Bug 25512 - Add support for LDAPS
Summary: Add support for LDAPS
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-05-15 12:59 UTC by Magnus Enger
Modified: 2023-02-02 22:58 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Magnus Enger 2020-05-15 12:59:07 UTC
Salvaging this from bug 8993:

I'm an LDAP noob, but working with a customer I have managed to get LDAPS working, by changing line 114 of C4/Auth_with_ldap.pm from this:

  my $db = Net::LDAP->new(\@hosts);

to this:

  my $db = Net::LDAP->new(\@hosts, version => 3, scheme => 'ldaps', port => 123, capath => '/usr/ssl/certs');

Does that look like something that might be useful to others? 

Maybe all the options to Net::LDAP->new should be made configurable? 
https://metacpan.org/pod/Net::LDAP

The comments in C4::Auth_with_ldap describes how to configure LDAP, including mappings etc. Maybe this configuration could be extended with an "options" element to something like this:

 <config>
  ...
  <useldapserver>1</useldapserver>
  <!-- LDAP SERVER (optional) -->
  <ldapserver id="ldapserver">
    <hostname>localhost</hostname>
    <base>dc=metavore,dc=com</base>
    <user>cn=Manager,dc=metavore,dc=com</user>             <!-- DN, if not anonymous -->
    <pass>metavore</pass>          <!-- password, if not anonymous -->
    <options>
      <scheme>...</scheme>
      <keepalive>...</keepalive>
      <timeout>...</timeout>
      etc...
    </options>
    ...
    <mapping>
       ...
    </mapping> 
  </ldapserver> 
 </config>

So that we can iterate over the elements inside <options>, and use them to make a hash with element names as keys and element content as values, and then pass this to Net::LDAP->new?

Bug 5406 is similar to this, but was marked CLOSED INVALID, because you can specify <hostname>ldaps://ldap.example.com</hostname> to get LDAPS. But I still think you might need to ble able to specify things like cafile or capath? 

Opinions most welcome!
Comment 1 Frédéric Demians 2023-02-02 14:01:02 UTC
I'm encountering the same issue with Google Workspace LDAP server. It is necessary to explicitly specify Google cert/key files generated for each configured LDAP client from Google Workspace admin console. Something like that:

clientcert => '..../etc/ldap/Google_xx_yy_zz_36497.crt',
clientkey  => '..../etc/ldap/Google_xx_yy_zz_36497.key',