Project

General

Profile

Forums » Open discussion »

LDAPS certificate issue with Google Workspace LDAP

Added by Tolga Uzun 9 days ago

I’m trying to use LDAP authentication with Google Workspace’s LDAP but haven’t been able to make it work.

Google provides .crt and .key files, which I copied to my Redmine instance and ran update-ca-certificates, successfully adding the certificates.

When I test LDAPS, it shows state=error: certificate verify failed (self-signed certificate). I tried disabling certificate verification, which changes the test state to successful, but I still can’t log in.

Does anyone know the proper configuration for setting up LDAP with Google Workspace? I might be misconfiguring the Base DN or the filter.

Any help would be appreciated!


Replies (3)

RE: LDAPS certificate issue with Google Workspace LDAP - Added by Lionel BAKALA 2 days ago

Hi Tolga,

To assist in troubleshooting your issue, I have a question: Can you query your Google Workspace LDAP directory from your Redmine instance using command like ?

ldapsearch -H ldaps://ldap.google.com -D "uid=admin,ou=users,dc=example,dc=com" -W -b "dc=example,dc=com"

This will help verify that LDAPS connectivity and authentication are functioning correctly from the Redmine host, and whether any certificates are required for the connection.

RE: LDAPS certificate issue with Google Workspace LDAP - Added by Tolga Uzun about 23 hours ago

Hi Lionel,

Thanks for your interest for this issue.

ldapsearch itself does not work but I have to add LDAPTLS_CACERT, LDAPTLS_CERT and LDAPTLS_KEY addresses to the command. I can see the users and groups with that command.

Btw, I already gave up, when I heard the TFA of Google is not supported with this LDAP method and going to an OAUTH path. Thanks anyway

RE: LDAPS certificate issue with Google Workspace LDAP - Added by Lionel BAKALA about 11 hours ago

Hello Tolga,

OAuth is more efficient, and you still have the option to use Google Workspace LDAP as a user source.

I recently worked on a Redmine authentication setup using Authelia (an identity provider), which introduces two-factor authentication (TFA).

Best regards,

    (1-3/3)