# LDAP authentication with TLS using ood\_portal.yml

**URL:** <https://discourse.openondemand.org/t/ldap-authentication-with-tls-using-ood-portal-yml/232>\
**Category:** Get Help\
**Created:** [March 4, 2019, 11:37pm UTC](https://discourse.openondemand.org/t/ldap-authentication-with-tls-using-ood-portal-yml/232 "2019-03-04T23:37:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![msgambati-INL](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/msgambati-inl/32/935_2.png) [@msgambati-INL](https://discourse.openondemand.org/u/msgambati-INL)\
**Post date:** [March 4, 2019, 11:37pm UTC](https://discourse.openondemand.org/t/ldap-authentication-with-tls-using-ood-portal-yml/232/1 "2019-03-04T23:37:02Z")

</div>

Hello,

We are trying to get OOD to authenticate with our LDAP server with TLS enabled using the ood\_portal.yml file. We were able to get it to work, but we could not figure out where to put the necessary entries in the ood\_portal.yml file. Here are the two lines we need in order for it to work:

- ‘LDAPTrustedMode TLS’
- ‘LDAPTrustedGlobalCert CA\_BASE64 /etc/openldap/cacerts/hpc-cacert.pem’

We added the first one to ssl directives section, but we are not sure where to add the second line. Once we run the update\_ood\_portal command, we then have to manually add the GlobalCert line to the server config section, not the virtual host section?

```auto
ood_portal.yml:
ssl:
  - SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
  - 'SSLCertificateFile "<path_to_cert>"'
  - 'SSLCertificateKeyFile "<path_to_key>"'
  - 'SSLCertificateChainFile "<path_to_chainfile>"'
  - 'LDAPTrustedMode TLS'

auth:
  - 'AuthType Basic'
  - 'AuthName "private"'
  - 'AuthBasicProvider ldap'
  - 'AuthLDAPURL "ldap://<hostname>/ou=People,dc=<dc's>?uid"'
  - 'AuthLDAPGroupAttribute memberUid'
  - 'AuthLDAPGroupAttributeIsDN off'
  - 'RequestHeader unset Authorization'
  - 'Require valid-user'

ood-port.conf (after edit):
# # For CentOS 7
# sudo systemctl try-restart httpd24-httpd.service httpd24-htcacheclean.service
#

LDAPTrustedGlobalCert CA_BASE64 <path_to_ca>

# Redirect all http traffic to the https Open OnDemand portal URI
# http://*:443
# #=> https://localhost:443
#
<VirtualHost *:80>
  RewriteEngine On
  RewriteRule ^(.*) https://%{SERVER_NAME}:443$1 [R=301,NE,L]
</VirtualHost>

# The Open OnDemand portal VirtualHost
#
<VirtualHost *:443>

  SSLEngine On
  SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
  SSLCertificateFile "<path_to_cert>"
  SSLCertificateKeyFile "<path_to_key>"
  SSLCertificateChainFile "<path_to_chainfile>"
  LDAPTrustedMode TLS

  # Lua configuration
  #
  LuaRoot "/opt/ood/mod_ood_proxy/lib"
  LogLevel lua_module:info

  # Log authenticated user requests (requires min log level: info)
  LuaHookLog logger.lua logger

  # Authenticated-user to system-user mapping configuration
  #
  SetEnv OOD_USER_MAP_CMD "/opt/ood/ood_auth_map/bin/ood_auth_map.regex"

  # Per-user Nginx (PUN) configuration
  # NB: Apache will need sudo privs to control the PUNs
  #
  SetEnv OOD_PUN_STAGE_CMD "sudo /opt/ood/nginx_stage/sbin/nginx_stage"

  #
  # Below is used for sub-uri's this Open OnDemand portal supports
  #

  # Serve up publicly available assets from local file system:
  #
  # https://localhost:443/public/favicon.ico
  # #=> /var/www/ood/public/favicon.ico
  #
  Alias "/public" "/var/www/ood/public"
  <Directory "/var/www/ood/public">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
  </Directory>

  # Reverse proxy traffic to backend PUNs through Unix domain sockets:
  #
  # https://localhost:443/pun/dev/app/simulations/1
  # #=> unix:/path/to/socket|http://localhost/pun/dev/app/simulations/1
  #
  SetEnv OOD_PUN_URI "/pun"
  <Location "/pun">
    AuthType Basic
    AuthName "private"
    AuthBasicProvider ldap
    AuthLDAPURL "ldap://<hostname>/ou=People,dc=<dc's>?uid"
    AuthLDAPGroupAttribute memberUid
    AuthLDAPGroupAttributeIsDN off
    RequestHeader unset Authorization
    Require valid-user

    ProxyPassReverse "http://localhost/pun"

    # ProxyPassReverseCookieDomain implementation (strip domain)
    Header edit* Set-Cookie ";\s*(?i)Domain[^;]*" ""

    # ProxyPassReverseCookiePath implementation (less restrictive)
    Header edit* Set-Cookie ";\s*(?i)Path\s*=(?-i)(?!\s*/pun)[^;]*" "; Path=/pun"

    SetEnv OOD_PUN_SOCKET_ROOT "/var/run/nginx"
    SetEnv OOD_PUN_MAX_RETRIES "5"
    LuaHookFixups pun_proxy.lua pun_proxy_handler

  </Location>

  # Control backend PUN for authenticated user:
  # NB: See mod_ood_proxy for more details.
  #
  # https://localhost:443/nginx/stop
  # #=> stops the authenticated user's PUN
  #
  SetEnv OOD_NGINX_URI "/nginx"
  <Location "/nginx">
    AuthType Basic
    AuthName "private"
    AuthBasicProvider ldap
    AuthLDAPURL "ldap://<hostname>/ou=People,dc=<dc's>?uid"
    AuthLDAPGroupAttribute memberUid
    AuthLDAPGroupAttributeIsDN off
    RequestHeader unset Authorization
    Require valid-user

    LuaHookFixups nginx.lua nginx_handler
  </Location>

  # Redirect root URI to specified URI
  #
  # https://localhost:443/
  # #=> https://localhost:443/pun/sys/dashboard
  #
  RedirectMatch ^/$ "/pun/sys/dashboard"

  # Redirect logout URI to specified redirect URI
  #
  # https://localhost:443/logout
  # #=> https://localhost:443/pun/sys/dashboard/logout
  #
  Redirect "/logout" "/pun/sys/dashboard/logout"

</VirtualHost>

