LDAP authentication over SSL

[kpeck1]

Hello!

I have an instance of MunkiReport that I was able to authenticate with LDAP up until recently when the DCs were switched over to authenticate over SSL only. Now when I attempt to login with LDAP accounts I get the following error:

Fatal error: Uncaught exception 'adLDAPException' with message 'Bind to Active Directory failed. Check the login credentials and/or server details. AD said: Strong(er) authentication required' in /var/www/munkireports/app/lib/adLDAP/adLDAP.php:650 Stack trace: #0 /var/www/munkireports/app/lib/adLDAP/adLDAP.php(604): adLDAP->connect() #1 /var/www/munkireports/app/controllers/auth.php(171): adLDAP->__construct(Array) #2 [internal function]: munkireport\controller\Auth->login() #3 /var/www/munkireports/system/kissmvc_core.php(90): call_user_func_array(Array, Array) #4 /var/www/munkireports/system/kissmvc.php(13): KISS_Engine->__construct(Array, 'show', 'index', 'AUTO') #5 /var/www/munkireports/index.php(135): Engine->__construct(Array, 'show', 'index', 'AUTO') #6 {main} thrown in /var/www/munkireports/app/lib/adLDAP/adLDAP.php on line 650

My sanitized LDAP config in config.php looks like this:

$conf['auth']['auth_AD']['account_suffix'] = '@local.domain.com'; $conf['auth']['auth_AD']['base_dn'] = 'DC=local,DC=domain,DC=com'; //set to NULL to auto-detect $conf['auth']['auth_AD']['domain_controllers'] = array('dc1.local','dc2.local','dc3.local','dc4.local'); //can be an array of servers $conf['auth']['auth_AD']['admin_username'] = 'user'; $conf['auth']['auth_AD']['admin_password'] = 'userpw'; //if needed to perform the search $conf['auth']['auth_AD']['mr_allowed_groups'] = array('munkiadmins'); //case sensitive

Is there an option to set MunkiReport to authenticate over LDAPS that I'm missing? Any help would be appreciated.

Thanks!

[bochoven]

I think you can add a couple of flags:

https://github.com/adldap/adLDAP/wiki/Configuration-settings#ssl

$conf['auth']['auth_AD']['useSSL'] = true;

And/or

$conf['auth']['auth_AD']['useTLS'] = true;

-Arjen

On 10 Jul 2017, at 16:19, PotatoSkin15 notifications@github.com wrote:

Hello!

I have an instance of MunkiReport that I was able to authenticate with LDAP up until recently when the DCs were switched over to authenticate over SSL only. Now when I attempt to login with LDAP accounts I get the following error:

Fatal error: Uncaught exception 'adLDAPException' with message 'Bind to Active Directory failed. Check the login credentials and/or server details. AD said: Strong(er) authentication required' in /var/www/munkireports/app/lib/adLDAP/adLDAP.php:650 Stack trace: #0 /var/www/munkireports/app/lib/adLDAP/adLDAP.php(604): adLDAP->connect() #1 /var/www/munkireports/app/controllers/auth.php(171): adLDAP->__construct(Array) #2 [internal function]: munkireport\controller\Auth->login() #3 /var/www/munkireports/system/kissmvc_core.php(90): call_user_func_array(Array, Array) #4 /var/www/munkireports/system/kissmvc.php(13): KISS_Engine->construct(Array, 'show', 'index', 'AUTO') #5 /var/www/munkireports/index.php(135): Engine->construct(Array, 'show', 'index', 'AUTO') #6 {main} thrown in /var/www/munkireports/app/lib/adLDAP/adLDAP.php on line 650

My sanitized LDAP config in config.php looks like this:

$conf['auth']['auth_AD']['account_suffix'] = '@local.domain.com'; $conf['auth']['auth_AD']['base_dn'] = 'DC=local,DC=domain,DC=com'; //set to NULL to auto-detect $conf['auth']['auth_AD']['domain_controllers'] = array('dc1.local','dc2.local','dc3.local','dc4.local'); //can be an array of servers $conf['auth']['auth_AD']['admin_username'] = 'user'; $conf['auth']['auth_AD']['admin_password'] = 'userpw'; //if needed to perform the search $conf['auth']['auth_AD']['mr_allowed_groups'] = array('munkiadmins'); //case sensitive

Is there an option to set MunkiReport to authenticate over LDAPS that I'm missing? Any help would be appreciated.

Thanks!

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[kpeck1]

Thanks for the quick reply! I tried adding those lines to config.php and still the same error message. I also tried modifying $useSSL in /var/www/munkireports/app/lib/adLDAP/adLDAP.php and still no dice.

[rickheil]

Stab in the dark, but is the cert on AD signed by a CA that is trusted on the munkireport server?

[kpeck1]

Yes, the AD cert is trusted by the munkireport server.

[orbsmiv]

These two lines (added directly to config.php) worked for me:

$conf['auth']['auth_AD']['use_ssl'] = TRUE;
$conf['auth']['auth_AD']['ad_port'] = 636;

(Note the types are bool and int.)

Tcpdump verified that communication was over LDAPS ports.