Reputation: 1050
I'm currently debugging why my postgres database cannot authenticate against openldap (slapd=2.4.57*). In pg_hba.conf I have the following line:
hostssl all all all ldap ldapserver=ldap ldapport=389 ldapbasedn="dc=discover,dc=d-fine,dc=com" ldapbinddn="uid=database,ou=users,dc=discover,dc=d-fine,dc=com" ldapbindpasswd=secret ldapsearchattribute=uid ldaptls=1
When I'm in the database container I do the following:
psql "sslmode=require dbname=postgres host=database user=discover-bot"
and get the following error:
psql: error: connection to server at "database" (172.18.0.4), port 5432 failed: FATAL: LDAP authentication failed for user "discover-bot"
I went to the ldap container to test the connection. At first nothing worked. Then I set the environment variable:
export LDAPTLS_CACERT=/etc/ldap/certs/ca-certs.pem
The following command started to work:
ldapsearch -h ldap -p 389 -ZZ -D "uid=database,ou=users,dc=discover,dc=d-fine,dc=com" -w secret -b "dc=discover,dc=d-fine,dc=com" "(uid=discover-bot)"
But the following command doesn't work:
ldapsearch -x -v -ZZ ldap://ldap:389 -D "uid=database,ou=users,dc=discover,dc=d-fine,dc=com" -w secret -b "dc=discover,dc=d-fine,dc=com" "(uid=discover-bot)".
with error:
ldap_initialize( <DEFAULT> )
ldap_start_tls: Connect error (-11)
additional info: (unknown error code)
For some reason in my installation I cannot find detailed logs for LDAP. But maybe the reason for this discrepancy is obvious? Maybe knowing this difference I can format my pg_hba.conf in a different way? Do I need to set LDAPTLS_CACERT in my database or ldap container by default?
UPD. The configuration worked under Debian Buster but not under Debian Bullseye.
Upvotes: 0
Views: 77