Supervisor: curl missing LDAP protocol

[olbjan]

Home Assistant release with the issue:
0.88 and 0.89

Operating environment (HassOS/Generic):
HassOS 2.10 on Intel NUC

Supervisor logs:

Description of problem:
Trying to use the commandline auth provider against an LDAP server is currently not possible in Hass.io / HassOS installations as the provided curl does not support the LDAP protocol or ldapsearch.

This is required by the linked example script as linked in the HA documentation:
https://www.home-assistant.io/docs/authentication/providers/ -->
https://github.com/efficiosoft/ldap-auth-sh

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[olbjan]

I checked that on hass.io Supervisor 162 and hassOS 2.11 curl still does not include LDAP support.

[frenck]

Our containers for Hass.io are based on Alpine Linux.

Alpine Linux does not ship CURL with LDAP support.
See also here: https://git.alpinelinux.org/aports/tree/main/curl/APKBUILD#n94

This isn't "fixable" from our end.

[nununo]

Hi @olbjan did you manage to integrate LDAP with Hassio? I've bumped into the same problem. I'm considering reinstalling Hassio on top of Debian to avoid these limitations but I'd like to avoid going through that trouble if I could. Did you find a workaround? Thanks

[olbjan]

@nununo Sorry, I've basically given up on this for the time being. LDAP auth is nice but not as important for me that I'm willing to roll my own OS below HA....

[nununo]

@olbjan makes sense. I already had in mind trying to install HA over Debian so I may still give it a try if I get to do it.

[Mystery-X]

I'm also trying,
But since the curl is no option, i'm currently investigating the ldapsearch route.
installing the ldapsearch was easy :

`core-ssh:~# apk add openldap-clients

fetch http://dl-cdn.alpinelinux.org/alpine/v3.10/main/armv7/APKINDEX.tar.gz

fetch http://dl-cdn.alpinelinux.org/alpine/v3.10/community/armv7/APKINDEX.tar.gz

(1/4) Installing db (5.3.28-r1)

(2/4) Installing libsasl (2.1.27-r3)

(3/4) Installing libldap (2.4.48-r0)

(4/4) Installing openldap-clients (2.4.48-r0)

Executing busybox-1.30.1-r2.trigger
OK: 76 MiB in 67 packages`

[pvizeli]

curl work, we need only build our own version on the image

[nununo]

I finally managed to integrate LDAP with Hassio.
I had to perform some extra hacks to make it work:

• I followed this this tip to install ldapsearch inside the Hassio image (although I had to tweak the command to docker exec -t -i homeassistant apk add --update --repository http://dl-cdn.alpinelinux.org/alpine/edge/main --repository http://dl-cdn.alpinelinux.org/alpine/edge/community openldap-clients);
• Since my LDAP server uses STARTTLS, I had to copy the LDAP server's certificate to the config/ldap-auth-sh/ folder and configure /etc/openldap/ldap.conf to point to it;
• Edited the script to include the option -ZZ in the common_opts.

Most probably an upgrade will break something. I'll wait and see. Anyway, it's working ;)

[nununo]

It would be great, though, if LDAP integration would be easier to implement in Hassio...

[darootler]

I would also love to have LDAP authentication supported by Hass.io.

Regards
Richard

[mountainsandcode]

The suggestion posted by @nununo also works for me - but I fear it'll have to be run upon every pull of a docker image (i.e., every HA version update). Any chance we can package openldap-clients with the image while waiting for a compiled version of curl with ldap? Would be super!

[nununo]

Indeed @mountainsandcode, mine is already broken and I've been lazy to retweak it :-) Native LDAP support would be so great.

[mountainsandcode]

@pvizeli Would love to support somehow (e.g., with a PR) but not familiar at all with OS-level development. Any pointers or can we support somehow to get this implemented?

[pvizeli]

curl work, we need only build our own version on the image

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[darootler]

Hmm, still no ldap support for curl or am i missing something?

Regards
Richard

[Larx]

I'm interested, too.
(Should be mentioned in the docs, too. The way to get LDAP support as described in the docs does not work with the officially preferred way of installation ;-/ .)

[adamoutler]

The big problem here is the linked LDAP Auth script is all wrong for ldapsearch. Their BASEDN is used for BINDDN, and HOST isn't used at all. I'm sure it would work if you already had LDAP Auth set up on your system, but as-is, it's all messed up and unusable. I'm willing to bet the number of people using HASSIO ldap auth with the script is near-zero, and includes those who figured out how to install curl.

[Larx]

Anybody found a workaround yet?

[adamoutler]

Yeah. Let me organize my notes... It was frackin' rediculous what I had
to do.

On Mon, Sep 21, 2020, 2:39 PM Larx [e-mail] wrote:

Anybody found a workaround yet?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/home-assistant/supervisor/issues/940#issuecomment-696296540,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAEA4L3SAT43ALXGXNAJQF3SG6MVXANCNFSM4G4TTLXQ
.

[adamoutler]

Anybody found a workaround yet?

I created a topic here for hassio. It uses ssh to log into a remote computer with ldapsearch installed. It's messy but it works. https://community.home-assistant.io/t/hassos-ldap-command-line-authentication-over-ssh/228852

[rjmidau]

Anybody found a workaround yet?

There is currently an open PR to add LDAP as an authentication provider to Core: home-assistant/core#37645