RocketChat / RocketChat/Rocket.Chat
LDAPS via TCP Proxy needs SNI
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
Using Traefik as a TCP proxy for TLS for LDAP requires SNI.
Steps to reproduce:
Setup bitnami/openldap
Use traefik for TLS termination ( I'm using stepca for local CA )
Try to connect results in all sorts of timeout and failures!
Expected behavior:
Normal connection.
Parse the ldap uri and if ldaps, add servername: "<server_name>" in the tlsOptions param.
Can be an option in the interface too.
Actual behavior:
Server Setup Information:
- Version of Rocket.Chat Server: 6
- Operating System: docker on gentoo
- Deployment Method: docker
- Number of Running Instances: 1
- DB Replicaset Oplog: 1
- NodeJS Version: v14.21.2
- MongoDB Version: 5.0.14
Client Setup Information
- Desktop App or Browser Version: chrome
- Operating System: Windows11
Additional context
Relevant logs:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the LDAP connection setup and LDAP URI parsing, then inspect how ldapjs TLS options are passed for LDAPS connections. Reproduce the failure with an LDAPS endpoint behind a TCP proxy requiring SNI; done when the connection succeeds using the server name from the URI.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100