# Ldap & AD SSL config and truststore

**URL:** <https://forum.opensearch.org/t/ldap-ad-ssl-config-and-truststore/4641>\
**Category:** Security\
**Created:** [January 20, 2021, 9:50am UTC](https://forum.opensearch.org/t/ldap-ad-ssl-config-and-truststore/4641 "2021-01-20T09:50:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darrell](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Darrell](https://forum.opensearch.org/u/Darrell)\
**Post date:** [January 20, 2021, 9:50am UTC](https://forum.opensearch.org/t/ldap-ad-ssl-config-and-truststore/4641/1 "2021-01-20T09:50:18Z")

</div>

Hi,  
I have OD setup on kubernetes using:

- Open Distro Security Admin v7
- opendistro-for-elasticsearch:1.12.0
- opendistro-for-elasticsearch-kibana:1.12.0

The structure is as follows:  
1x opendistro-es-client pod  
1x opendistro-es-kibana pod  
3x opendistro-es-data pods  
3x opendistro-es-master pods

OD is up and running and I can log in with admin and my mounted configmap after running securityadmin.sh. I am trying to get LDAP working using SSL to connect to my MS AD server and I get complaints about wanting to use ‘opendistro\_security.ssl.transport.truststore\_filepath’

I have attempted to create a truststore but it then breaks the local user login. My questions are as follows:

1. Which service do you configure the ldap config on (client, kibana data nodes or master nodes or all). I only want kibana to auth against ldap for login and not mess up inter node certs/pem
2. Do you need authc and authz
3. Must you use a truststore to auth against AD

The errors I am seeing in the logs are as follows:  
Unable to connect to ldapserver [ldap.example.com:636](http://ldap.example.com:636) due to ElasticsearchException[Empty file path for opendistro\_security.ssl.transport.truststore\_filepath]. Try next.  
Authentication finally failed for [user@example.com](mailto:user@example.com) from 10.40.xx.yy:55158

Here are my config files:  
config.yml: (currently on opendistro-es-client pod)

> config:  
> dynamic:  
> authc:  
> basic\_internal\_auth\_domain:  
> http\_enabled: true  
> transport\_enabled: false  
> order: 2  
> http\_authenticator:  
> type: basic  
> challenge: true  
> authentication\_backend:  
> type: internal  
> ldap:  
> description: “Authenticate via LDAP or Active Directory”  
> http\_enabled: true  
> transport\_enabled: true  
> order: 1  
> http\_authenticator:  
> type: basic  
> challenge: true  
> authentication\_backend:  
> type: ldap  
> config:  
> enable\_ssl: true  
> enable\_start\_tls: false  
> enable\_ssl\_client\_auth: false  
> verify\_hostnames: true  
> hosts:  
> - [ldap.example.com:636](http://ldap.example.com:636)  
> bind\_dn: “CN=s\_ldap\_auth\_opendist,OU=Generic,OU=ServiceAccounts,OU=Users,OU=Anzo,DC=corp,DC=example,DC=com”  
> password: “mypassword”  
> userbase: ‘OU=Anzo,DC=corp,DC=example,DC=com’  
> usersearch: ‘(sAMAccountName={0})’  
> username\_attribute: sAMAccountName

elasticsearch.yml:

> cluster.name: “elasticsearch”  
> network.host: 0.0.0.0  
> opendistro\_security.ssl.transport.pemcert\_filepath: esnode.pem  
> opendistro\_security.ssl.transport.pemkey\_filepath: esnode-key.pem  
> opendistro\_security.ssl.transport.pemtrustedcas\_filepath: root-ca.pem  
> opendistro\_security.ssl.transport.enforce\_hostname\_verification: false  
> opendistro\_security.ssl.http.enabled: true  
> opendistro\_security.ssl.http.pemcert\_filepath: esnode.pem  
> opendistro\_security.ssl.http.pemkey\_filepath: esnode-key.pem  
> opendistro\_security.ssl.http.pemtrustedcas\_filepath: root-ca.pem  
> opendistro\_security.allow\_unsafe\_democertificates: true  
> opendistro\_security.allow\_default\_init\_securityindex: true  
> opendistro\_security.authcz.admin\_dn:
> 
> - CN=kirk,OU=client,O=client,L=test, C=de  
> opendistro\_security.audit.type: internal\_elasticsearch  
> opendistro\_security.enable\_snapshot\_restore\_privilege: true  
> opendistro\_security.check\_snapshot\_restore\_write\_privileges: true  
> opendistro\_security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”]  
> opendistro\_security.system\_indices.enabled: true  
> opendistro\_security.system\_indices.indices: [“.opendistro-alerting-config”, “.opendistro-alerting-alert\*”, “.opendistro-anomaly-results\*”, “.opendistro-anomaly-detector\*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-_", ".opendistro-notifications-_”]  
> cluster.routing.allocation.disk.threshold\_enabled: false  
> node.max\_local\_storage\_nodes: 3

If you need any other config files, please let me know. The documentation around SSL to AD and how to create a truststore is very vague and incomplete in my opinion. Any help would be much appreciated.

Regards  
Darrell

---

<div class="post-metadata">

**Author:** ![Darrell](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Darrell](https://forum.opensearch.org/u/Darrell)\
**Post date:** [January 20, 2021, 10:23am UTC](https://forum.opensearch.org/t/ldap-ad-ssl-config-and-truststore/4641/2 "2021-01-20T10:23:28Z")

</div>

Just as an update, my kibana config has environment overides and is pointing to the es-client service as its source of info:

> - name: ELASTICSEARCH\_HOSTS  
> value: [https://opendistro-es-client-service.logging:9200](https://opendistro-es-client-service.logging:9200)

---

<div class="post-metadata">

**Author:** ![Darrell](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@Darrell](https://forum.opensearch.org/u/Darrell)\
**Post date:** [January 20, 2021, 11:55am UTC](https://forum.opensearch.org/t/ldap-ad-ssl-config-and-truststore/4641/3 "2021-01-20T11:55:23Z")

</div>

Hi,  
I seem to have fixed this to a certain degree. Login is now possible. I created a file called “create\_truststore.sh” and mounted this file as config/create\_truststore.sh

mountPath: /usr/share/elasticsearch/config/create\_truststore.sh  
name: create-truststore  
subPath: create\_truststore.sh

I then added a lifecycle update on podstart as follows:  
lifecycle:  
postStart:  
exec:  
command: [“/usr/bin/bash”, “-c”, “/usr/share/elasticsearch/config/create\_truststore.sh”]

and mounted a configmap: (with permissions)  
name: create-truststore  
configMap:  
name: create-truststore  
defaultMode: 0777

The truststore.sh file in the configmap is as follows:  
data:  
create\_truststore.sh: |-  
/usr/bin/yum install openssl -y

```
cd /usr/share/elasticsearch/config

openssl s_client -connect ldap.example.com:636 < /dev/null |sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /usr/share/elasticsearch/config/ldap.example.com.crt

/opt/jdk/bin/keytool -genkey -alias truststore -keyalg RSA -keystore /usr/share/elasticsearch/config/truststore.jks -dname "CN=Mark Smith, OU=JavaSoft, O=Sun, L=Cupertino, S=California, C=US" -storepass changeit -keypass changeit -validity 10000

/opt/jdk/bin/keytool -import -file /usr/share/elasticsearch/config/ldap.example.com.crt -alias myldap -keystore truststore.jks -storepass changeit -noprompt

```

This has fixed it and upon pod restart this will apply the truststore

I hope this helps anyone else that may experience a similar issue.

Regards