REQCERT never" is not really a fix. This only bypasses cert checking. If you are running into this issue it's because your company run's their own root CA and you generated a cert for expedition from it. So you need to put your local cert into the Linux cert store. 

Proper fix:

$ sudo cp local-ca.crt /usr/local/share/ca-certificates

$ sudo update-ca-certificates

[grenzi]

@Sean_Small yes, you are right 👍