Error: ldap identifier backend logon connect error: LDAP Result Code 200 "Network Error": tls: failed to verify certificate
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 103
Description
## Describe the bug
ocis 5.0rc4 (and earlier versions too) starts but doesn't work and shows the following message in the logs when I try to log in:
`
{"level":"error","service":"idp","error":"ldap identifier backend logon connect error: LDAP Result Code 200 \"Network Error\": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-02-28T17:31:56+01:00 is after 2024-01-29T20:04:27Z","time":"2024-02-28T17:31:56+01:00","message":"identifier failed to logon with backend"}
`
I don't know exactly how I got into this situation. After a hardware failure, this instance was down for a few weeks - probably from before 2024-01-29 to after 2024-01-29.
Deleting the following files and restarting ocis fixed the problem:
* /var/lib/ocis/idm -> delete ldap.crt and ldap.key
* /var/lib/ocis/idp -> delete encryption.key and private-key.pem
## Expected behavior
As far as I can see, the certs in `/var/lib/ocis/idm` and `/var/lib/ocis/idp` are automatically copied / generated, so if they are outdated, ocis should probably do one of the following things:
a) refuse to start and give a proper error message
b) copy/generate new versions of the files (the same way it was done originally)
## Actual behavior
ocis starts but doesn't work properly, the administrator has to debug and find the solution on their own.
## Setup
systemd based instance, with the following config:
`
OCIS_BASE_DATA_PATH=/var/lib/ocis
ACCOUNTS_DEMO_USERS_AND_GROUPS=false
PROXY_HTTP_ADDR=0.0.0.0:443
OCIS_URL=https://foo.bar.com
PROXY_TRANSPORT_TLS_KEY=/etc/letsencrypt/live/foo.bar.com/privkey.pem
PROXY_TRANSPORT_TLS_CERT=/etc/letsencrypt/live/foo.bar.com/fullchain.pem
OCIS_INSECURE=false
PROXY_ENABLE_BASIC_AUTH=true
`
Contributor guide
Assessment
This issue has not been assessed yet.