fix ldap crt init

Author: terrywbrady

app/config/mrt/ldap.lookup.yml

@@ -23,15 +23,19 @@ docker: &docker
     guest_password: guest
     guest_user: anonymous
     connect_timeout: 15
+
 dockerlocal:
   <<: *docker
+
 ecs-dev: &ecs-dev
   admin_password: 
     val: password
   host:
     val: ldap
   port:
     val: 1636
+  tls_ca_file:
+    val: /etc/pki/ca-trust/source/anchors/ldap-ca.crt
   default_read:
     val: merritt-test, anonymous
   default_write:
@@ -44,17 +48,22 @@ ecs-dev: &ecs-dev
     val: simple_tls
   _fixed:
     <<: *fixed
+
 ecs-dbsnapshot:
   <<: *ecs-dev
+
 ecs-ephemeral:
   <<: *ecs-dev
+
 ecs-stg:
   admin_password: 
     ssm: /uc3/mrt/stg/ldap/admin-password
   host:
     env: HOST_LDAP
   port: 
     val: 1636
+  tls_ca_file:
+    val: /etc/pki/ca-trust/source/anchors/ldap-ca.crt
   encryption:
     val: simple_tls
   default_read:
@@ -67,13 +76,16 @@ ecs-stg:
     ssm: /uc3/mrt/stg/ldap/default-admin
   _fixed:
     <<: *fixed
+
 ecs-prd:
   admin_password: 
     ssm: /uc3/mrt/prd/ldap/admin-password
   host:
     env: HOST_LDAP
   port: 
     val: 1636
+  tls_ca_file:
+    val: /etc/pki/ca-trust/source/anchors/ldap-ca.crt
   encryption: 
     val: simple_tls
   default_read:
@@ -86,5 +98,6 @@ ecs-prd:
     ssm: /uc3/mrt/prd/ldap/default-admin
   _fixed:
     <<: *fixed
+
 default:
   <<: *docker 

app/lib/client/ldap/ldap.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'net/ldap'
+require 'openssl'
 
 module UC3Ldap
   # LDAP Client
@@ -33,11 +34,19 @@ def initialize
         connect_timeout: @ldapconf.fetch(:connect_timeout, '60').to_i
       }
       if @ldapconf.fetch(:encryption, '') == 'simple_tls'
+        tls_options = {
+          ssl_version: @ldapconf.fetch('tls', 'TLSv1_2')
+        }
+
+        ca_file = @ldapconf.fetch(:tls_ca_file, '').to_s
+        unless ca_file.empty?
+          tls_options[:ca_file] = ca_file
+          tls_options[:verify_mode] = OpenSSL::SSL::VERIFY_PEER
+        end
+
         @ldap_connect[:encryption] = {
           method: :simple_tls,
-          tls_options: {
-            ssl_version: @ldapconf.fetch('tls', 'TLSv1_2')
-          }
+          tls_options: tls_options
         }
       end
       @ldap = Net::LDAP.new(@ldap_connect)