Fedor  Petrov
Fedor Petrov

Reputation: 1050

pg_hba.conf for openldap doesn't work. In ldap server two seemingly similar commands have different result. Why?

I'm currently debugging why my postgres database cannot authenticate against openldap (slapd=2.4.57*). In pg_hba.conf I have the following line:

hostssl    all             all             all                     ldap ldapserver=ldap ldapport=389 ldapbasedn="dc=discover,dc=d-fine,dc=com" ldapbinddn="uid=database,ou=users,dc=discover,dc=d-fine,dc=com" ldapbindpasswd=secret ldapsearchattribute=uid ldaptls=1

When I'm in the database container I do the following:

psql "sslmode=require dbname=postgres host=database user=discover-bot"

and get the following error:

psql: error: connection to server at "database" (172.18.0.4), port 5432 failed: FATAL:  LDAP authentication failed for user "discover-bot"

I went to the ldap container to test the connection. At first nothing worked. Then I set the environment variable:

export LDAPTLS_CACERT=/etc/ldap/certs/ca-certs.pem

The following command started to work:

ldapsearch -h ldap -p 389 -ZZ -D "uid=database,ou=users,dc=discover,dc=d-fine,dc=com" -w secret -b "dc=discover,dc=d-fine,dc=com" "(uid=discover-bot)"

But the following command doesn't work:

ldapsearch -x -v -ZZ ldap://ldap:389 -D "uid=database,ou=users,dc=discover,dc=d-fine,dc=com" -w secret -b "dc=discover,dc=d-fine,dc=com" "(uid=discover-bot)".

with error:

ldap_initialize( <DEFAULT> )
ldap_start_tls: Connect error (-11)
        additional info: (unknown error code)

For some reason in my installation I cannot find detailed logs for LDAP. But maybe the reason for this discrepancy is obvious? Maybe knowing this difference I can format my pg_hba.conf in a different way? Do I need to set LDAPTLS_CACERT in my database or ldap container by default?

UPD. The configuration worked under Debian Buster but not under Debian Bullseye.

Upvotes: 0

Views: 77

Answers (0)

Related Questions