correct way of using LDAP

[moamen-gamal]

Greetings,
I'm trying to connect EJBCA publisher to an openldap server but for some reason the ejbca always gives me the "Following error occurred when testing connection ss: LDAP ERROR: Error binding to LDAP server. Connect Error".
Thanks.
this is the full docker-compose file it may help

version: '3'

services:

  database:
    container_name: ejbca-db
    image: mariadb:latest
    environment:
      - MYSQL_ROOT_PASSWORD=rootpass1234
      - MYSQL_DATABASE=ejbca
      - MYSQL_USER=ejbca
      - MYSQL_PASSWORD=pass1234
    ports:
      - 3306:3306
    volumes:
      - ./data:/var/lib/mysql
    networks:
      - localnetwork

  openldap:
    image: osixia/openldap:latest
    container_name: openldap
    hostname: openldap
    ports: 
      - "389:389"
      - "636:636"
    volumes:
      - ./data/certificates:/container/service/slapd/assets/certs
      - ./data/slapd/database:/var/lib/ldap
      - ./data/slapd/config:/etc/ldap/slapd.d
    environment: 
      - LDAP_ORGANISATION=ramhlocal
      - LDAP_DOMAIN=ramhlocal.com
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=admin_pass
      - LDAP_CONFIG_PASSWORD=config_pass
      - "LDAP_BASE_DN=dc=ramhlocal,dc=com"
      - LDAP_TLS_CRT_FILENAME=server.crt
      - LDAP_TLS_KEY_FILENAME=server.key
      - LDAP_TLS_CA_CRT_FILENAME=ramhlocal.com.ca.crt
      - LDAP_READONLY_USER=true
      - LDAP_READONLY_USER_USERNAME=user-ro
      - LDAP_READONLY_USER_PASSWORD=ro_pass
    networks:
      - localnetwork
    
  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    hostname: phpldapadmin
    ports: 
      - "80:80"
    environment: 
      - PHPLDAPADMIN_LDAP_HOSTS=openldap
      - PHPLDAPADMIN_HTTPS=false
    depends_on:
      - openldap
    networks:
      - localnetwork

  ejbca:
    container_name: ejbca-server
    image: keyfactor/ejbca-ce:latest
    environment:
      - DATABASE_USER=ejbca
      - DATABASE_PASSWORD=pass1234
      - DATABASE_JDBC_URL=jdbc:mysql://database:3306/ejbca?characterEncoding=UTF-8
    ports:
      - 8443:8443
    depends_on:
      - database
      - openldap
    links:
      - database
      - openldap
    networks:
      - localnetwork
      
networks:
  localnetwork:
    driver: bridge

and as a side note, the logs don't give me anything about the EJBCA trying to connect to openldap. so what Iam suspecting is that the ejbca can't see the openldap server.

[primetomas]

Ho do you try to connect to LDAP from EJBCA? That is in your Publisher configuration. Try without TLS first, there is a "test connection" button, and it should be visible in the EJBCA log when EJBCA connects to LDAP.

Using LDAP nowadays is quite rare btw. I'm always curious about the use cases?

[moamen-gamal]

you are right, i needed to make it a plaintext connection since i didn't configure the TLS.

[primetomas]

Great. The tricky with LDAP and TLS is the trust store. The CA that signed the LDAP servers server certificate must be in Java "cacerts" trust store, otherwise Java it will not be able to establish a TLS connection. It's done by the LDAP library -> Java,