Problem: connect to LDAP/LDAPS from Docker

[akupreev]

Issue

Colleagues, good afternoon.
I encountered a problem enabling LDAP/LDAPS authorization in semaphore.
Semaphore is deployed in docker-container using docker-compose, when deployed, the config.json configuration is not pulled from the compose.yml file, namely, the configuration from the SEMAPHORE_LDAP_MAPPING_* values ​​is not pulled up.
Configuration example:

SEMAPHORE_LDAP_ACTIVATED: "yes"
SEMAPHORE_LDAP_HOST: "example.com"
SEMAPHORE_LDAP_PORT: "636"
SEMAPHORE_LDAP_DN_BIND: "cn=test,ou=service,ou=Accounts,ou=Organization,dc=example,dc=com"
SEMAPHORE_LDAP_PASSWORD: "secret-password"
SEMAPHORE_LDAP_DN_SEARCH: "dc=example,dc=com"
SEMAPHORE_LDAP_NEEDTLS: "yes"
SEMAPHORE_LDAP_SEARCH_FILTER: "(&(sAMAccountName=%s)(memberOf=ou=Users,ou=Organization,dc=example,dc=com))"
SEMAPHORE_LDAP_MAPPING_DN: "dn"
SEMAPHORE_LDAP_MAPPING_MAIL: "{{userPrincipalName}}@example.com"
SEMAPHORE_LDAP_MAPPING_UID: "sAMAccountName"
SEMAPHORE_LDAP_MAPPING_CN: "cn"

Tell me please where I made a mistake?

Impact

Docker

Installation method

Docker

Database

Postgres

Browser

Chrome

Semaphore Version

2.9.112

Ansible Version

No response

Logs & errors

No response

Manual installation - system information

No response

Configuration

No response

Additional information

No response

[fiftin]

We have examples how to config LDAP:

https://github.com/semaphoreui/semaphore/tree/develop/examples/openldap

[akupreev]

Good afternoon.
Do I understand correctly that the variables below are not required?

SEMAPHORE_LDAP_MAPPING_DN: "dn"
SEMAPHORE_LDAP_MAPPING_MAIL: "{{userPrincipalName}}@example.com"
SEMAPHORE_LDAP_MAPPING_UID: "sAMAccountName"
SEMAPHORE_LDAP_MAPPING_CN: "cn"

Also, please clarify, do I understand correctly that semaphore only works with OpenLdap, and connecting to Microsoft Active Directory is impossible?

[tboerger]

Active directory should also work, but it's simply not tested automatically. AFAIK there are people in the community using it with an AD.

[MadsMMP]

Did you find a solution? Currently have similar problem. I do not get any logs to why LDAP isnt working.

Also using Docker Compose

[akupreev]

@MadsMMP Hello my friend. At the moment, I have not found a suitable solution to make the LDAP Semaphore with AD connection work.

[MadsMMP]

I have found a solution!

The docker-compse.yml configuration doesn't match the original config.json which it meant to be used.

Therfore u need to create a config.json and make it use that instead of the arguments in the compose file.

Please tell me if you need more depth explanation

[vtpham]

solution

Hi MadsMMP
could you provide a more detailed solution on how to fix it. - many Thx

[00shorty]

Hi all,

we do have the same problem here as well with LDAP.
Using docker with local users is working fine but when we enable LDAP support nothing is working the container won't come up

 SEMAPHORE_LDAP_ACTIVATED: "yes"
SEMAPHORE_LDAP_HOST: "domaincontroller.secure.local"
 SEMAPHORE_LDAP_PORT: "636"
 SEMAPHORE_LDAP_DN_BIND: "CN=Technical User 0040,OU=Service Accounts,DC=secure,DC=local"
 SEMAPHORE_LDAP_PASSWORD: "Super$ecurePa$$word"
 SEMAPHORE_LDAP_DN_SEARCH: "dc=secure,dc=local"
 SEMAPHORE_LDAP_NEEDTLS: "yes"
 SEMAPHORE_LDAP_SEARCH_FILTER: "(&(sAMAccountName=%s)(memberOf=CN=Semaphore_admin,OU=Permissions,DC=secure,DC=local))"
 SEMAPHORE_LDAP_MAPPING_DN: "dn"
 SEMAPHORE_LDAP_MAPPING_MAIL: "sAMAccountName"
 SEMAPHORE_LDAP_MAPPING_UID: "sAMAccountName"
 SEMAPHORE_LDAP_MAPPING_CN: "cn"

