Problem: LDAP-Auth for external Tools via 7636

[scheinig]

Problem:

LDAP-Auth for external Tools via 7636 and NGINX ssl proxy

This gives a fixed DNS alias with the correct port 636 and a valid certificate. The proxy then also redirects the UCS primary port 7636.

Solution:

Example for Apache-Site with Basic Auth:

 AuthType Basic
 AuthBasicProvider ldap
 AuthName "SCHEIN"
 AuthLDAPURL "ldaps://ldaps.schein.com:636/cn=users,dc=schein,dc=com?uid"
 AuthLDAPInitialBindAsUser on
 AuthLDAPCompareAsUser on
 AuthLDAPInitialBindPattern (.*) uid=$1,cn=users,dc=schein,dc=com
 Require valid-user

See also:

[HowTo] Use letsencrypt certificates for LDAPS connections (via stunnel)

Problem We want to access the UCS LDAP(S) connection with an external service, but with a valid certificate. This example was created during the LDAPS-connection of WebUntis. Ideas Letsencrypt provides certificates which should be accepted by all external LDAP connections replacing the internally used LDAP certificates is a bad idea, things might break completely it’s possible to use a SSL proxy like nginx but we already have stunnel running Prerequisities Warning: the follow…