Project

General

Profile

Forums » Open discussion »

LDAPS certificate issue with Google Workspace LDAP

Added by Tolga Uzun 11 days ago

I’m trying to use LDAP authentication with Google Workspace’s LDAP but haven’t been able to make it work.

Google provides .crt and .key files, which I copied to my Redmine instance and ran update-ca-certificates, successfully adding the certificates.

When I test LDAPS, it shows state=error: certificate verify failed (self-signed certificate). I tried disabling certificate verification, which changes the test state to successful, but I still can’t log in.

Does anyone know the proper configuration for setting up LDAP with Google Workspace? I might be misconfiguring the Base DN or the filter.

Any help would be appreciated!


Replies (3)

RE: LDAPS certificate issue with Google Workspace LDAP - Added by Lionel BAKALA 4 days ago

Hi Tolga,

To assist in troubleshooting your issue, I have a question: Can you query your Google Workspace LDAP directory from your Redmine instance using command like ?

ldapsearch -H ldaps://ldap.google.com -D "uid=admin,ou=users,dc=example,dc=com" -W -b "dc=example,dc=com"

This will help verify that LDAPS connectivity and authentication are functioning correctly from the Redmine host, and whether any certificates are required for the connection.

RE: LDAPS certificate issue with Google Workspace LDAP - Added by Tolga Uzun 3 days ago

Hi Lionel,

Thanks for your interest for this issue.

ldapsearch itself does not work but I have to add LDAPTLS_CACERT, LDAPTLS_CERT and LDAPTLS_KEY addresses to the command. I can see the users and groups with that command.

Btw, I already gave up, when I heard the TFA of Google is not supported with this LDAP method and going to an OAUTH path. Thanks anyway

RE: LDAPS certificate issue with Google Workspace LDAP - Added by Lionel BAKALA 3 days ago

Hello Tolga,

OAuth is more efficient, and you still have the option to use Google Workspace LDAP as a user source.

I recently worked on a Redmine authentication setup using Authelia (an identity provider), which introduces two-factor authentication (TFA).

Best regards,

    (1-3/3)