# How to configure OnDemand Dex for LDAP

**URL:** <https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079>\
**Category:** Get Help\
**Tags:** question\
**Created:** [August 25, 2020, 6:28pm UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079 "2020-08-25T18:28:03Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![fangpingmu](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fangpingmu/32/532_2.png) [@fangpingmu](https://discourse.openondemand.org/u/fangpingmu)\
**Post date:** [August 25, 2020, 6:28pm UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/1 "2020-08-25T18:28:03Z")

</div>

I updated open ondemand to 1.8. The basic LDAP authentication still works fine.

I am changing basic LDAP authentication to ondemand-dex. I have installed ondemand-dex, and modified /etc/ood/config/ood\_portal.yml to dex LDAP configurations based on the following documentation.

[https://osc.github.io/ood-documentation/latest/authentication/dex.html#authentication-dex](https://osc.github.io/ood-documentation/latest/authentication/dex.html#authentication-dex)

I got a “This site can’t be reached” error. How can I debug this problem? Where are the logs?

Thanks a lot!

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [August 25, 2020, 6:29pm UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/2 "2020-08-25T18:29:22Z")

</div>

Hi and welcome!

Check the apache logs at `/var/log/httpd24/error.log`. There may also be dex logs in that `/var/log` directory as well.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [August 25, 2020, 8:56pm UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/3 "2020-08-25T20:56:06Z")

</div>

Is the `ondemand-dex` service running? You need that running in order to log into Dex with LDAP.

---

<div class="post-metadata">

**Author:** ![fangpingmu](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fangpingmu/32/532_2.png) [@fangpingmu](https://discourse.openondemand.org/u/fangpingmu)\
**Post date:** [August 25, 2020, 11:41pm UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/4 "2020-08-25T23:41:59Z")

</div>

`ondemand-dex` service is running.

systemctl status ondemand-dex  
● ondemand-dex.service - OnDemand Dex - A federated OpenID Connect provider packaged for OnDemand  
Loaded: loaded (/usr/lib/systemd/system/ondemand-dex.service; enabled; vendor preset: disabled)  
Active: active (running) since Tue 2020-08-25 19:26:25 EDT; 9min ago  
Main PID: 3228 (ondemand-dex)  
CGroup: /system.slice/ondemand-dex.service  
└─3228 /usr/sbin/ondemand-dex serve /etc/ood/dex/config.yaml

Nothing in `/var/log/httpd24/error.log` is relevant. Cannot find any dex logs under /var/log.

After the error, I did realize that the web address changed to _.crc.pitt.edu:5554/auth?response\_type=code&scope=openid%20profile%20email&client\_id=_

Where does the port 5554 come from?

---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [August 26, 2020, 1:30am UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/5 "2020-08-26T01:30:12Z")

</div>

5554 is the default port for Dex - since it is an OpenID Connect identity provider, it must listen on a separate port from Apache

---

<div class="post-metadata">

**Author:** ![fangpingmu](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fangpingmu/32/532_2.png) [@fangpingmu](https://discourse.openondemand.org/u/fangpingmu)\
**Post date:** [August 26, 2020, 1:43am UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/6 "2020-08-26T01:43:24Z")

</div>

Does this port need to be open?

We only open port 80 and 443. I assume that open ondemand will listen to port 443 and use port 5554 internally.

it seems ondemand-dex is using 5554 externally, which is not reachable by default.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [August 26, 2020, 11:18am UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/7 "2020-08-26T11:18:22Z")

</div>

Yes, the port used by Dex needs to be accessible externally as when a user logs in they will get redirected to that port to perform authentication on the login page. If you configure with SSL the port is 5554 and non-SSL is 5556.

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [August 26, 2020, 11:37am UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/8 "2020-08-26T11:37:32Z")

</div>

I’ve opened a documentation pull request to clarify this extra firewall requirement: [https://github.com/OSC/ood-documentation/pull/394](https://github.com/OSC/ood-documentation/pull/394)

---

<div class="post-metadata">

**Author:** ![westburg.2](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@westburg.2](https://discourse.openondemand.org/u/westburg.2)\
**Post date:** [May 26, 2022, 3:43pm UTC](https://discourse.openondemand.org/t/how-to-configure-ondemand-dex-for-ldap/1079/9 "2022-05-26T15:43:09Z")

</div>