```

Let me know what additional information is needed.

Thanks,

Matt

---

<div class="post-metadata">

**Author:** ![efranz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/efranz/32/27_2.png) [@efranz](https://discourse.openondemand.org/u/efranz)\
**Post date:** [March 13, 2019, 5:56pm UTC](https://discourse.openondemand.org/t/ldap-authentication-with-tls-using-ood-portal-yml/232/2 "2019-03-13T17:56:12Z")

</div>

This is the template file used to generate the Apache config from the config yaml you have: [https://github.com/OSC/ondemand/blob/799e7b39bfac5bc89f81306ee673dfdc3c0c7ec3/ood-portal-generator/templates/ood-portal.conf.erb](https://github.com/OSC/ondemand/blob/799e7b39bfac5bc89f81306ee673dfdc3c0c7ec3/ood-portal-generator/templates/ood-portal.conf.erb)

It doesn’t appear there is any location to insert server configuration.

What you could do instead is add a separate file `/opt/rh/httpd24/root/etc/httpd/conf.d/global_cert.conf` with a single directive:

```auto
LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/cacerts/hpc-cacert.pem

```

I think that Apache loads these conf files in alphabetical order so that would be loaded and then the ood-portal.conf would be loaded. When ood-portal.conf was regenerated you wouldn’t lose manual edits since the `LDAPTrustedGlobalCert` would have been added to a separate file.

---

<div class="post-metadata">

**Author:** ![msgambati-INL](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/msgambati-inl/32/935_2.png) [@msgambati-INL](https://discourse.openondemand.org/u/msgambati-INL)\
**Post date:** [March 21, 2019, 3:48pm UTC](https://discourse.openondemand.org/t/ldap-authentication-with-tls-using-ood-portal-yml/232/3 "2019-03-21T15:48:18Z")

</div>

Hi Efranz,

I tried your suggestion of adding the global\_cert.conf file and it works fine. Is there any plans to add server configuration to the template file?

Thanks,

Matt

---

<div class="post-metadata">

**Author:** ![westburg.2](https://avatars.discourse-cdn.com/v4/letter/w/0ea827/32.png) [@westburg.2](https://discourse.openondemand.org/u/westburg.2)\
**Post date:** [May 26, 2022, 3:17pm UTC](https://discourse.openondemand.org/t/ldap-authentication-with-tls-using-ood-portal-yml/232/4 "2022-05-26T15:17:22Z")

</div>

Closed on May 26, 2022, 3:17pm UTC