# AD/LDAP cert needed for authentication **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [October 10, 2017, 5:40pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714 "2017-10-10T17:40:11Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Paul\_Archer](https://avatars.discourse-cdn.com/v4/letter/p/839c29/32.png) [@Paul\_Archer](https://forum.ansible.com/u/Paul_Archer)\ **Post date:** [October 10, 2017, 5:40pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/1 "2017-10-10T17:40:11Z")
I’m trying to use LDAP authentication to connect to AD. I want to use TLS (configure awx → subcategory: ldap → ‘ldap start tls’), but I need to add the CACert for the AD server. If AWX weren’t docker’ized, I’d add it in /etc/openldap/certs, but with docker, I have no idea where/how to add the cert. Any ideas? Paul ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [October 10, 2017, 6:20pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/2 "2017-10-10T18:20:50Z")
In this case, until we support it at a higher level, you may need to rebuild the image with your cert installed. ---
**Author:** ![Paul\_Archer](https://avatars.discourse-cdn.com/v4/letter/p/839c29/32.png) [@Paul\_Archer](https://forum.ansible.com/u/Paul_Archer)\ **Post date:** [October 11, 2017, 1:32pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/3 "2017-10-11T13:32:04Z")
OK, so this may not be the best forum, but see earlier comment re: “no idea where/how to add the cert.” Or to put it another way, if I were to rebuild the image (which image? awx\_web? awx\_task?), where would the certs go in the overall directory structure of the build files, and what else would I have to modify? Thanks, Paul ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [October 11, 2017, 3:06pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/4 "2017-10-11T15:06:07Z")
It probably just needs to be added to the web container. I’ll point out that our task container image is built with the web container image as a base so it would just be picked up by that. You can see a little bit about how we add files to the image itself here: [https://github.com/ansible/awx/blob/devel/installer/image\_build/templates/Dockerfile.j2#L24-L25](https://github.com/ansible/awx/blob/devel/installer/image_build/templates/Dockerfile.j2#L24-L25) So maybe it just needs to be put in the right location there? I’m not entirely certain. An ideal code level solution would be take to be able to take it as a configuration option, you can see how we register them here: [https://github.com/ansible/awx/blob/devel/awx/main/conf.py](https://github.com/ansible/awx/blob/devel/awx/main/conf.py) Which uses our conf app located here: [https://github.com/ansible/awx/tree/devel/awx/conf](https://github.com/ansible/awx/tree/devel/awx/conf) To register them and present them through our api. You could then manage the content of the cert in our sso backend to make sure it was available to the LDAP authentication backend here: [https://github.com/ansible/awx/blob/devel/awx/sso/backends.py](https://github.com/ansible/awx/blob/devel/awx/sso/backends.py) Come to think of it, some of these settings that we already have might help you instead of doing all this: [https://github.com/ansible/awx/blob/devel/awx/sso/backends.py#L89-L94](https://github.com/ansible/awx/blob/devel/awx/sso/backends.py#L89-L94) I’m just not sure right at this very moment and haven’t had a chance to dig into this bit much. ---
**Author:** ![Cody\_John](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@Cody\_John](https://forum.ansible.com/u/Cody_John)\ **Post date:** [October 31, 2017, 2:21pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/5 "2017-10-31T14:21:24Z")
Paul, I have a similar requirement. Have you had any luck? ---
**Author:** ![Paul\_Archer](https://avatars.discourse-cdn.com/v4/letter/p/839c29/32.png) [@Paul\_Archer](https://forum.ansible.com/u/Paul_Archer)\ **Post date:** [October 31, 2017, 3:26pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/6 "2017-10-31T15:26:59Z")
installer/image\_build/templates/Dockerfile.j2 `RUN mkdir -p /etc/openldap/certs ADD key3.db /etc/openldap/certs ADD cert8.db /etc/openldap/certs` installer/image\_build/tasks/main.yml ` - name: Stage openldap key copy: src: key3.db dest: ‘{{ docker\_base\_path }}’ delegate\_to: localhost - name: Stage openldap cert copy: src: cert8.db dest: ‘{{ docker\_base\_path }}’ delegate\_to: localhost ` Add your cert and key files to awx/installer/image\_build/files/ ---
**Author:** ![Cody\_John](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@Cody\_John](https://forum.ansible.com/u/Cody_John)\ **Post date:** [October 31, 2017, 3:52pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/7 "2017-10-31T15:52:32Z")
Yeah I’ve been playing with it as well and come to roughly the same steps. However now I’m running into what seems like a bug. I want to specify a non-FQDN host name for my LDAP server: `ldaps://ldap:636` Whenever I try to save this in the GUI, it just…doesn’t. If you don’t specify a hostname with a “.”, the update results in a 400 error: ` 10.255.255.10 - - [31/Oct/2017:15:49:32 +0000] “PATCH /api/v2/settings/all/ HTTP/1.1” 400 57 “[http://server/](http://server/)” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_12\_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36” “-” ` ---
**Author:** ![Cody\_John](https://avatars.discourse-cdn.com/v4/letter/c/8e7dd6/32.png) [@Cody\_John](https://forum.ansible.com/u/Cody_John)\ **Post date:** [October 31, 2017, 4:15pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/8 "2017-10-31T16:15:00Z")
I’ve opened a bug report for it: [https://github.com/ansible/awx/issues/537](https://github.com/ansible/awx/issues/537) ---
**Author:** ![Selvam\_Elangovan](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Selvam\_Elangovan](https://forum.ansible.com/u/Selvam_Elangovan)\ **Post date:** [May 14, 2020, 2:44pm UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/9 "2020-05-14T14:44:09Z")
I am using awx 11.x. I am looking for same option to upload ssl cert in awx container. do we still need to create image for awx-web to port it? ---
**Author:** ![Selvam\_Elangovan](https://avatars.discourse-cdn.com/v4/letter/s/8c91f0/32.png) [@Selvam\_Elangovan](https://forum.ansible.com/u/Selvam_Elangovan)\ **Post date:** [May 16, 2020, 9:34am UTC](https://forum.ansible.com/t/ad-ldap-cert-needed-for-authentication/25714/10 "2020-05-16T09:34:50Z")
Can we use config map to make very available to aws-web container