SonarQube LDAP working LDAPs not!

Hello all,

we are using SonarQube Developer Edition 10.2.1 on a Debian 11 System.
For security reasons our LDAP team wants to urge us to change connection from LDAP to LDAPs.
This also affects our sonarQube instance.
Our LDAP/LDAPs Server is unfortunately running under windows :frowning:

However while a plain LDAP connection is working as a charm, LDAPs does not. Yet even sonarQube fails to start completely when using LDAPs.

Our Config for LDAPs in the sonarproperties is:

# Enable usage of StartTLS (default : false)
ldap.StartTLS=false

#--------------------------------------------------------------------------------------------------
# LDAP CONFIGURATION

sonar.security.realm=LDAP
ldap.url=ldaps://ldapsServer
ldap.bindDn="CN=Admin,OU=subgroup,OU=group,DC=here,DC=local"
ldap.bindPassword=sectet password
ldap.authentication=simple
sonar.security.localUsers=admin

# User Configuration
ldap.user.baseDn=OU=subgroup,OU=group,DC=here,DC=local
ldap.user.request=(&(objectClass=user)(sAMAccountName={login})) 
ldap.user.realNameAttribute=cn

Using this config, Sonar is starting but after a few seconds it crashes completely. The sonar.log does not tell us anything but the weblog says:

2023.10.30 15:46:33 DEBUG web[][o.s.a.l.LdapContextFactory] Initializing LDAP context {java.naming.referral=follow, java.naming.security.principal="CN=Admin,OU=subgroup,OU=group,DC=here,DC=local", com.sun.jndi.ldap.connect.pool=true, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.provider.url=ldaps://ldapsServer, java.naming.security.authentication=simple}
2023.10.30 15:46:33 INFO  web[][o.s.a.l.LdapContextFactory] Test LDAP connection: FAIL
2023.10.30 15:46:33 WARN  web[][o.s.c.a.AnnotationConfigApplicationContext] Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.server.ws.WebServiceEngine': Unsatisfied dependency expressed through constructor parameter 0; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.server.authentication.ws.AuthenticationWs': Unsatisfied dependency expressed through constructor parameter 0; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.server.authentication.ws.LoginAction': Unsatisfied dependency expressed through constructor parameter 0; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.server.authentication.CredentialsAuthentication': Unsatisfied dependency expressed through constructor parameter 4; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.server.authentication.LdapCredentialsAuthentication': Unsatisfied dependency expressed through constructor parameter 3; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.auth.ldap.LdapRealm': Bean instantiation via constructor failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.sonar.auth.ldap.LdapRealm]: Constructor threw exception; nested exception is org.sonar.auth.ldap.LdapException: LDAP realm failed to start: Unable to open LDAP connection
2023.10.30 15:46:33 ERROR web[][o.s.s.p.Platform] Background initialization failed. Stopping SonarQube

Can please anyone tell us what is going wrong here?

Greetings,
Martina

Hi Martina,

Unfortunately, we can’t tell you much more than what’s already in the logs:

Your best bet here is to get an independent LDAP client to perfect your connection settings with and then transfer them into your SonarQube config. Alternately, your LDAP admins should be a good resource to lean on here.

 
HTH,
Ann