mirror of
https://github.com/lldap/lldap.git
synced 2026-04-25 08:15:52 +03:00
[GH-ISSUE #1051] [Documentation] LDAPS config #375
Labels
No labels
backend
blocked
bug
cleanup
dependencies
docker
documentation
duplicate
enhancement
enhancement
frontend
github_actions
good first issue
help wanted
help wanted
integration
invalid
ldap
pull-request
question
rust
rust
tests
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/lldap-lldap#375
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @MassiPi on GitHub (Nov 26, 2024).
Original GitHub issue: https://github.com/lldap/lldap/issues/1051
Hello,
i'm trying to user ldaps. The port to the docker image is open, the config file is updated, lldap seems happy
(sorry the config)
but when i try to connect via ldapsearch i always get an error (plain ldap works with the very same command)
I created my certs with the suggested command
but i'm not sure i'm using this correctly.
i named my base DN with a proper domain, that however is not resolved to the dns of the server answering requests. Is this causing the issue? how should i create it?
and obviously this also happens from remote machines (i'm trying to setup nslcd on a unix host and i can't connect)
thanks
@nitnelave commented on GitHub (Nov 26, 2024):
Hey,
Can you enable verbose mode (in the config) and post the logs of the connection attempt?
If you don't see any new logs when you run
ldapsearch, it's because the query doesn't reach LLDAP (problem in the host name, docker config or port forwarding most likely)@MassiPi commented on GitHub (Nov 26, 2024):
sure i will, i thought about a possible network problem (since the error given seems clear), but docker says it's ok :) i'll be recreating the container, no problem..
(stupid question incoming) where is lldap logging?
(can you please help me understanding the correct way to create and manage certificates? i create key and cert, then i need to put the cert also on clients accessing ldaps, right? should i use the specific local dns name of the lldap server?)
@nitnelave commented on GitHub (Nov 26, 2024):
LLDAP logs to the standard output. With docker, that's in
docker logs lldapFor the certificate, it should be issued to the domain that you use to query the server, e.g. ldaps://my.domain.com:6360 should have a certificate for my.domain.com. I don't think the base DN matters.
With this (and assuming that the certificate is issued by a CA that the client recognizes, like letsencrypt) the client will automatically accept it.
If it's a self signed certificate, you usually have to tell the client not to check the certificate. You may also have some cases where you explicitly give the client the public certificate to match, but that's rare.
@MassiPi commented on GitHub (Nov 26, 2024):
seems something happens, but it breaks :)
any hint? (is it correct it opens and closes so many sessions? i just tried a cli ldapsearch..)
@nitnelave commented on GitHub (Nov 26, 2024):
I'm pretty sure this is a case of an LDAP message sent to the LDAPS port. I'm not sure how/why, but try looking in this direction. Maybe you're missing a flag in ldapsearch?
@MassiPi commented on GitHub (Nov 26, 2024):
oh god, this is a random find in the web
i really lost a lot of time lol
so now i need to understand why i can't get nslcd to work (not even logged in lldap so i assume i'm making something very wrong on client side)
@stephrobert commented on GitHub (Jan 27, 2025):
I have the same error. I generated certificat with mkcert.
ldapsearch -H ldaps://master2:6360 -D "uid=admin,ou=people,dc=robert,dc=local" -w "changeme" -b "dc=robert,dc=local" "(objectClass=*)" -x
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
In the log
2025-01-27T14:32:30.653866+00:00 master2 lldap[999789]: 2025-01-27T14:32:30.653717783+00:00 ERROR 🚨 [error]: [LDAPS] Service Error: while handling incoming messages: while receiving LDAP op: unexpected end of file
The command openssl s_client -connect :6360
subject=O = mkcert development certificate, OU = bob@master2
issuer=O = mkcert development CA, OU = bob@master2, CN = mkcert bob@master2
No client certificate CA names sent
Peer signing digest: SHA512
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
SSL handshake has read 1627 bytes and written 391 bytes
Verification: OK
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
@kapsh commented on GitHub (Jan 28, 2025):
Solution:
LDAPTLS_REQCERT=allow ldapsearch ...will ignore self-signed or incorrect certificates andLDAPTLS_REQCERT=neverwill not even look at them.Errors are misleading in this case. LLDAP logs "unexpected end of file" because ldapsearch breaks connection after handshake, and latter needs at least
-d1arg to show real reason. Example output with debug:@nitnelave commented on GitHub (Jan 28, 2025):
It's a bit hard to improve the error message in this case, "unexpected end of file" is all I get from the underlying library.
I can test if the error is this, and add some tentative solutions, but in this case it's the client (ldapsearch) breaking the connection. I don't think there's anything that we should change on the LLDAP side. If anything, that should be a bug report to ldapsearch to improve their error messages.