# AWX LDAPS  authentication - disable REQUIRE CERT

**URL:** <https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388>\
**Category:** AWX Project\
**Tags:** awx, ee\
**Created:** [November 26, 2022, 6:16am UTC](https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388 "2022-11-26T06:16:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joe](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.ansible.com/u/Joe)\
**Post date:** [November 26, 2022, 6:16am UTC](https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388/1 "2022-11-26T06:16:28Z")

</div>

Hello,

Running AWX 21.9 with operator 1.1.0 on K3s.

Active Directory LDAP authentication works fine, Active Directory LDAPS does not.

I have set the ldap\_cacert\_secret ldap-ca.crt and bundle\_cacert\_secret bundle-ca.crt.  
The ldap-ca.crt was successfully implemented in the awx-web container, I used openssl to verify.

Within the awx-web container, I test with openssl using the AD CA cert and I get this error.  
Verification error: EE certificate key too weak  
Similarly, from the box hosting the k3s instance I get the same error.  
In addition, from the box hosting the k3s instance, I am unable to connect using the AD CA cert using ldapsearch. However, if I set TLS\_REQCERT to Never, the connection succeeds with ldapsearch. From other older boxes, I do not get this EE certificate key too weak, openssl and ldapsearch work fine with the AD CA cert.

I believe the problem is with the AD CA cert having a weak key causing an inability to verify the SSL connection. The awx-web container ldap.py has this setting by default. ldap.OPT\_X\_TLS\_REQUIRE\_CERT:True.  
So what I want to do is set either of these. ldap.OPT\_X\_TLS\_REQUIRE\_CERT:ldap.OPT\_X\_TLS\_NEVER

OR  
ldap.OPT\_X\_TLS\_REQUIRE\_CERT:Never.

I have tried both by updating ldap.py.j2 under the awx-operator installer role however it has no effect, I am certain it is because this is the wrong location.

Can you all help me to set TLS\_REQ\_CERT to Never within awx-web?

Thanks

---

<div class="post-metadata">

**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\
**Post date:** [December 9, 2022, 6:52pm UTC](https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388/2 "2022-12-09T18:52:09Z")

</div>

Can you try going to api/v2/settings/ldap and look at the option AUTH\_LDAP\_CONNECTION\_OPTIONS. You may be able to set OPT\_\* options in that field (using the little form at the bottom of the settings page). Please let us know if can set that setting and, if so, if that works for you or not.

-The AWX Team

---

<div class="post-metadata">

**Author:** ![Joe](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.ansible.com/u/Joe)\
**Post date:** [January 2, 2023, 3:51am UTC](https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388/3 "2023-01-02T03:51:33Z")

</div>

Hello, thank you for the reply

I set the option under api/v2/settings/ldap

“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_REFERRALS”: 0",  
“OPT\_X\_TLS\_REQUIRE\_CERT”: “OPT\_X\_TLS\_NEVER”,  
“OPT\_NETWORK\_TIMEOUT”: 30

It does not work unfortunately.  
Do you know how I can look at any logging to find the cause of the error?

---

<div class="post-metadata">

**Author:** ![Joe](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@Joe](https://forum.ansible.com/u/Joe)\
**Post date:** [January 2, 2023, 5:58pm UTC](https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388/4 "2023-01-02T17:58:16Z")

</div>

The setting required was NEWCTX, I saw some Reddit threads mentioning it and the below is actually referenced in the ldap constants.py.

# see: [https://stackoverflow.com/a/29722445](https://stackoverflow.com/a/29722445)

# see: [https://stackoverflow.com/a/38136255](https://stackoverflow.com/a/38136255)

Thanks for your help

---

<div class="post-metadata">

**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\
**Post date:** [January 4, 2023, 7:45pm UTC](https://forum.ansible.com/t/awx-ldaps-authentication-disable-require-cert/37388/5 "2023-01-04T19:45:43Z")

</div>

thanks for the followup!