Support Active Directory of TLS/SSl

[brymon68]

Problem to Solve

passport-ldapauth allows for ldap access over TLS:
https://www.npmjs.com/package/passport-ldapauth#active-directory-over-ssl-example

Our ldap provider uses TLS. Our OpenCTI instance is configured to connect to our LDAP but seems to hang when clicking on 'Sign In' on the login page. Without proper debugging, I am taking a huge guess that this is due to the fact that we are not providing our cert.

Current Workaround

No workaround other than using local auth.

Proposed Solution

Support a method to pass via environment variable (Docker) for a path to the cert and then mount the cert via data volume.

Additional Information

We are using OpenCTI's docker installation.
Here is an example of a similar docker-compose.yml with envioronment variables we are using:

-PROVIDERS__LDAP_STRATEGY=LdapStrategy
-PROVIDERS__LDAP_CONFIG_URL=ldap://sec-ldap.mycompany.com
-PROVIDERS__LDAP_BIND_CREDENTIALS=password
-PROVIDERS__LDAP_SEARCH_BASE=ou=co,dc=company,dc=com,dc=com
-PROVIDERS__LDAP_SEARCH_FILTER=(uid={{username}})
-PROVIDERS__LDAP_EMAIL_ATTRIBUTE=uid
-PROVIDERS__LDAP_ACCOUNT_ATTRIBUTE=uid

{ Any additional information, including logs or screenshots if you have any. }

[richard-julien]

Hi @brymon68, can you provide a test environment for that? Let continue the discussion on Slack. Thanks.

[SamuelHassine]

Hi @brymon68 LDAPS is now fully operational on OpenCTI, you can connect to your LDAP/AD over TLS.

[CRAI-Ruzila]

@SamuelHassine Where is the documentation to implement LDAP/AD in OpenCTI? I can't find anything. I'm assuming just add the following based on what I've been able to find.

• PROVIDERS__LDAP__STRATEGY=LdapStrategy
• PROVIDERS__LDAP__CONFIG__URL=ldap://dc01:389
• PROVIDERS__LDAP__CONFIG__BIND_DN=CN=Opencti,OU=Administration,DC=abc,DC=com
• PROVIDERS__LDAP__CONFIG__BIND_CREDENTIALS=XXXXX
• PROVIDERS__LDAP__CONFIG__SEARCH_BASE=OU=User Account,DC=abc,DC=com
• PROVIDERS__LDAP__CONFIG__SEARCH_FILTER=(SAMAccountName={{username}})"
• PROVIDERS__LDAP__CONFIG__MAIL_ATTRIBUTE=mail
• PROVIDERS__LDAP__CONFIG__ALLOW_SELF_SIGNED=true
• PROVIDERS__LOCAL__STRATEGY=LocalStrategy

[SamuelHassine]

@CRAI-Ruzila:

https://luatix.notion.site/Configuration-a568604c46d84f39a8beae141505572a#085c93182b244ec4afdc5dd0266795cc.

Kind regards,
Samuel