0

Haven’t had much luck while trying several ways to implement LDAPS for PostgreSQL.

pg_hba.conf

hostssl all +test_ldap 0.0.0.0/0 ldap ldapserver=dc2.ad.foobar.com ldapport=636 ldapscheme=ldaps ldaptls=0 ldapbinddn="CN=ldap,OU=Helpers,OU=Foobar,DC=ad,DC=foobar,DC=com" ldapbindpasswd=*** ldapsearchattribute=mail ldapbasedn="OU=Users,OU=Foobar,DC=ad,DC=foobar,DC=com"

Upon research, I found out that the below params are to be changed.

postgresql.conf

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

The question is how do I get .crt and .key from the .pem certificate that I already have (shared by LDAP team). Apart from these what else needs to be done to make it work with LDAPS (SSL/TLS).

3
  • "Upon research, I found out that the below params are to be changed". Please id the source. This definitely seems wrong to me.
    – jjanes
    Jan 6 at 23:03
  • The question is how do I get .crt and .key from the .pem certificate: that seems to imply that you need do that, but the ldap and postgres server are independent services and they don't have to share the same keys. Besides the "LDAP team" would normally never give out their private key. The certificate they gave you is surely for a client-side usage. Jan 7 at 15:42
1

I have never done this, but my understanding is that the certs need to configured into your LDAP library configuration, not your PostgreSQL. So that would probably be configured in /etc/ldap/ldap.conf. Also, there would be no key. You are just verifying certs, not signing new ones.

Of the links in your comment, the 2nd is only describing using TLS for the client to database connection, not the database to LDAP server connection. The first link describes both, but doesn't explain very clearly which section pertains to which feature. The LDAP one is what they do with /etc/pki/ca-trust/source/anchors/ad-ca.cer although the exact details on that vary with the distribution.

2
  • We had LDAP configured earlier which was working perfectly fine. The problem only occurs while using ldaps://... Is there any way where I can make Postgres use the required certs (I only have .pem). If so I can keep the same config as before (LDAP) with just the port pointing to 636.
    – roman95
    Jan 10 at 14:54
  • As said before, this is part of the LDAP configuration. Just because LDAP was configured to do its thing correctly over plain LDAP, doesn't mean it was configured to do it correctly over LDAPS. In general, pem and crt are just different extensions for the same thing. Pem describes how it is encoded (base 64), and crt describes what it is (a certificate). So a base64-encoded certificate might have either extension.
    – jjanes
    Jan 10 at 16:22
0

You have to use ldaptls=1 to get an encrypted connection to the LDAP server

7
  • I tried this, but all the same. Errors out FATAL: could not load server certificate file "server.crt": no start line
    – roman95
    Jan 10 at 14:46
  • That's a different problem. it means that your server.crt is in the wrong format. Jan 10 at 14:51
  • Well with the given .pem, I used the below openssl cmd to generate the .crt and added (path to .crt) to postgresql.conf. openssl x509 -outform der -in certificate.pem -out certificate.crt. Not sure where I have gone wrong here.
    – roman95
    Jan 10 at 14:57
  • Log detail - DETAIL: LDAP diagnostics: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get local issuer certificate) FATAL: LDAP authentication failed for user "username"
    – roman95
    Jan 10 at 15:02
  • 1
    @LaurenzAlbe There are two competing and mutually incompatible ways to implement SSL with LDAP. ldaptls=1 is one, and ldapscheme=ldaps is the other. As far as I can tell, he is using the right one for him, just configuring it in the wrong way.
    – jjanes
    Jan 10 at 16:38
0

It may very well sound weird, but you do not need any certificates to make LDAPS work. I had spent endless hours but the solution was a 1 liner.

Step 1:

Add the below line to /etc/openldap/ldap.conf (Might vary depending on distro)

TLS_REQCERT never

Step 2:

Make sure you have the below entry to your pg_hba.conf.

i) If SSL is set to off or commented in postgresql.conf. Use below entry

host all +test_ldap 0.0.0.0/0 ldap ldapserver=dc2.ad.foobar.com ldapport=636 ldapscheme=ldaps ldaptls=0 ldapbinddn="CN=ldap,OU=Helpers,OU=Foobar,DC=ad,DC=foobar,DC=com" ldapbindpasswd=*** ldapsearchattribute=mail ldapbasedn="OU=Users,OU=Foobar,DC=ad,DC=foobar,DC=com

ii) If SSL is set to on or commented in postgresql.conf. Just replace host to hostssl (refer above config).

Step 3:

And once the changes are made, login to your psql client as superuser and run the below. Or if you could afford downtime of your DB, simply restart the postgresql.service.

SELECT pg_reload_conf();
New contributor
roman95 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.