VatsaA.57811 (Employee) asked a question.
Hello,
I am trying to set up FreeRADIUS server and integrate with Okta's LDAP interface. However, I'm getting this error on the FreeRADIUS console:
"rlm_ldap (ldap): Connecting to ldaps://demo-arsenal.ldap.okta.com:636
rlm_ldap (ldap): Bind with uid=00unp8nqbr8M3b6N7697,ou=users, dc=demo-arsenal, dc=okta, dc=com to ldaps://demo-arsenal.ldap.okta.com:636 failed: Can't contact LDAP server
rlm_ldap (ldap): Opening connection failed (0)
rlm_ldap (ldap): Removing connection pool
/etc/freeradius/3.0/mods-enabled/ldap[1]: Instantiation failed for module "ldap""
On the Okta console I'm getting this error:
Can anyone help me with setting up the LDAP config file:
This is my current config:
ldap {
server = "ldaps://demo-***.ldap.okta.com"
identity = "uid=***8M3b6N7697,ou=users, dc=demo-***, dc=okta, dc=com"
password = "****"
base_dn = "dc=demo-arsenal, dc=okta, dc=com"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
tls = yes
ldap_connections_number = 10
start_tls = no
tls_ca_file = /etc/ssl/certs/okta_ldap_server.crt
Hello @VatsaA.57811 (Employee) , thank you for contacting Okta Community.
I've brought your question to the attention of our colleagues. It seems you are encountering a limitation: LDAPi requires TLS 1.2 to establish a connection. You can read more about it here:
LDAP Interface known limitations
You should try contacting Free Radius Support to assist you with configuring the LDAP browser's configuration file.
While we'll do our best to answer your questions here, this medium is more inclined towards Okta's core products and features.
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Hi Diana, thanks for responding on this query. I will for sure reach out to FreeRADIUS on this. However, just needed to understand if the LDAP config file format is correct as per the Okta docs:
ldap {
server = "ldaps://demo-***.ldap.okta.com"
identity = "uid=***8M3b6N7697,ou=users, dc=demo-***, dc=okta, dc=com"
password = "****"
base_dn = "dc=demo-arsenal, dc=okta, dc=com"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
tls = yes
ldap_connections_number = 10
start_tls = no
tls_ca_file = /etc/ssl/certs/okta_ldap_server.crt
---Appreciate your help---