Use LDAP to Authenticate Access to LogicHub

lhub.ldap.providerUrl = "ldaps://ldap.dev.logichub.com:636" 
lhub.ldap.principalQuery = "uid=%CN%,ou=People,dc=logichub,dc=com"
lhub.ldap.trustAllCerts = true (optional if the client has the correct cert) 
lhub.ldap.groupSyncMode = "off"  # Valid sync mode options = "off", "on", "dryrun"
lhub.ldap.adminGroupQueryBaseDN = "ou=Admins,dc=logichub,dc=local"
lhub.ldap.adminGroupQueryBindDN = "cn=ldapadm,dc=logichub,dc=local"
lhub.ldap.adminGroupQueryBindPassword = "*****PASSWORD*****"
lhub.ldap.userGroupQueryBaseDN = "ou=Users,dc=logichub,dc=local"
lhub.ldap.userGroupQueryBindDN = "cn=ldapadm,dc=logichub,dc=local"
lhub.ldap.userGroupQueryBindPassword = "*****PASSWORD*****"

scp ldapcertificate.pem <username>@test.dev.example.com:```

2. Copy the .pem file into the Docker Service container
```docker cp ldapcertificate.pem service:/opt/docker```

3. Run the following command from /opt/logichub/data/service/.

```keytool -import -alias ldap -file ldapcertificate.pem -keystore logichub_dev```



### Verify the Certificate

[block:callout]
{
  "type": "info",
  "title": "Getting the ldapsearch tool",
  "body": "yum install openldap-clients"
}
[/block]

To verify that the certificate is good, use the [ldapsearch command](https://linux.die.net/man/1/ldapsearch). The following is an example that you can adapt for your environment. 

```env LDAPTLS_CACERT=path-to-ldap-cert.pem ldapsearch -H ldaps://localhost:636 -D cn=ldapadmin,dc=logichub,dc=com -b "ou=Users,dc=example,dc=com" -s sub "objectclass=*"```

If there are issues with this command, try adding the flags ```-ZZ`` and ```-d 1``` to get more details.

This process requires the entire trust chain. If you don’t have access to the entire trust chain, you need to establish the trust in some other way (such as the signer's certificate and intermediate certificates to the right location).

If you only have the server certificate you can obtain the whole trust chain by using this command:
```openssl s_client -showcerts -connect your_ldap.your_company.com:1636  >> cert_output.txt```

You can then edit the cert_output.txt file to remove everything other than the blocks bounded by:

```BEGIN CERTIFICATE``` 
```END CERTIFICATE```
 
The remaining content can be used as the .pem file for certificates.

You can also bypass certificate verification in ldapsearch by using this command:

```env LDAPTLS_REQCERT=never ldapsearch -H ldaps://localhost:636 -D cn=ldapadmin,dc=logichub,dc=com -b "ou=Users,dc=logichub,dc=com" -s sub "objectclass=*" ```



### For administrator access to your LDAP server, obtain the correct DN to bind to the LDAP server.

On Windows systems, use the following process to obtain the correct base DN for administrator access to the LDAP server.

1. Select **My Computer** > **Network**.
2. Search Active Directory (button near the top of the window)
3. Select **View** >  **Choose Columns.**
4. Highlight **Distinguished Name** and click **Add**.
5. Search for a known user.  
6. Expand ‘Distinguished Name’ to reveal the full Base DN.

On Linux systems, use the ```ldapsearch``` command to obtain the base BN. 



### Obtain the correct DN for user authentication requests to the LDAP server

Follow the same process as in the previous section to obtain the correct DN for user access.  



### Construct the Principal Query for the User Using the DN

The principal query for user access to the LDAP server is of this form:
```lhub.ldap.principalQuery = "uid=%CN%,ou=People,dc=logichub,dc=com"```



### Verify that the User Access Works

After using the principal query, verify that a known LDAP user can log in to LogicHub with LDAP credentials.