LDAP users cannot login to harbor site, TLS confidentiality required about harbor HOT 2 CLOSED

Just to add to this, usually when you query an LDAP server that uses STARTTLS, you need to use the "-Z" parameter. STARTTLS does not require ldaps. So, I'm wondering if harbor is not building the request with "-Z"?

from harbor.

Ok, I've worked through this issue. Currently Harbor does not support using STARTTLS - it does not make the api call when initializing the connection to the ldap server. Someone could possibly add this functionality, if they were so inclined, by issuing a StartTLS extended operation call in "src/pkg/ldap/ldap.go". This should happen after the initial bind, but before accessing the database. I believe the relevant commands are akin to

from ldap3 import Server, Connection, Tls
...

tls_configuration = Tls(validate=ssl.CERT_REQUIRED, version=ssl.PROTOCOL_TLSv1_2)
conn.start_tls(tls_configuration)

In my case, it was easier just to update my linux ldap server. I use openldap, so for me this was simply adding the LDAPS service to a config and restarting the slapd service:

Edit /etc/default/slapd by adding ldaps:/// in the list of SLAPD_SERVICES

SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"

Restart slapd

sudo systemctl restart slapd

Test the connection with

ldapwhoami -x -H ldaps://<server_address>

The command above should return "anonymous".

from harbor.