LDAPS with certcheck=false about wg-portal

[PandemiK911]

Ok, waiting for the new image on docker-hub.

[PandemiK911]

It works like a charm : no more errors in logs and loggued successully with a LDAP user !

Thanks a lot a for this quick fix and sorry for pointing out the wrong function (or half of it ;-)

[h44z]

Thanks, nice catch. I just pushed the changes to the master branch. If you are using the docker image, can you test the changes using the latest tag (h44z/wg-portal:latest)? (Might take a few minutes for docker-hub to rebuild the image...)

[PandemiK911]

Still the same errors :

INFO[2021-04-21 08:45:06] starting WireGuard Portal Server [latest-e65a4a8]... 
[...]
WARN[2021-04-21 08:45:06] failed to setup LDAP connection, LDAP features disabled 
ERRO[2021-04-21 08:45:06] skipping provider registration: unable to open ldap connection: LDAP Result Code 200 "Network Error": x509: certificate signed by unknown authority

I don't have more debug info with LOG_LEVEL=trace.

My LDAP config (in case I missed something) :

      # LDAP Settings
      - LDAP_ENABLED=true
      - LDAP_TYPE=OpenLDAP
      - LDAP_URL=ldaps://ldap.company.com:636
      - LDAP_BASEDN=dc=company,dc=com
      - LDAP_USER=uid=viewonly,cn=users,cn=accounts,dc=company,dc=com
      - LDAP_PASSWORD=strongpasswordofcourse
      - LDAP_ADMIN_GROUP=cn=vpnadmins,cn=groups,cn=accounts,dc=company,dc=com
      - LDAP_STARTTLS=false
      - LDAP_CERT_VALIDATION=false

Same result with LDAP_STARTTLS=true, which is not surprising.

As configuring a LDAPS server is some kind of nightmare, I can provide a readonly account to ldap.company.com for debugging purposes. Thinking of it, only the hostname would be enough, no need to be able to bind.

[h44z]

I see. I have overlooked the ldap connection code of the auth provider, the previous commit only updated the ldap connection that is used for the user-synchronization.

[PandemiK911]

OK, let see if 7042523 resolve this issue.