Setup Secure LDAP over SSL/TLS (LDAPS) for PostgreSQL

Question

Haven’t had much luck while trying several ways to implement LDAPS for PostgreSQL.

pg_hba.conf

hostssl all +test_ldap 0.0.0.0/0 ldap ldapserver=dc2.ad.foobar.com ldapport=636 ldapscheme=ldaps ldaptls=0 ldapbinddn="CN=ldap,OU=Helpers,OU=Foobar,DC=ad,DC=foobar,DC=com" ldapbindpasswd=*** ldapsearchattribute=mail ldapbasedn="OU=Users,OU=Foobar,DC=ad,DC=foobar,DC=com"

Upon research, I found out that the below params are to be changed.

postgresql.conf

ssl = on
ssl_cert_file = 'server.crt'
ssl_key_file = 'server.key'

The question is how do I get .crt and .key from the .pem certificate that I already have (shared by LDAP team). Apart from these what else needs to be done to make it work with LDAPS (SSL/TLS).

Laurenz Albe · Accepted Answer · 2022-01-10 07:43:31Z

1

The solution is to use ldaptls=1.

Per the documentation:

ldaptls

Set to 1 to make the connection between PostgreSQL and the LDAP server use TLS encryption. This uses the StartTLS operation per RFC 4513. See also the ldapscheme option for an alternative.

I don't know what happens if you set both options to contradictory values, but it may well be the problem.

edited Jan 10, 2022 at 7:43

answered Jan 7, 2022 at 7:49

Laurenz Albe

257k22 gold badges312 silver badges388 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Luca Kiebel Over a year ago

While this code snippet may solve the problem, it doesn't explain why or how it answers the question. Please include an explanation for your code, as that really helps to improve the quality of your post. Remember that you are answering the question for readers in the future, and those people might not know the reasons for your code suggestion.

Laurenz Albe Over a year ago

@LucaKiebel I have extended the answer.

Collectives™ on Stack Overflow

Setup Secure LDAP over SSL/TLS (LDAPS) for PostgreSQL

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related