Hello
Problem:
I want to set a new authentication source to use LDAP (Active Directory) using TLS. However I have a certificate error when I test the connexion or if I try to login.
My company use certificates. The CA , and chain are imported.
The error is
ERF50-1006 [Foreman::WrappedException]: Unable to connect to LDAP server ([Net::LDAP::Error]: SSL_connect SYSCALL returned=5 errno=0 peeraddr=<LDAP IP>:636 state=error: certificate verify failed)
Expected outcome:
Test connexion and login operationnal with LDAPS
Foreman and Proxy versions:
3.14
Foreman and Proxy plugin versions:
- Foreman_puppet : 8.1.0
Distribution and version:
Ubuntu 22.04
Other relevant data:
Commands
- openssl is ok
# openssl s_client -connect <LDAP IP>:636
CONNECTED(00000003)
...
- curl is ok
curl -L ldaps://<LDAP IP>:636
DN:
domainFunctionality: 7
forestFunctionality: 7
...
- ldpasearch is ok (can connect and do search) :
# ldapsearch -x -v -Z -H ldaps://<LDAP IP>:636 (with options)
# extended LDIF
#
# LDAPv3
# base <dc=one,dc=local> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# one.local
dn: DC=one,DC=local
objectClass: top
objectClass: domain
objectClass: domainDNS
distinguishedName: DC=one,DC=local
production logs when I try the connexion :
2025-04-29T14:11:35 [I|app|4a3227e2] Started GET "/auth_sources" for <IP> at 2025-04-29 14:11:35 +0200
2025-04-29T14:11:35 [I|app|4a3227e2] Processing by AuthSourcesController#index as HTML
2025-04-29T14:11:35 [I|app|4a3227e2] Rendered auth_sources/index.html.erb within layouts/application (Duration: 5.9ms | Allocations: 2816)
2025-04-29T14:11:35 [I|app|4a3227e2] Rendered layouts/base.html.erb (Duration: 10.4ms | Allocations: 11819)
2025-04-29T14:11:35 [I|app|4a3227e2] Rendered layout layouts/application.html.erb (Duration: 17.2ms | Allocations: 14949)
2025-04-29T14:11:35 [I|app|4a3227e2] Completed 200 OK in 35ms (Views: 16.7ms | ActiveRecord: 3.6ms | Allocations: 23875)
2025-04-29T14:11:35 [I|app|71d4908c] Started GET "/notification_recipients" for 10.100.0.22 at 2025-04-29 14:11:35 +0200
2025-04-29T14:11:35 [I|app|71d4908c] Processing by NotificationRecipientsController#index as JSON
2025-04-29T14:11:35 [I|app|71d4908c] Completed 200 OK in 5ms (Views: 0.1ms | ActiveRecord: 0.6ms | Allocations: 2215)
2025-04-29T14:11:37 [I|app|36671ed2] Started GET "/auth_source_ldaps/4-ONE/edit" for 10.100.0.22 at 2025-04-29 14:11:37 +0200
2025-04-29T14:11:37 [I|app|36671ed2] Processing by AuthSourceLdapsController#edit as HTML
2025-04-29T14:11:37 [I|app|36671ed2] Parameters: {"id"=>"4-ONE"}
2025-04-29T14:11:37 [I|app|36671ed2] Rendered auth_source_ldaps/edit.html.erb within layouts/application (Duration: 15.9ms | Allocations: 13636)
2025-04-29T14:11:37 [I|app|36671ed2] Rendered layouts/base.html.erb (Duration: 9.8ms | Allocations: 11618)
2025-04-29T14:11:37 [I|app|36671ed2] Rendered layout layouts/application.html.erb (Duration: 26.2ms | Allocations: 25464)
2025-04-29T14:11:37 [I|app|36671ed2] Completed 200 OK in 37ms (Views: 25.2ms | ActiveRecord: 2.9ms | Allocations: 30406)
2025-04-29T14:11:37 [I|app|d4f031c7] Started GET "/notification_recipients" for 10.100.0.22 at 2025-04-29 14:11:37 +0200
2025-04-29T14:11:37 [I|app|d4f031c7] Processing by NotificationRecipientsController#index as JSON
2025-04-29T14:11:37 [I|app|d4f031c7] Completed 200 OK in 5ms (Views: 0.1ms | ActiveRecord: 0.6ms | Allocations: 2213)
2025-04-29T14:11:38 [I|app|bb9d22bd] Started PUT "/auth_source_ldaps/test_connection" for 10.100.0.22 at 2025-04-29 14:11:38 +0200
2025-04-29T14:11:38 [I|app|bb9d22bd] Processing by AuthSourceLdapsController#test_connection as */*
2025-04-29T14:11:38 [I|app|bb9d22bd] Parameters: {"authenticity_token"=>"<TOKEN>", "auth_source_ldap"=>{"name"=>"ONE", "host"=>"<LDAP NAME>", "tls"=>"1", "port"=>"636", "server_type"=>"active_directory", "account"=>"<ACCOUNT>", "base_dn"=>"<based>", "groups_base"=>"<groups>", "use_netgroups"=>"0", "ldap_filter"=>"", "onthefly_register"=>"0", "usergroup_sync"=>"0", "attr_login"=>"sAMAccountName", "attr_firstname"=>"givenName", "attr_lastname"=>"sn", "attr_mail"=>"mail", "attr_photo"=>"", "location_ids"=>["", "2"], "organization_ids"=>["", "1"]}, "fakepassword"=>"[FILTERED]"}
2025-04-29T14:11:38 [W|app|bb9d22bd] Failed to connect to LDAP server
2025-04-29T14:11:38 [I|app|bb9d22bd] Backtrace for 'Failed to connect to LDAP server' error (Foreman::WrappedException): ERF50-1006 [Foreman::WrappedException]: Unable to connect to LDAP server ([Net::LDAP::Error]: SSL_connect SYSCALL returned=5 errno=0 peeraddr=<IP LDAP>:636 state=error: certificate verify failed)
bb9d22bd | /usr/share/foreman/app/models/auth_sources/auth_source_ldap.rb:185:in `rescue in test_connection'
bb9d22bd | /usr/share/foreman/app/models/auth_sources/auth_source_ldap.rb:178:in `test_connection'
bb9d22bd | /usr/share/foreman/app/controllers/auth_source_ldaps_controller.rb:40:in `test_connection'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal/basic_implicit_render.rb:6:in `send_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/abstract_controller/base.rb:215:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal/rendering.rb:165:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/abstract_controller/callbacks.rb:234:in `block in process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:118:in `block in run_callbacks'
bb9d22bd | /usr/share/foreman/app/controllers/concerns/foreman/controller/timezone.rb:10:in `set_timezone'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:127:in `block in run_callbacks'
bb9d22bd | /usr/share/foreman/app/models/concerns/foreman/thread_session.rb:32:in `clear_thread'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:127:in `block in run_callbacks'
