ldaps: add LDAPS support - #264
Conversation
shridhargadekar
commented
Jul 31, 2026
shridhargadekar
commented
- Add export_root_ca_certificate() to ADHost, SambaHost, and IPAHost
- Add CertUtils (client.cert) utility for system-level CA cert install into /etc/openldap/ldap.conf — works with adcli, realmd, ldapsearch
- Add SSSDCommonConfiguration helpers: ad_use_ldaps(), samba_use_ldaps(), ipa_set_tls_cacert() for SSSD-specific LDAPS configuration
42bd692 to
74dde9f
Compare
- Add export_root_ca_certificate() to ADHost, SambaHost, and IPAHost - Add CertUtils (client.cert) utility for system-level CA cert install into /etc/openldap/ldap.conf — works with adcli, realmd, ldapsearch - Add SSSDCommonConfiguration helpers: ad_use_ldaps(), samba_use_ldaps(), ipa_set_tls_cacert() for SSSD-specific LDAPS configuration - Add SSSDCommonConfiguration helpers: ad_use_ldaps(), samba_use_ldaps(), ipa_set_tls_cacert() for SSSD-specific LDAPS configuration - Fix ADHost.export_root_ca_certificate() to walk the cert chain from LocalMachine\My (Server Auth EKU) to its issuer in LocalMachine\Root, avoiding unrelated Microsoft root CAs; falls back to server cert for self-signed DC certs (no AD CS) - Add CertUtils.install_ca_from_server() to fetch and install the root CA directly from the LDAPS port via openssl s_client Signed-off-by: shridhargadekar <shridhar.always@gmail.com>
74dde9f to
3721fa4
Compare
|
|
||
| return self.__naming_context | ||
|
|
||
| def export_root_ca_certificate(self) -> str: |
There was a problem hiding this comment.
These functions doesn't belong in hosts, it should be in roles and actually already have this method for this.
You should also add it to the generic provider because realm join works for AD, Samba, and IPA, allowing you to write a single test for multiple topologies using TopologyGroup.AnyDC or AnyAD
| truncate --size 0 /var/log/krb5kdc.log | ||
| """) | ||
|
|
||
| def export_root_ca_certificate(self) -> str: |
There was a problem hiding this comment.
Like the previous comment, this doesn't belong in hosts, it should be in roles, there is an IPACertifcateAuthority.get() which may work for the CA as well. This CertificateAuthority class should be extended.
| self.adminpw: str = self.config.get("adminpw", self.bindpw) | ||
| """Password of the admin user, defaults to value of ``bindpw``.""" | ||
|
|
||
| self.ca_cert_path: str = self.config.get("ca_cert_path", "/var/data/certs/ca.crt") |
There was a problem hiding this comment.
Same as the previous comment, but this has no CertificateAuthority class. Please make each role a separate commit.
| .. code-block:: python | ||
| :caption: Example usage with adcli | ||
|
|
||
| @pytest.mark.topology(KnownTopology.Samba) |
There was a problem hiding this comment.
I don't think this test scenario is really valid, since the KnownTopology.Samba is already joined when the test starts. Have you tried running this test?
|
|
||
|
|
||
| class _HasCACert(Protocol): | ||
| """Any host that can export its root CA certificate.""" |
There was a problem hiding this comment.
Moving to roles, this shouldn't be necessary.
| def install_ca( | ||
| self, | ||
| host: _HasCACert, | ||
| name: str = "test-ldap-ca.crt", |
There was a problem hiding this comment.
Nitpick, the ca.crt doesn't have to be used for ldap, I'd omit ldap from the name.
| self.sssd.fs.mkdir_p(parent) | ||
| self.sssd.fs.write(cacert_path, ca_cert) | ||
|
|
||
| def ad_use_ldaps(self, ad: AD, cacert_path: str = "/etc/sssd/pki/ad-ca.crt") -> None: |
There was a problem hiding this comment.
We already have a method to configure ldap, SSSDCommonConfiugration.ldap_provider, instead of adding three new methods, please extend this method to support ldaps.
def ldap_provider(
self,
server: str,
naming_context: str,
bind_user_dn: str,
bind_password: str,
subids: bool = False,
cacert: str = "/etc/ipa/ca.crt",
tls_reqcert: str = "demand",
ssl: bool = False,
config: dict[str, str] | None = None,
) -> None:
3 participants
