# Dex with LDAP giving internal server error

**URL:** <https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972>\
**Category:** Get Help\
**Created:** [March 18, 2022, 9:10pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972 "2022-03-18T21:10:48Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![patoddh](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/patoddh/32/1013_2.png) [@patoddh](https://discourse.openondemand.org/u/patoddh)\
**Post date:** [March 18, 2022, 9:10pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/1 "2022-03-18T21:10:48Z")

</div>

I’ve installed ondemand-2.0.20-1 and ondemand-dex-2.27.0-2 and have the dex section of /etc/ood/config/ood\_portal.yml like this:

```auto
dex:
# # Default based on if ssl key for ood-portal-generator is defined
  ssl: true
# # Only used if SSL is disabled
# http_port: "5556"
# # Only used if SSL is enabled
  https_port: "5554"
# # tls_cert and tls_key take OnDemand configured values for ssl and copy keys to /etc/ood/dex maintaining file names
  tls_cert: null
  tls_key: null
  storage_file: /etc/ood/dex/dex.db
  grpc: null
  expiry: null
# # Client ID, defaults to servername or FQDN
  client_id: null
  client_name: OnDemand
# # Client secret, value auto generated
# # A value that is a filesystem path can be used to store secret in a file
  client_secret: /etc/ood/dex/ondemand.secret
# # The OnDemand redirectURI is auto-generated, this option allows adding additional URIs
  client_redirect_uris: []
# # Additional Dex OIDC clients to configure
# static_clients: []
# # The following example is to configure OpenLDAP
# # Docs: https://github.com/dexidp/dex/blob/master/Documentation/connectors/ldap.md
  connectors:
     - type: ldap
       id: ldap
       name: LDAP
       config:
         host: it-hs-dc03.cshl.edu:636
         insecureSkipVerify: false
         bindDN: "CN=ldap authentication,OU=Service Accounts,OU=ITStaff,OU=Departments,OU=CSHLusers,DC=cshl,DC=edu"
         bindPW: OMITTED
         userSearch:
           baseDN: OU=CSHLusers,DC=cshl,DC=edu
           filter: "(objectClass=posixAccount)"
           username: uid
           idAttr: uid
           emailAttr: mail
           nameAttr: gecos
           preferredUsernameAttr: uid
         groupSearch:
           baseDN: OU=CSHLgroups,DC=cshl,DC=edu
           filter: "(objectClass=posixGroup)"
           userMatchers:
             - userAttr: DN
               groupAttr: member
           nameAttr: cn

```

I am getting an internal server error with the following in the log:

```auto
[Fri Mar 18 16:55:50.259555 2022] [auth_openidc:error] [pid 200603:tid 140224977958656] [client 143.48.116.14:52638] oidc_check_userid_openidc: configuration error: the authentication type is set to "openid-connect" but OIDCRedirectURI has not been set

```

Suggestions and help welcome!

Thanks

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 18, 2022, 9:29pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/2 "2022-03-18T21:29:08Z")

</div>

Hi and welcome!

I’d comment these 2 out and see what the behavior is.

```nohighlight
  # client_id: null
  # client_redirect_uris: []

```

---

<div class="post-metadata">

**Author:** ![patoddh](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/patoddh/32/1013_2.png) [@patoddh](https://discourse.openondemand.org/u/patoddh)\
**Post date:** [March 18, 2022, 9:37pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/3 "2022-03-18T21:37:56Z")

</div>

Thanks for the quick reply. Made that change and got a new error:

```auto
[Fri Mar 18 17:36:47.266770 2022] [auth_openidc:error] [pid 201049:tid 140697458108160] [client 143.48.116.14:53300] oidc_util_http_call: curl_easy_perform() failed on: https://lightshare.cshl.edu:5554/.well-known/openid-configuration (SSL certificate problem: unable to get local issuer certificate)
[Fri Mar 18 17:36:47.266822 2022] [auth_openidc:error] [pid 201049:tid 140697458108160] [client 143.48.116.14:53300] oidc_provider_static_config: could not retrieve metadata from url: https://lightshare.cshl.edu:5554/.well-known/openid-configuration

```

---

<div class="post-metadata">

**Author:** ![jose-d](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jose-d/32/703_2.png) [@jose-d](https://discourse.openondemand.org/u/jose-d)\
**Post date:** [March 21, 2022, 11:55am UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/4 "2022-03-21T11:55:17Z")

</div>

```auto
https://lightshare.cshl.edu:5554/.well-known/openid-configuration

```

hi, try to curl locally this URL to see if ssl-related stuff is going well.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 21, 2022, 1:53pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/5 "2022-03-21T13:53:42Z")

</div>

You probably need to add the CA to the trust store like in this topic.

> [@Unknown certificate authority when using openondemand-dex](https://discourse.openondemand.org/t/unknown-certificate-authority-when-using-openondemand-dex/1083/4):
>
> The internal vs external could be a problem if both addresses are not part of the certificate’s CN or Subject Alternative Name. Also the redirectURIs should probably point to external address. The way the Dex authentication works is you come in from ood0097ca.westeurope.cloudapp.azure.com and then will get redirected likely to ood0097ca.westeurope.cloudapp.azure.com:5554 for Dex. You can check your cert with something like openssl x509 -noout -text -in /etc/ood/dex/ood0097ca.westeurope.clouda…

---

<div class="post-metadata">

**Author:** ![patoddh](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/patoddh/32/1013_2.png) [@patoddh](https://discourse.openondemand.org/u/patoddh)\
**Post date:** [March 21, 2022, 2:42pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/6 "2022-03-21T14:42:33Z")

</div>

Thanks for the help. So we had to change SSLCertificateFile with the cert concatenated with the chain certs, instead of (in addition to?) using SSLCertificateChainFile. That brought up the login page, but after entering username/pw, the next error 🙂 is

```nohighlight
Login error: failed to connect: LDAP Result Code 200 "Network Error": x509: certificate signed by unknown authority

```

On the web page itself

---

<div class="post-metadata">

**Author:** ![jose-d](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jose-d/32/703_2.png) [@jose-d](https://discourse.openondemand.org/u/jose-d)\
**Post date:** [March 21, 2022, 2:51pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/7 "2022-03-21T14:51:06Z")

</div>

do you have your CA in ldap connector specified? like

```auto
...
  connectors:
  - type: ldap
    id: ldap
    name: LDAP
    config:
      host: yourLDAPserver
      rootCA: /etc/ssl/certs/yourCAcert.pem
...

```

---

<div class="post-metadata">

**Author:** ![patoddh](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/patoddh/32/1013_2.png) [@patoddh](https://discourse.openondemand.org/u/patoddh)\
**Post date:** [March 21, 2022, 8:47pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/8 "2022-03-21T20:47:30Z")

</div>

There was no rootCA line. Got it working now, thanks for the help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [September 17, 2022, 8:48pm UTC](https://discourse.openondemand.org/t/dex-with-ldap-giving-internal-server-error/1972/9 "2022-09-17T20:48:00Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.