auth: ldap Where/what Cert with ldaps to an AD

[simpsonetti]

Hi,
i want to auth my users against an Active Directory. So for this i setup the auth : ldap part and add as url ldaps://IP:636 . But this didn't work.
So i start with --debug ldap and i get this here:
LDAP: LDAP Error: Error: unable to get local issuer certificate
LDAP: LDAP OnError: Error: unable to get local issuer certificate
LDAP: LDAP OnError: Error: unable to get local issuer certificate

So is there an option where i can configure that and which cert did MesC expect here?

[si458]

you are trying to connect to your AD over secure, try using ldap://IP:389
i cant remember if mesh supports ldaps or not? just looking into config now

[simpsonetti]

here is my domainpart config with the ldap:
I'm just starting this server as a productive version and i'm just configuring the config.json. So until now, there are not all options configured i need. Step by step...

{
    "auth": "ldap",
    "ldapOptions": {
        "url": "ldaps://172.16.20.1:636/",
        "tlsOptions": {
            "rejectUnauthorized": false
        },
        "bindDN": "CN=sk-meshcentral-ad,OU=MeshCentral,OU=Servicekonten,OU=BS,OU=infra,DC=domain,DC=com",
        "bindCredentials": "securepass",
        "searchBase": "DC=domain,DC=com",
        "searchFilter": "(name={{cn}})"
    },
    "ldapUserKey": "cn",
    "_ldapUserBinaryKey": "objectSid",
    "ldapUserName": "{{{givenName}}} {{{name}}}",
    "ldapUserEmail": "mail",
    "ldapUserRealName": "{{{givenName}}} {{{name}}}",
    "ldapUserPhoneNumber": "telephoneNumber",
    "ldapUserImage": "thumbnailPhoto",
    "ldapSaveUserToFile": "../meshcentral-data/ldapusers.txt",
    "meshQuota": 100000000,
    "userQuota": 1000000
}

[simpsonetti]

Hi @si458 , do you check MC against a regular Active Directory oder only openLDAP?

[si458]

i dont use ldap anymore, but the config above was just my testing config was i was looking into a ldap bug, but i setup and used openldap and not AD

[simpsonetti]

so, after hours of investigation:
to ask our AD i need to setup CAcert. That's my cause here. "Regular" ldapsearch" doesn't work too. So i give him the "LDAPTLS_CACERT" env and than my ldapsearch works.

So for meshcentral, there has to be an option, so specify my CACERT. But it seems, there isn't anything for this?
@si458 : i edit my config.json via VS Code, so the autocompletion is working with the "$schema" and therefor is no option!?
Could you check this?

[si458]

sadly the is no option for certificates for LDAP after quickly checking the code,
all you can set is ldapOptions: { } and inside that, you put extra options to pass to ldapauth-fork
so the best thing i can suggest is to ask in the module repo and see if they can say HOW you should add a certificate in to do authentication with CA certificates.
once you have it working there normally in nodejs, then we can add it into meshcentral