Using LDAP under Linux

DigaSystem allows to work with user credentials that are synced from Active Directory.
No additional configuration is needed when running Nano under a Windows operating system.
If you want to use this feature under Linux you have to specify how to talk to the LDAP server

Prerequisites for LDAP under Linux

Make sure the library libldap-2.5-0 is installed. If not install it using e.g.

apt-get update
apt-get install libldap-2.5-0 -y

Older Nano docker images and docker compose

If your are running older Nano docker images you can adapt your docker compose file to install the library automatically.

Nano images starting with v1.2.22 have the library already installed.

...
    entrypoint: [""]
    command: 
      - /bin/bash
      - -c
      - | 
        apt-get update ;
        apt-get install libldap-2.5.0 -y ;
        dotnet DpeNanoServices.dll     
---

Configuration for LDAP under Linux

Configure LDAP using one of the following methods:

appSettings.json

"Ldap": {
    "Address": "<fully-qualified-ldap-server-name>",
    "Port": 389, // use 636 for secure
    "Security": "none" // none, ssl
}

Environment variables

Ldap__Address: "<fully-qualified-ldap-server-name>"
Ldap__Port: 389, // use 636 for secure
Ldap__Security: "none" // none, ssl

AD / LDAP Server Certificate for SSL

When using SSL, make sure the AD/LDAP server certificate is known on the linux machine running DpeNanoServices, e.g.

Export the CA certificate as PEM. Easiest source: any domain-joined Windows machine, via certutil or certmgr.msc → Trusted Root CAs → export as Base-64 X.509 (.cer/.pem). Ask your AD/PKI admin if you don't have access.
Change the extension from .cer to .pem
Copy it to the Linux host, e.g. to /etc/ssl/certs/my-ad-cert.pem.

Point OpenLDAP at it:

export LDAPTLS_CACERT=/etc/ssl/certs/my-ad-cert.pem

Alternatively (only for testing) you can allow to continue without certificate validation by setting:

export LDAPTLS_REQCERT=allow