Authentication with domain controller over LDAPS (LDAP over SSL)

[denesvelo]

Dear Community,

I'm using Chamilo LMS 1.11.26.

1. I can confirm, LDAP is working fine.
2. We plan switch the authentication on domain controller from LDAP to LDAPS (over SSL)
3. I didn’t found any hint for LDAPS in your linked dosumentation.

tried:
// Set LDAP options for SSL/TLS
$ldapOptions = array(
LDAP_OPT_X_TLS_REQUIRE_CERT => LDAP_OPT_X_TLS_DEMAND,
LDAP_OPT_X_TLS_PROTOCOL_MIN => LDAP_OPT_X_TLS_PROTOCOL_TLSv1_2,
);
but that didn't worked. Any suggestion?

[denesvelo]

An AI helped solve it.
1st modify $extldap_config in \app\config\auth.conf.php:

$extldap_config = array(
'base_dn' => 'DC=ORGANIZATION,DC=ORG', //base dommain string
'admin_dn' => 'CN=LDAPUSER,OU=Users,DC=ORGANIZATION,DC=ORG', //admin distinguished name
'admin_password' => 'PASSWORD', //admin password
'host' => "ldaps://organization.org:636",
// 'filter' => '', // no () arround the string
// 'port' => 389,
'port' => 636,
'protocol_version' => 3, //protocl version (2 or 3)
'referrals' => 0, // set this to 0 to connect to AD server
//String used to search the user in ldap. %username will ber replaced by the username.
'user_search' => 'sAMAccountName=%username%', // no () arround the string. See extldap_get_user_search_string() function below
'encoding' => 'UTF-8', //encoding used in ldap (most common are UTF-8 and ISO-8859-1
'update_userinfo' => false //Set to true if user info have to be update at each login
);

than edit in \main\auth\external_login\ldap.inc.php:

function extldap_connect()
{
global $extldap_config, $debug;
if (!is_array($extldap_config['host'])) {
$extldap_config['host'] = [$extldap_config['host']];
}
foreach ($extldap_config['host'] as $host) {
// Trying to connect
if (isset($extldap_config['port'])) {
$port = $extldap_config['port'];
} else {
$port = 636; // Standard LDAPS Port
}

    if (isset($extldap_config['use_ldaps']) && $extldap_config['use_ldaps'] === true) {
        $ds = ldap_ssl_connect($host, $port);
    } else {
        $ds = ldap_connect($host, $port);
    }

    if (!$ds) {
        if ($debug) {
            error_log(
                'EXTLDAP ERROR : cannot connect to ' . $extldap_config['host'] . ':' . $port
            );
        }
    } else {
        break;
    }
}
if (!$ds) {
    if ($debug) {
        error_log('EXTLDAP ERROR : no valid server found');
    }
    return false;
}

// Setting protocol version
if (isset($extldap_config['protocol_version'])) {
    if (!ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, $extldap_config['protocol_version'])) {
        ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 2);
    }
}

// Setting protocol version
if (isset($extldap_config['referrals'])) {
    if (!ldap_set_option($ds, LDAP_OPT_REFERRALS, $extldap_config['referrals'])) {
        ldap_set_option($ds, LDAP_OPT_REFERRALS, $extldap_config['referrals']);
    }
}

return $ds;

}

in my case, Windows, there was two additional step:
1, export certificate for ldaps: openssl s_client -connect IP or fqdn of domain controller:636 | openssl x509 -out C:\xampp\apache\certs\ldap-ca.pem
2, add system wide environment variable: LDAPTLS_CACERT = C:\xampp\apache\certs\ldap-ca.pem