[STARTTLS] LDAP sync failing against Samba4

Description:

LDAP Server: samba 4.9.5+dfsg-5+deb10u1

Running a LDAP sync with Samba4.

Steps to reproduce:

• Groups filter: (&(cn=#{groupName})(member=CN=#{username},OU=*))

1. Set LDAP sync to STARTTLS
2. Run sync

Expected behavior:

Do not crash

Actual behavior:

Crash

Server Setup Information:

• Version of Rocket.Chat Server: 3.7.1
• Operating System: Debian 10
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog: ??
• NodeJS Version: 12.18.1-1nodesource1
• MongoDB Version: 4.2.8

Client Setup Information

• Desktop App or Browser Version:
• Operating System:

Additional context

Relevant logs:

Oct 31 17:11:15 srv-rocket rocketchat[106]: server.js:204 LDAPSync ➔ error LDAPError [StrongAuthRequiredError]: BindSimple: Transport encryption required.
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at messageCallback (/opt/Rocket.Chat/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1419:45)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Parser.onMessage (/opt/Rocket.Chat/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1089:14)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Parser.emit (events.js:210:5)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Parser.EventEmitter.emit (domain.js:475:20)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Parser.write (/opt/Rocket.Chat/programs/server/npm/node_modules/ldapjs/lib/messages/parser.js:111:8)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Socket.onData (/opt/Rocket.Chat/programs/server/npm/node_modules/ldapjs/lib/client/client.js:1076:22)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Socket.emit (events.js:210:5)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Socket.EventEmitter.emit (domain.js:475:20)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at addChunk (_stream_readable.js:309:12)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at readableAddChunk (_stream_readable.js:290:11)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at Socket.Readable.push (_stream_readable.js:224:10)
Oct 31 17:11:15 srv-rocket rocketchat[106]:     at TCP.onStreamRead (internal/stream_base_commons.js:182:23) {
Oct 31 17:11:15 srv-rocket rocketchat[106]:   lde_message: 'BindSimple: Transport encryption required.',
Oct 31 17:11:15 srv-rocket rocketchat[106]:   lde_dn: null
Oct 31 17:11:15 srv-rocket rocketchat[106]: }

Start by reproducing the LDAP sync with STARTTLS against the stated Samba4 version and review the ldapjs trace at programs/server/npm/node_modules/ldapjs/lib/client/client.js. Check how the sync handles the StrongAuthRequiredError and verify completion without a crash or transport-encryption failure.