unable to connect to Ldap

[imran-baig-se]

am trying to enable reauth to my existing application

Error: 06/Nov/2019:13:13:53 +0000 [ERROR 500 /login] Get http://localhost:5650: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"

my Caddyfile

kibana-test.xxx.io:5000 { tls /root/config/star_tajawal_io.crt /root/config/XXXX-io-sub-domain-private-key.pem

basicauth / kibana-test kibana-test

jwt { path / redirect /login } reauth { path / upstream url=http://localhost:5650 ldap url=ldap://prod-devops-freeipa-ldap-public-xxxx.eu-west-1.elb.amazonaws.com:389,timeout=5s,username=qa.xxx,password=xxxx,base="OU=Users,OU=tajawal,DC=tajawal,DC=io" } log stdout errors visible }

am running in container..

Logs from Caddy:

$ sudo docker-compose up Starting caddy_kibana_test ... done Attaching to caddy_kibana_test caddy_kibana_test | 2019/11/06 13:13:47 [INFO] Successfully loaded TLS assets from /root/config/star_tajawal_io.crt and /root/config/xxxx-io-sub-domain-private-key.pem caddy_kibana_test | Activating privacy features... done. caddy_kibana_test | JWT middleware is initiated caddy_kibana_test | caddy_kibana_test | Serving HTTPS on port 5000 caddy_kibana_test | https://kibana-test.XXXX.io:5000 caddy_kibana_test | caddy_kibana_test | 2019/11/06 13:13:47 [INFO] Serving https://kibana-test.xxxx.io:5000 caddy_kibana_test | 2019/11/06 13:13:47 [INFO][cache:0xc000186f00] Started certificate maintenance routine caddy_kibana_test | 2019/11/06 13:13:47 [NOTICE] Sending telemetry: we were too early; waiting 19h27m31.015992392s before trying again caddy_kibana_test | 5.195.224.30 - - [06/Nov/2019:13:13:49 +0000] "GET /login HTTP/2.0" 500 172 caddy_kibana_test | 5.195.224.30 - - [06/Nov/2019:13:13:49 +0000] "GET /favicon.ico HTTP/2.0" 500 178 caddy_kibana_test | 5.19

Please advise @freman

[freman]

Hi

It would appear to be your upstream is HTTPS and you are requesting as HTTP

\x15\x03\x01\x00\x02\x02 is basically the start of HTTPS (It's funny, I have written a transport that is capable of handling http and https automatically and I wonder why it was never done before)

It's basically midnight here so I'm a bit tired but if you just want ldap you don't need upstream url=http://localhost:5650

if you do need that for other reasons then try upstream url=https://localhost:5650

[imran-baig-se]

Hello @freman

Thanks for quick help, I have removed the upstream.. already now its says invalid credintals though i tried with many other all are good credintals

error : +0000 [ERROR 500 /] bind with "xxx.xx": LDAP Result Code 49 "Invalid Credentials":

just a quick question.

My ladap string is correct.?? am doing with freeipa.

ldap url=ldap://prod-devops-freeipa-ldap-public-xxx.eu-west-1.elb.amazonaws.com:389,timeout=5s,username=imran.xxx,password="imxran.xxx",base="CN=Users,CN=tajawal,DC=tajawal,DC=io",filter="(&(memberOf=CN=group,CN=accounts,DC=xxx,DC=io)(uid=%s)(objectClass=user)(sAMAccountName=%s))"

Thanks in adavance

[freman]

I ran that through the config parser, it parses ok.

I have spotted one more issue, the filter is limited to only one %s parameter

"(&(memberOf=CN=group,CN=accounts,DC=xxx,DC=io)(uid=%s)(objectClass=user)(sAMAccountName=%s))"

all tho you can cheat and use %[1]s to repeatedly use that one parameter (I'm lazy, I used the default sprintf)

Should your ldap not be using ssl/tls? I imagine that'd be something aws would enforce? ldaps://

But beyond that, the everything after the : (LDAP Result Code 49 "Invalid Credentials") is actually coming from LDAP so unless one of your passwords is incorrect the module appears to be working

If you can get your hands on the ldapsearch tool on a box that has access to the ldap host you can test your parameters with that much easier and quicker, if you find a set up that works for you let me know what it is and I"ll help you with a config line for caddy-reauth

ldapsearch -h prod-devops-freeipa-ldap-public-xxxx.eu-west-1.elb.amazonaws.com -D qa.xxx -w xxxx -b "OU=Users,OU=tajawal,DC=tajawal,DC=io" "(&(memberOf=CN=group,CN=accounts,DC=xxx,DC=io)(objectClass=user)(sAMAccountName=username))" "cn"