How Do I Import CA Certificate (openldap,AD,IDM,FreeIPA) in Ansible Automation Platform Required for LDAPS Integration?

Solution Verified - Updated -

Environment

  • Red Hat Ansible Automation Platform 2.4

Issue

  • I am able to authenticate to the controller UI using LDAP, but when I change to use LDAPS I am unable to authenticate to the server.
    The authentication to LDAPS fails with the below error.

    2020-04-28 17:25:36,184 WARNING  django_auth_ldap Caught LDAPError while authenticating e079127: SERVER_DOWN({'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get issuer certificate)', 'desc': "Can't contact LDAP server"},)

    OR

    2020-06-02 11:48:24,840 WARNING  django_auth_ldap Caught LDAPError while authenticating reinernippes: SERVER_DOWN({'desc': "Can't contact LDAP server", 'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (certificate has expired)'},)

Resolution

  • Login to Controller Node.

  • Create a file called ldap.py in your /etc/tower/conf.d directory with the following:

    AUTH_LDAP_GLOBAL_OPTIONS = {
    ldap.OPT_X_TLS_REQUIRE_CERT: True,
    ldap.OPT_X_TLS_CACERTFILE: "<PATH_TO_LDAPS_SERVER_CERT>"
}
    • Change the permission and group ownership of the file as follows:
      # chmod 640 /etc/tower/conf.d/ldap.py

  # chown root:awx /etc/tower/conf.d/ldap.py      [i.e. -rw-r----- 1 root awx   309 Dec 13 21:23 ldap.py]

  • Additionally, To disable SSL certificate verification change the ldap.py file with below content, keeping the permissions same as mentioned in the previous steps:

    AUTH_LDAP_GLOBAL_OPTIONS = {
    ldap.OPT_X_TLS_REQUIRE_CERT: False
    }

  • After you've created the ldap.py file with the required content, restart your controller services:

    # automation-controller-service restart

Root Cause

  • By default, django_auth_ldap will verify SSL connections before starting an LDAPS transaction.
    When the user receives a "certificate verify failed" error, This means that the django_auth_ldap could not verify the certificate. When the SSL connection cannot be verified, the connection attempt is halted.

Diagnostic Steps

  • To enable logging for LDAP, you must set the Logging Aggregator Level Threshold field to DEBUG in the Controller Settings configuration window:

    * Click the Settings icon from the left navigation pane and select System.
* From the System configuration page, click the Logging tab.
* Scroll down to the bottom and set the Logging Aggregator Level Threshold field to Debug.
* Click Save to save your changes.

  • Enable logging for LDAP

  • Check for errors in /var/log/tower/tower.log .

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments