Awx: Provide custom CA certificate or skip-verify option for LDAP auth

[ewerk-pnahratow]

ISSUE TYPE

• Feature Idea

COMPONENT NAME

• Installer

SUMMARY

I cannot use SSL encrypted LDAP authentication because I see no way to provide my CA certificate to the containers or have an option in the installer to disable certificate verification.

When logging in a certificate verification error comes up.

It would be awesome to have a additional_ca_certificate or skip_verify_ssl variable in the insaller inventory.

ENVIRONMENT

• AWX version: d02221702fd680cd38068ec49597a7b627228c04
• AWX install method: docker on linux
• Ansible version: 2.3.2.0
• Operating System: Centos 7 (epel)
• Web Browser: Firefox

STEPS TO REPRODUCE

• Configure ansible-awx to use SSL encrypted ldap auth
• Login

EXPECTED RESULTS

Successful login

ACTUAL RESULTS

2017-10-12 10:06:12,414 DEBUG    django_auth_ldap Initiating TLS
2017-10-12 10:06:12,426 WARNING  django_auth_ldap Caught LDAPError while authenticating username: CONNECT_ERROR({'info': "TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user.", 'desc': 'Connect error'},)

[matburt]

It looks like we could expose this through the configuration interface or you could modify the settings file to change certificate checking: https://github.com/ansible/awx/blob/devel/awx/sso/backends.py#L89

We probably just need to do that.

[alancivita]

i had a similar issue, don't know if this can help:
i copied my RootCa.pem to the host that hosts the containers.
then
docker cp RootCa.pem 34ad2609f00f:/RootCa.pem
docker exec -it 34ad2609f00f /bin/bash
cp /RootCa.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust extract

cheers

[alexander-bauer]

This is related to the issue I opened earlier today, #442.

My solution was to bind-mount the CA trust from the host into the awx_web container. This means that the container trust matches the host's. On CentOS 7, this is mounting /etc/pki/ca-trust to the same path on the container.

[savealive]

I'm just passing following env var to awxweb container:
env: LDAPTLS_REQCERT: "never"

[Evertvz]

Hello,
Just to let you know that I'm installing version 1.0.6 and can see the option to bind-mount a certain directory through the installer named ca_trust_dir. Unfortunately though this does not seem to work and the container is launched without the mount.
I tried checking with some debug tasks, which turned out ok so it must be either a syntax issue or my ignorance.

[Numblesix]

Im also unable to mount ca_trust_dir even though i specified it in the inventory

[Decstasy]

Im also unable to mount ca_trust_dir even though i specified it in the inventory

I fixed it by myself but the pull request is still open... Look here: https://github.com/ansible/awx/pull/2156/commits/a294a6f06e85c630074ea337b2b9f6c4098a00fb

[Baefisch]

i tried this:

docker cp RootCa.pem 34ad2609f00f:/RootCa.pem
docker exec -it 34ad2609f00f /bin/bash
cp /RootCa.pem /etc/pki/ca-trust/source/anchors/
update-ca-trust extract`

but i am unable to login:
got this error message:
2019-02-06 07:37:02,403 WARNING django_auth_ldap Caught LDAPError while authenticating UserX: CONNECT_ERROR({'desc': 'Connect error', 'info': 'error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed (unable to get local issuer certificate)'},)

unsecure ldap is working.

i am also able to curl other ssl trusted sides in our network inside the container.

[root@awxweb source]# curl https://xxxxxxxxxxx.com

...........................

where is my mistake?

[Baefisch]

restarting the web container solved the problem.

[stefjakobs]

AWX has an option _ca_trust_dir_ which injects a directory as pki trust anchor. Unfortunately this doesn't help for ldap, as the openldap version used in AWX is buggy see: https://bugzilla.redhat.com/show_bug.cgi?id=1270678

The following patch helped to disable the certificate check:

--- a/installer/roles/local_docker/templates/docker-compose.yml.j2
+++ b/installer/roles/local_docker/templates/docker-compose.yml.j2
@@ -45,6 +45,7 @@ services:
     dns: "{{ awx_alternate_dns_servers }}"
     {% endif %}
     environment:
+      LDAPTLS_REQCERT: "never"
       http_proxy: {{ http_proxy | default('') }}
       https_proxy: {{ https_proxy | default('') }}
       no_proxy: {{ no_proxy | default('') }}

Tested with
AWX version: 4.0.0
AWX install method: docker on linux

[otdouglasm]

Another option is to add a config file with the specific options you want, e.g.:

[root@tower ~]# cat /etc/tower/conf.d/ldap.py
AUTH_LDAP_GLOBAL_OPTIONS = {
    ldap.OPT_X_TLS_REQUIRE_CERT: ldap.OPT_X_TLS_ALLOW
}

This solved the cert verification error on a RH Tower 3.4 instance. Set ownership and permissions the same as other files in the same directory (root:awx, 640).