# Dex LDAP not working

**URL:** <https://discourse.openondemand.org/t/dex-ldap-not-working/1189>\
**Category:** Get Help\
**Created:** [November 2, 2020, 7:09pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189 "2020-11-02T19:09:54Z")\
**Posts on this page:** 8\
**Page:** 2

<div class="post-metadata">

**Author:** ![miketice22](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/miketice22/32/569_2.png) [@miketice22](https://discourse.openondemand.org/u/miketice22)\
**Post date:** [November 3, 2020, 9:40pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/21 "2020-11-03T21:40:51Z")

</div>

[root@aplcdhen01 config]# rpm -q ondemand-dex  
ondemand-dex-2.24.0-8.el7.x86\_64  
[root@aplcdhen01 config]# rpm -q ondemand  
ondemand-1.6.25-1.el7.x86\_64  
[root@aplcdhen01 config]# ls -l /usr/sbin/ondemand-dex  
-rwxr-xr-x 1 root root 24754216 Aug 6 15:30 /usr/sbin/ondemand-dex  
[root@aplcdhen01 config]#  
[root@aplcdhen01 config]# ls -l /etc/ood/dex/  
total 4  
-rw------- 1 ondemand-dex ondemand-dex 3508 Nov 3 19:33 config.yaml

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 3, 2020, 9:50pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/22 "2020-11-03T21:50:06Z")

</div>

Your version of OnDemand is too old to support Dex directly. You will need to upgrade to latest 1.8 release which is 1.8.12. Here are steps: [https://osc.github.io/ood-documentation/latest/release-notes/v1.8-release-notes.html#upgrading-from-v1-7](https://osc.github.io/ood-documentation/latest/release-notes/v1.8-release-notes.html#upgrading-from-v1-7)

There is one special step for upgrading from 1.6: [https://osc.github.io/ood-documentation/latest/release-notes/v1.8-release-notes.html#upgrading-from-v1-6](https://osc.github.io/ood-documentation/latest/release-notes/v1.8-release-notes.html#upgrading-from-v1-6)

While it’s possible to run mod\_auth\_openidc in such a way to support Dex without upgrading, I would strongly recommend upgrading as OIDC authentication was made much easier with the 1.8 release. If for some reason you cannot upgrade then you will have to configure mod\_auth\_openidc with all the necessary values similar to my previous `grep` output, just substitute your values. They could go into a file like `/opt/rh/httpd24/root/etc/httpd/conf.d/auth_oidc.conf`. Also you will have to configure Dex manually if you can not upgrade as the automatic Dex configuration steps taken by OnDemand were added in 1.8.

---

<div class="post-metadata">

**Author:** ![miketice22](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/miketice22/32/569_2.png) [@miketice22](https://discourse.openondemand.org/u/miketice22)\
**Post date:** [November 4, 2020, 1:23pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/23 "2020-11-04T13:23:10Z")

</div>

Thanks, I upgraded, now see the following errors:

