MRBS connection with LDAP using TLS not working

[oweeya]

So I have now able to authenticate MRBS using LDAP. But when I tried to connect them using TLS and changing the $ldap_tls = true; doesn't work for me. I have already set up TLS in the LDAP server and confirmed it running using ldapwhoami -H ldap://example.com -x -ZZ. Trying to log errors using $ldap_debug = true; also doesn't seems to work for me as the log file doesn't contain any error.

 

My LDAP server is running on Ubuntu server 22.04 and created using OpenLDAP.

My MRBS server is running on Ubuntu server 22..04 using Nginx as web server.

 

Am I missing something or wrong configs? Any advice is highly appreciated

This is the tutorial I followed to create my LDAP server and TLS https://ubuntu.com/server/docs/service-ldap

[oweeya]

I've updated the ca-certificates on my MRBS server with the .crt from LDAP server for TLS connection, I've also set the ldap_port = 636 but still fail. But this time I finally have some error log generated

2022/12/29 01:18:49 [error] 2203#2203: *93 FastCGI sent in stderr: "PHP message: [MRBS DEBUG] MRBS\Auth\AuthLdap->action(738): got LDAP connection using ldaps://10.0.2.4:636PHP message:E_WARNING in /var/www/html/lib/MRBS/Auth/AuthLdap.php at line 938ldap_start_tls(): Unable to start TLS: Can't contact LDAP serverMRBS GET: Array()MRBS POST: Array( [csrf_token] => a83ed2898cabb26902ef8a50817678501d5fa67f409468d5b82a16c81a96b00a [returl] => [target_url] => index.php [action] => SetName [username] => **** [password] => ****)MRBS SESSION: Array( [csrf_token] => a83ed2898cabb26902ef8a50817678501d5fa67f409468d5b82a16c81a96b00a)PHP message: [MRBS DEBUG] MRBS\Auth\AuthLdap->action(802): constructed dn 'uid=john,ou=People,dc=jksldap,dc=com' and user_search 'uid=john' using 'uid'PHP message: [MRBS DEBUG] MRBS\Auth\AuthLdap::validateUserCallback(238): base_dn 'ou=People,dc=jksldap,dc=com' dn 'uid=john,ou=People,dc=jksldap,dc=com' user 'john'PHP message:E_USER_WARNING in /var/www/html/lib/MRBS/Auth/AuthLdap.php at line 863Can't contact LDAP serverMRBS GET: Array()MRBS POST: Array( [csrf_token] => a83ed2898cabb26902ef8a50817678501d5fa67f409468d5b82a16c81a96b00a [returl] => [target_url] => index.php [action] => SetName [username] => **** [password] => ****)MRBS SESSION: Array( [csrf_token] => a83ed2898cabb26902ef8a50817678501d5fa67f409468d5b82a16c81a96b00a)PHP message: [MRBS DEBUG] MRBS\Auth\AuthLdap::validateUserCallback(310): bind to 'uid=john,ou=People,dc=jksldap,dc=com' failed: Can't contact LDAP server" while reading response header from upstream, client: 10.0.2.2, server: _, request: "POST /admin.php HTTP/1.1", upstream: "fastcgi://unix:/run/php/php8.1-fpm.sock:", host: "127.0.0.1", referrer: "http://127.0.0.1/admin.php"

 

The MRBS server sits on ip 10.0.2.5 The LDAP server sits on ip 10.0.2.4

I don't know what is on 10.0.2.2 and I don't know why it appears, maybe this is something from NAT Network from my VirtualBox? I can't tell since this is my first time using it.

So far everything I've tried is on MRBS config and LDAP config but nothing Nginx config, is it possible that it is a problem from Nginx instead of MRBS and LDAP?

I'm really lost at this point so anything that I could find and try I've tried.

Any advice will be highly appreciated.

Edited December 29, 2022 by oweeya

[free780]

Does your certificate have the ip address in the subject? Usually it’s a fqdn which means your ldap config needs to reflect this. Depending on the implementation the CRL may also need to be queried.

[oweeya]

Hi and thanks for the reply. It took me weeks and a lot of trial and error but I managed to find the cause and solved it.

 

My CA cert was done correctly and installed correctly on client side, but the problem is I didn't include it in my ldap.conf. After finding out I missed out the inclusion in my ldap.conf I went ahead and added it so now it is working fine and able to establish StartTLS connection no problem.

 

Then I also went ahead and enabled LDAPS connection. to do this I simply just added ldaps:/// on the line SLAPC_SERVICES on the file /etc/default/slapd. Then just changed the ldap port in config.inc.php to 636.

 

Now I am able to use MRBS in both StartTLS and LDAPS but I opted for LDAPS as it is the more secure connection when compared with StartTLS.