Configuring LDAP over SSL in iMC PLAT 7.2

[diode]

I've found that our HPE IMC configuration is using port 389 with simple LDAP.  Simple LDAP on port 389 = cleartext passwords (normally on 389 you use SASL to encypt)..  This setup currently works - users can authenticate with their active directory credentials.

IMC doesn't seem to support SASL, so I want to configure SSL based LDAP instead on port 636.  I have configured port 636 with other applications that do not support SASL.

However, I cannot seem to get this to work in iMC.  I've tried lots of different certificates - the root, the DC, a PKCS7 with the chain from the intermediate up, and none work.  Usually I get a "The authentication file type is incorrect" error.

I tried exporting the root cert again as .cer and suddenly I'm getting an "Authentication server is not available. Please contact the administrator" error, which seems to be an improvement.

Yet I've changed nothing else - if I change back to LDAP on port 389 it works again (with plaintext passwords...)

The only thing I can think of is that the intermediate (issuing) certificate is missing - the domain controller is issued its certificate by an intermediate CA, which is signed by the root.

Has anyone gotten this working? 

[_biv_]

you probably have seen this configuration example which unfortunately doesn't talk about how to configure SSL:

https://techhub.hpe.com/eginfolib/networking/docs/IMC/v7_2/5200-1318/content/index.htm

and I assume when you configured on port 636 other applications that do not support SASL, you've changed in iMC System > Authentication Server > LDAP Server-  parameters accordingly, not just the server port, right?  Can you please share more detail, what this "other application" is and how it is configured? 

[NeilR]

I've not been able to get this to work either. Im using 7.3. Your link is referring to configuration for the IMC administrator logins.

There is also the configuration for the LDAP servers in the UAM section which also has a use SSL option. That gives a similar error if SSL is enabled between IMC and the LDAP servers.

That configuration has server certs but also appears to use the root cert settings under service parameter/certificate. The imc eap server certificate is used in client authentication.

The certifcate use in imc is not very well documented.

[BrianSeppanen]

to do this you'll need to get a certificate chain in pem encoded format from your AD servers.   I happen to be able to access the AD servers.    Login run certlm.msc.    access personal -> certificates.    The certificate will have client authentication capabilities which is required for the certificate.    Select the certificate and view the details tab and start the export by selecting copy to file.  select next to get past the no, do not export the private key if prompted.   I selected Base64 encoded.    save your file.    Next go back to that certificate and select certification path and select the next node up.    Follow the same steps and name the file something different.    Repeat for each node to the top.    After you have all of your nodes accounted for, you'll need to merge the files together.    So in the pem encoded file.   Where  you have 

-----END CERTIFICATE-----

you'll insert the next certificate

-----BEGIN CERTIFICATE-----

and repeat for each in the chain until all of the certificates are included.    Start from the host, move to the issuer, and then to the root.

Once you have them all, save the file.     Go to the authentication settings.   and select require SSL and upload the file you just created.    change your LDAP port likely from 389 to 636 or whatever SSL port you're LDAPS is using.    Test your connection and it should work.    Set a reminder for your calendar for the expiration date of the host certificate, because you'll have to update it.   Usually the issuer and root have a much longer expiration.

Hopefully that works for you, it worked for me with E0705P06 (7.3)