> [Wed Nov 04 13:21:00.837888 2020] [auth\_openidc:error] [pid 29084] [client 10.100.10.124:49250] oidc\_util\_jwt\_verify: parsing JWT failed: [src/jose.c:699: oidc\_jwe\_decrypt\_impl]: encrypted JWT could not be decrypted with any of the 1 keys: error for last tried key is: crypto error [file: jwe.c, function: \_cjose\_jwe\_decrypt\_dat\_a256gcm, line: 1263]  
> [Wed Nov 04 13:21:00.837968 2020] [auth\_openidc:error] [pid 29084] [client 10.100.10.124:49250] oidc\_authenticate\_user: the URL hostname (localhost) of the configured OIDCRedirectURI does not match the URL hostname of the URL being accessed (ondemand.jhuapl.edu): the “state” and “session” cookies will not be shared between the two!

```
cat /etc/ood/config/ood_portal.yml
# Ansible managed
---
servername: ondemand.jhuapl.edu
port: '443'

ssl:
- 'SSLCertificateFile /etc/pki/tls/certs/aplcdhen01.jhuapl.edu.pem'
- 'SSLCertificateKeyFile /etc/pki/tls/private/aplcdhen01.jhuapl.edu.key'
- 'SSLCertificateChainFile /etc/pki/tls/certs/aplcdhen01.jhuapl.edu.pem'

auth:
- 'AuthType openid-connect'
- 'Require valid-user'

dex:
  client_secret: 334389048b872a533002b34d73f8c29fd09efc50
  client_id: localhost
  connectors:
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: aplid.jhuapl.edu:636
        insecureSkipVerify: false
        userSearch:
          baseDN: cn=users,dc=jhuapl,dc=edu
          filter: "(objectClass=person)"
          username: uid
          idAttr: uid
          emailAttr: mail
          nameAttr: displayName
          preferredUsernameAttr: uid
        groupSearch:
          baseDN: ou=Groups,dc=dom1-proxy,dc=apl-staging
          filter: "(objectClass=group)"
          userMatchers:
            - userAttr: DN
              groupAttr: member
          nameAttr: cn
  frontend:
    theme: ondemand

[root@aplcdhen01 ~]# cat /etc/ood/dex/config.yaml
---
issuer: https://ondemand.jhuapl.edu:5554
storage:
  type: sqlite3
  config:
    file: "/etc/ood/dex/dex.db"
web:
  http: 0.0.0.0:5556
  https: 0.0.0.0:5554
  tlsCert: "/etc/ood/dex/aplcdhen01.jhuapl.edu.pem"
  tlsKey: "/etc/ood/dex/aplcdhen01.jhuapl.edu.key"
telemetry:
  http: 0.0.0.0:5558
staticClients:
- id: localhost
  redirectURIs:
  - https://localhost/oidc
  name: OnDemand
  secret: 334389048b872a533002b34d73f8c29fd09efc50
connectors:
- type: ldap
  id: ldap
  name: LDAP
  config:
    host: aplid.jhuapl.edu:636
    insecureSkipVerify: false
    userSearch:
      baseDN: cn=users,dc=jhuapl,dc=edu
      filter: "(objectClass=person)"
      username: uid
      idAttr: uid
      emailAttr: mail
      nameAttr: displayName
      preferredUsernameAttr: uid
    groupSearch:
      baseDN: ou=Groups,dc=dom1-proxy,dc=apl-staging
      filter: "(objectClass=group)"
      userMatchers:
      - userAttr: DN
        groupAttr: member
      nameAttr: cn
oauth2:
  skipApprovalScreen: true
enablePasswordDB: false
frontend:
  dir: "/usr/share/ondemand-dex/web"
  theme: ondemand

```

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 4, 2020, 2:16pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/24 "2020-11-04T14:16:31Z")

</div>

Remove `client_id: localhost` from your `dex` configuration in `ood_portal.yml` as that is used to build the `OIDCRedirectURI`. The client ID will automatically be populated based on the value you supplied for `servername` so it’s fine to omit the value. If you want to continue setting `client_id` then set it to same value as `servername`. With OnDemand the only thing under `dex` you must set is `connectors`. All the other items will be automatically set to appropriate values for you.

---

<div class="post-metadata">

**Author:** ![miketice22](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/miketice22/32/569_2.png) [@miketice22](https://discourse.openondemand.org/u/miketice22)\
**Post date:** [November 4, 2020, 2:50pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/25 "2020-11-04T14:50:36Z")

</div>

Thanks! That worked. Now it looks like there are formatting issues with the page, but I would assume you would want to track that as a separate topic/issue, correct?

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 4, 2020, 4:21pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/26 "2020-11-04T16:21:38Z")

</div>

If the issue is formatting issues with Dex then I think this thread is fine, otherwise a new thread might be better.

---

<div class="post-metadata">

**Author:** ![miketice22](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/miketice22/32/569_2.png) [@miketice22](https://discourse.openondemand.org/u/miketice22)\
**Post date:** [November 4, 2020, 4:28pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/27 "2020-11-04T16:28:04Z")

</div>

I started another thread, thanks.

---

<div class="post-metadata">

**Author:** ![westburg.2](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@westburg.2](https://discourse.openondemand.org/u/westburg.2)\
**Post date:** [May 26, 2022, 3:43pm UTC](https://discourse.openondemand.org/t/dex-ldap-not-working/1189/28 "2022-05-26T15:43:04Z")

</div>



[Previous page](https://discourse.openondemand.org/t/dex-ldap-not-working/1189.md?page=1)