Ondemand httpd ssl issue

Get Help
1

Hi everyone,

I am trying to install Open OnDemand on our login node of our cluster. I have issue to enable the https port.

The system we use is: Rocky Linux release 8.4, ondemand-3.0.3-1.el8.x86_64, ondemand-dex-2.36.0-1.el8.x86_64.

I am setting up using ondemand-dex with LDAP.

There is also an issue to use LDAP. Now I need help first on the SSL/HTTPS.

The HTTP/80 seems works fine, while after I enabled the SSL/HTTPS, when I tried to open the ondemand webportal on a different computer, it directs me to: https:/myserverhere/pun/sys/dashboard, and reports 500 error:

===================================

" Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error lo"

===================================

The strange thing is, that I can manually to open the following link:

https://myserver here:5554/auth/ldap/login?back=&state=lzixgjlc7xxxu

or even I can open
http://myserverhere:5556/auth/ldap/login?back=&state=lzixgjlc7xxxuilzf

The contents of ood_portal.yml look like:

servername: ‘myserverhere’
ssl:
- ‘SSLCertificateFile “/etc/pki/tls/certs/ondemand.crt”’
- 'SSLCertificateKeyFile “/etc/pki/tls/private/ondemand.key”
dex_uri: false

dex:
ssl: true
http_port: “5556”
https_port: “5554”
tls_cert: /etc/ood/dex/ldap.pem
tls_key: /etc/ood/dex/ldap.key
connectors:
- type: ldap
id: ldap
name: LDAP
config:
host: ldapserver:636
rootCA: /etc/ood/dex/ca.pem
insecureSkipVerify: false
bindDN: (hidden)
bindPW: (hidden)
userSearch:
baseDN: (hidden)
filter: (hidden)
cn: uid
username: uid
idAttr: uid
emailAttr: mail
displayName: gecos
preferredUsernameAttr: uid
groupSearch:
baseDN: (hidden)
filter: (hidden)
userMatchers:
- userAttr: DN
groupAttr: member
gidNumber: gidNumber
nameAttr: cn

Thanks in advance for your help!

Best,
Feng

2

OK, fit it by referecning the post: Tried Dex again, help with openidc errors?

3

There is actually a second issue on the SSL:
once I turned on
dex_uri: false
https_port: “5554”
tls_cert: /etc/ood/dex/ldap.pem
tls_key: /etc/ood/dex/ldap.key

My understanding is to set the above cert/key for dex to communicate with LDAP?

Any help is greatly appreciated.

Best,
Feng

[Mon Oct 23 09:19:53.832771 2023] [auth_openidc:error] [pid 3466587:tid 140736643467008] [client xxx:58409] oidc_util_http_call: curl_easy_perform() failed on: https://xxx:5554/.well-known/openid-configuration (SSL certificate problem: unable to get local issuer certificate)

[Mon Oct 23 09:19:53.832801 2023] [auth_openidc:error] [pid 3466587:tid 140736643467008] [client xxx:58409] oidc_provider_static_config: could not retrieve metadata from url: https:/xxxx:5554/.well-known/openid-configuration

[Mon Oct 23 09:20:45.596200 2023] [auth_openidc:error] [pid 3466586:tid 140736635074304] [client xxx:58423] oidc_util_http_call: curl_easy_perform() failed on: https://xxx:5554/.well-known/openid-configuration (SSL certificate problem: unable to get local issuer certificate)

[Mon Oct 23 09:20:45.596233 2023] [auth_openidc:error] [pid 3466586:tid 140736635074304] [client xxxx:58423] oidc_provider_static_config: could not retrieve metadata from url: https://xxxx:5554/.well-known/openid-configuration

4

Without the tls_cert and tls_key, the login webpage can show up, but when try to login, for the error:

Internal Server Error

Login error: failed to connect: LDAP Result Code 200 “Network Error”: x509: certificate signed by unknown authority

Did I miss something?

5

The new error is:

Should we only use true certificate?

[Mon Oct 23 10:19:18.748661 2023] [auth_openidc:error] [pid 3473232:tid 140736162928384] [client xx:58912] oidc_util_http_call: curl_easy_perform() failed on: https://xxxdex/.well-known/openid-configuration (SSL certificate problem: self signed certificate)

[Mon Oct 23 10:19:18.748694 2023] [auth_openidc:error] [pid 3473232:tid 140736162928384] [client xxx:58912] oidc_provider_static_config: could not retrieve metadata from url: https://xxx/dex/.well-known/openid-configuration

6

Yes - both errors are from the certificates you’re using. Or more specifically - the certificate authority they were generated from. You need to use a real/valid certificate authority to generate the certificates. This certificate authority file has to exist on all the systems that will use it. I.e., the OOD server and the LDAP server.

7

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.