Error Message

 semaphore-1  | 
 semaphore-1  | Hello! You will now be guided through a setup to:
 semaphore-1  | 
 semaphore-1  | 1. Set up configuration for a MySQL/MariaDB database
 semaphore-1  | 2. Set up a path for your playbooks (auto-created)
 semaphore-1  | 3. Run database Migrations
 semaphore-1  | 4. Set up initial semaphore user & password
 semaphore-1  | 
 semaphore-1  | What database to use:
 semaphore-1  |    1 - MySQL
 semaphore-1  |    2 - BoltDB
 semaphore-1  |    3 - PostgreSQL
 semaphore-1  |  (default 1): 
 semaphore-1  | db Hostname (default 127.0.0.1:3306): 
 semaphore-1  | db User (default root): 
 semaphore-1  | db Password: 
 semaphore-1  | time="2024-11-27T10:51:52+01:00" level=warning msg="An input error occurred: expected newline"
 semaphore-1  | time="2024-11-27T10:51:52+01:00" level=warning msg="An input error occurred: expected newline"
 semaphore-1  | time="2024-11-27T10:51:52+01:00" level=warning msg="An input error occurred: expected newline"
 semaphore-1  | db Name (default semaphore): 
 semaphore-1  | Playbook path (default /tmp/semaphore): 
 semaphore-1  | Public URL (optional, example: https://example.com/semaphore): 
 semaphore-1  | Enable email alerts? (yes/no) (default no): 
 semaphore-1  | Enable telegram alerts? (yes/no) (default no): 
 semaphore-1  | Enable slack alerts? (yes/no) (default no): 
 semaphore-1  | Enable Rocket.Chat alerts? (yes/no) (default no): 
 semaphore-1  | Enable Microsoft Team Channel alerts? (yes/no) (default no): 
 semaphore-1  | Enable LDAP authentication? (yes/no) (default no): 
 semaphore-1  | LDAP server host (default localhost:389): 
 semaphore-1  | Enable LDAP TLS connection (yes/no) (default no): 
 semaphore-1  | LDAP DN for bind (default cn=user,ou=users,dc=example): 
 semaphore-1  | Password for LDAP bind user (default pa55w0rd): 
 semaphore-1  | LDAP DN for user search (default ou=users,dc=example): 
 semaphore-1  | LDAP search filter (default (uid=%s)): 
 semaphore-1  | LDAP mapping for DN field (default dn): 
 semaphore-1  | LDAP mapping for username field (default uid): 
 semaphore-1  | LDAP mapping for full name field (default cn): 
 semaphore-1  | LDAP mapping for email field (default mail): 
 semaphore-1  | Config output directory (default /home/semaphore): 
 semaphore-1  | Running: mkdir -p uid..
 semaphore-1  | Configuration written to uid/config.json..
 semaphore-1  | Loading config
 semaphore-1  | Validating config
 semaphore-1  |  Pinging db..
 semaphore-1  | Running db Migrations..
 semaphore-1  | 
 semaphore-1  | 
 semaphore-1  |  > Username:  > Email: 
 semaphore-1  |  Welcome back, /etc/semaphore! (a user with this username/email is already set up..)
 semaphore-1  | 
 semaphore-1  |  Re-launch this program pointing to the configuration file
 semaphore-1  | 
 semaphore-1  | ./semaphore server --config uid/config.json
 semaphore-1  | 
 semaphore-1  |  To run as daemon:
 semaphore-1  | 
 semaphore-1  | nohup ./semaphore server --config uid/config.json &
 semaphore-1  | 
 semaphore-1  |  You can login with mail or cn.
 semaphore-1  | No additional python dependencies to install
 semaphore-1  | Starting semaphore server
 semaphore-1  | Loading config
 semaphore-1  | Cannot Find configuration! Use --config parameter to point to a JSON file generated by `semaphore setup`.
 semaphore-1  | 
 semaphore-1  | 
 semaphore-1  |  > Username:  > Email: 
 semaphore-1  |  Welcome back, /etc/semaphore! (a user with this username/email is already set up..)
 semaphore-1  | 
 semaphore-1  |  Re-launch this program pointing to the configuration file
 semaphore-1  | 

00Shorty

[00shorty]

I resolved it by using the following configurator: https://semaphoreui.com/install/docker/2_10_42/