bb9d22bd | /usr/share/foreman/app/controllers/concerns/foreman/controller/topbar_sweeper.rb:12:in `set_topbar_sweeper_controller'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:127:in `block in run_callbacks'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/audited-5.8.0/lib/audited/sweeper.rb:16:in `around'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:127:in `block in run_callbacks'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/audited-5.8.0/lib/audited/sweeper.rb:16:in `around'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:127:in `block in run_callbacks'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:138:in `run_callbacks'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/abstract_controller/callbacks.rb:233:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal/rescue.rb:23:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal/instrumentation.rb:67:in `block in process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/notifications.rb:206:in `block in instrument'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/notifications/instrumenter.rb:24:in `instrument'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/notifications.rb:206:in `instrument'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal/instrumentation.rb:66:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal/params_wrapper.rb:259:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activerecord-7.0.8.7/lib/active_record/railties/controller_runtime.rb:27:in `process_action'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/abstract_controller/base.rb:151:in `process'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionview-7.0.8.7/lib/action_view/rendering.rb:39:in `process'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal.rb:188:in `dispatch'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_controller/metal.rb:251:in `dispatch'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/routing/route_set.rb:49:in `dispatch'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/routing/route_set.rb:32:in `serve'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/journey/router.rb:50:in `block in serve'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/journey/router.rb:32:in `each'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/journey/router.rb:32:in `serve'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/routing/route_set.rb:852:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/apipie-dsl-2.6.2/lib/apipie_dsl/static_dispatcher.rb:67:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/apipie-rails-1.4.2/lib/apipie/static_dispatcher.rb:74:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/static.rb:23:in `call'
bb9d22bd | /usr/share/foreman/lib/foreman/middleware/libvirt_connection_cleaner.rb:9:in `call'
bb9d22bd | /usr/share/foreman/lib/foreman/middleware/telemetry.rb:10:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/apipie-rails-1.4.2/lib/apipie/middleware/checksum_in_headers.rb:27:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/tempfile_reaper.rb:15:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/etag.rb:27:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/conditional_get.rb:40:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/head.rb:12:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/http/permissions_policy.rb:38:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/http/content_security_policy.rb:39:in `call'
bb9d22bd | /usr/share/foreman/lib/foreman/middleware/logging_context_session.rb:22:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/session/abstract/id.rb:266:in `context'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/session/abstract/id.rb:260:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/cookies.rb:704:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/callbacks.rb:27:in `block in call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/callbacks.rb:99:in `run_callbacks'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/callbacks.rb:26:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/debug_exceptions.rb:28:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/show_exceptions.rb:29:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/railties-7.0.8.7/lib/rails/rack/logger.rb:40:in `call_app'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/railties-7.0.8.7/lib/rails/rack/logger.rb:27:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/sprockets-rails-3.5.2/lib/sprockets/rails/quiet_assets.rb:17:in `call'
bb9d22bd | /usr/share/foreman/lib/foreman/middleware/logging_context_request.rb:11:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/remote_ip.rb:93:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/request_id.rb:26:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/method_override.rb:24:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/runtime.rb:22:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/activesupport-7.0.8.7/lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/executor.rb:14:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/sendfile.rb:110:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/ssl.rb:77:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/actionpack-7.0.8.7/lib/action_dispatch/middleware/host_authorization.rb:131:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/secure_headers-6.7.0/lib/secure_headers/middleware.rb:11:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/railties-7.0.8.7/lib/rails/engine.rb:530:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `public_send'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `method_missing'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/urlmap.rb:74:in `block in call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/urlmap.rb:58:in `each'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/rack-2.2.13/lib/rack/urlmap.rb:58:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/configuration.rb:279:in `call'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/request.rb:99:in `block in handle_request'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/thread_pool.rb:390:in `with_force_shutdown'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/request.rb:98:in `handle_request'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/server.rb:472:in `process_client'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/server.rb:254:in `block in run'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/puma-6.6.0/lib/puma/thread_pool.rb:167:in `block in spawn_thread'
bb9d22bd | /usr/share/foreman/vendor/ruby/3.0.0/gems/logging-2.4.0/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context'
2025-04-29T14:11:38 [I|app|bb9d22bd] Completed 422 Unprocessable Entity in 34ms (Views: 0.2ms | ActiveRecord: 1.4ms | Allocations: 8188)
