How to properly configure LDAP

[vsfomin]

I can't set up LDAP correctly in my case.
Below is the ldapsearch command that works for me, I find "Some.User" in AD. How to correctly transfer parameters to the Kafka-ui ldap configuration? Below my configuration in kafka-ui, but it doesn't work.

ldapsearch -H ldaps://ldap.example.com -D "cn=hdp.ad.reader,OU=<MyGroup>,OU=Service Accounts,OU=Admins,DC=<example>,DC=<com>" -w "***** -b "DC=<example>,DC=<com>" "(sAMAccountName=Some.User)"

I see Active Directory authentication failed: Supplied password was invalid in logs.

auth:
      type: LDAP
spring:
      ldap:
        admin-password: ****
        admin-user: cn=hdp.ad.reader,OU=<MyGroup>,OU=Service Accounts,OU=Admins,DC=<example>,DC=<com>
        base: DC=<example>,DC=<com>
        group-filter-search-base: DC=<example>,DC=<com>
        urls: ldaps://ldap.example.com
        user-filter-search-base: DC=<example>,DC=<com>
        user-filter-search-filter: (sAMAccountName={0})

DEBUG logs:

G [Thread-129] j.e.security: X509Certificate: Alg:SHA256withRSA, Serial:2d:00:a8:b7:b4:f9:e2:ce:19:37:83:56:87:00:01:00:a8:b7:b4, Subject:CN=*.dmp.x5.ru, OU=DMP, O=X5 Tech, L=Moscow, ST=Moscow, C=RU, Issuer:CN=IssuingCA01, O=X5 Group, C=RU, Key type:RSA, Length:4096, Cert Id:3126932924, Valid from:6/16/25, 8:23 AM, Valid until:6/16/26, 8:23 AM
2025-07-01 11:46:53,632 DEBUG [Thread-129] j.e.security: X509Certificate: Alg:SHA256withRSA, Serial:36:00:00:00:28:09:22:fd:41:24:0c:6a:b5:00:03:00:00:00:28, Subject:CN=IssuingCA01, O=X5 Group, C=RU, Issuer:CN=RootCA, Key type:RSA, Length:2048, Cert Id:506732166, Valid from:2/1/25, 6:35 AM, Valid until:2/1/30, 6:45 AM
2025-07-01 11:46:53,632 DEBUG [Thread-129] j.e.security: X509Certificate: Alg:SHA256withRSA, Serial:17:30:03:57:b4:2d:0a:8d:43:41:62:cd:d9:38:38:e6, Subject:CN=RootCA, Issuer:CN=RootCA, Key type:RSA, Length:2048, Cert Id:946327557, Valid from:7/9/20, 3:51 PM, Valid until:7/9/30, 4:01 PM
2025-07-01 11:46:53,660 DEBUG [boundedElastic-7] o.s.s.w.s.a.AuthenticationWebFilter: Authentication failed: simple bind failed: ldap.example.com:636

[Haarolean]

@vsfomin hi, could you try running with ldap logs enabled?
LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_LDAP: TRACE
hope that gives any useful insight.

[vsfomin]

I'm running LDAPS and ldap server asnwer succesfully.
ldap.domain.name (192.168.235.232:636) open
Tests from kafka-ui pod

[Haarolean]

@vsfomin is your ldap certificate a self-signed one? If yes, have you anyhow included it into jdk/app truststore(-s)?

[vsfomin]

@Haarolean I've included all company certificates into new image and did update-ca-certificates. It doesn't make some changes.

FROM kafbat/kafka-ui:v1.2.0
USER root
RUN apk add --no-cache ca-certificates
COPY certs/ /usr/local/share/ca-certificates/   #copy company certs here
RUN update-ca-certificates
USER kafkaui

After I check it in /etc/ssl/certs
I've installed openssl into image and check openssl s_client -connect ldap.<my-company-domain>:636 -showcerts
And I see chain of certs and other information.

Connecting to 192.168.235.232
CONNECTED(00000003)
depth=2 CN=RootCA
verify return:1
depth=1 C=RU, O=My Company, CN=IssuingCA01
verify return:1
depth=0 C=RU, ST=Moscow, L=Moscow, O=My Company, OU=DMP, CN=*.my-company-domain
verify return:1
...
...
"SSL handshake has read 4944 bytes and written 415 bytes
Verification: OK"

Finally, I've build kafka-ui image with openldap-client and check connection:

ldapsearch -H ldaps://ldap.<my-domain> -D "cn=some-account,OU=Hadoop,OU=Service Accounts,OU=Admins,DC=Company,DC=com" -w "*****" -b "OU=Main,DC=Company,DC=com" "(&(sAMAccountName=Vladi.Fomin)(objectClass=user))"

and this return sAMAccountName=Vladi.Fomin information

[fallen-up]

@vsfomin
try this way:
keytool -import -trustcacerts -alias mycompany-root-ca -file /certs/ca.crt -keystore /usr/lib/jvm/zulu21-ca/lib/security/cacerts -storepass changeit -noprompt
(change only path to your ca.crt & alias. save "changeit" - it's important)

there is no need to install the ca-certificates package & run update-ca-certificates. java doesn't use it.

[vsfomin]

@vsfomin try this way: keytool -import -trustcacerts -alias mycompany-root-ca -file /certs/ca.crt -keystore /usr/lib/jvm/zulu21-ca/lib/security/cacerts -storepass changeit -noprompt (change only path to your ca.crt & alias. save "changeit" - it's important)

there is no need to install the ca-certificates package & run update-ca-certificates. java doesn't use it.

Yes, it's works! Thanks a lot! The problem has solved!