Description of problem: [LDAP] - Not able to make test connection with LDAP IDM Server if used https connection Version-Release number of selected component (if applicable): Satellite 6.7 (failing) Satellite 6.6 (passing) How reproducible: Always Steps to Reproduce: 1. Download the LDAP server (IDM )certificate to a temporary location. You can get it from e.g. https://freeipa.example.com/ipa/config/ca.crt 2. Trust the Certificate. Copy the certificate at /etc/pki/ca-trust/source/anchors/ on foreman server. # cp ipa_ca.crt /etc/pki/ca-trust/source/anchors/ # update-ca-trust extract # restorecon -R /etc/pki/ca-trust/source/anchors/ # systemctl restart httpd 3. Try now test connection for LDAP (IDM) server with https Actual results: Currently, Test Connection is failing with an Error ('[Foreman:: WrappedException]: Unable to connect to LDAP server ') Expected results: Test Connection should not fail. Additional info: The same Test is passing for Satellite 6.6
This is due to an upgrade in the net-ldap rubygem in 6.7. Satellite 6.6 shipped with 0.15, which did not validate TLS certificates. Satellite 6.7 includes version 0.16, which validates TLS certificates. This fixes CVE-2017-17718. Closing as NOTABUG since the name on the certificate must match the hostname provided.