# New LDAP error in AWX 3.0.1

**URL:** <https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [February 13, 2019, 3:22pm UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669 "2019-02-13T15:22:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kristopher.d.ayala](https://avatars.discourse-cdn.com/v4/letter/k/a88e57/32.png) [@kristopher.d.ayala](https://forum.ansible.com/u/kristopher.d.ayala)\
**Post date:** [February 13, 2019, 3:22pm UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669/1 "2019-02-13T15:22:11Z")

</div>

Hi All,

After building the images for AWX 3.0.1 I am seeing a new LDAP error.

2019-02-13 14:54:15,180 WARNING django\_auth\_ldap Caught LDAPError while authenticating : SERVER\_DOWN({‘desc’: “Can’t contact LDAP server”, ‘info’: ‘error:14090086:SSL routines:ssl3\_get\_server\_certificate:certificate verify failed (unable to get local issuer certificate)’},)

I have been using the same LDAP config and root\_ca.pem file since AWX 1.0.6. But with the 3.0.1 release its not working anymore.

Has anyone seen or run into this before? My googling the error message and trying the suggested fixes have not worked. I have also checked the AWX code base for any LDAP settings but have not seen any that caught my eye.

This is probably just a user error on my end due to my lack of LDAP workings but any help would be appreciated.

Below is my settings in the api/v2/settings/ldap section.

{

“AUTH\_LDAP\_SERVER\_URI”: “ldaps://\<ldap\_server\>:636”,  
“AUTH\_LDAP\_BIND\_DN”: “CN=user,OU=ServiceAccounts,OU=CorpUsers,DC=winroot,DC=,DC=com”,  
“AUTH\_LDAP\_BIND\_PASSWORD”: “$encrypted$”,  
“AUTH\_LDAP\_START\_TLS”: false,  
“AUTH\_LDAP\_CONNECTION\_OPTIONS”: {  
“OPT\_NETWORK\_TIMEOUT”: 30,  
“OPT\_REFERRALS”: 0,  
“OPT\_X\_TLS\_NEWCTX”: 0,  
“OPT\_X\_TLS\_CACERTFILE”: “/var/lib/awx/Root\_CA.pem”,  
},  
“AUTH\_LDAP\_USER\_SEARCH”: [  
“DC=WINROOT,DC=,DC=com”,  
“SCOPE\_SUBTREE”,  
“(sAMAccountName=%(user)s)”  
],  
“AUTH\_LDAP\_USER\_DN\_TEMPLATE”: null,  
“AUTH\_LDAP\_USER\_ATTR\_MAP”: {  
“first\_name”: “givenName”,  
“last\_name”: “sn”,  
“email”: “mail”  
},  
“AUTH\_LDAP\_GROUP\_SEARCH”: [  
“DC=WINROOT,DC=,DC=com”,  
“SCOPE\_SUBTREE”,  
“(objectClass=group)”  
],  
“AUTH\_LDAP\_GROUP\_TYPE”: “ActiveDirectoryGroupType”,  
“AUTH\_LDAP\_GROUP\_TYPE\_PARAMS”: {},  
“AUTH\_LDAP\_REQUIRE\_GROUP”: null,  
“AUTH\_LDAP\_DENY\_GROUP”: null,  
“AUTH\_LDAP\_USER\_FLAGS\_BY\_GROUP”: {},  
“AUTH\_LDAP\_ORGANIZATION\_MAP”: {  
“ORG 1”: {  
“admins”: “cn=\<admin\_group\>,ou=autogroups,OU=CorpGroups,dc=winroot,dc=,dc=com”,  
“remove\_admins”: true  
},  
},  
“AUTH\_LDAP\_TEAM\_MAP”: {  
“TEAM 1”: {  
“organization”: “ORG 1”,  
“users”: “cn=,ou=autogroups,ou=corpgroups,dc=winroot,dc=,dc=com”,  
“remove”: true  
},  
}  
}

---

<div class="post-metadata">

**Author:** ![Darkhan](https://avatars.discourse-cdn.com/v4/letter/d/34f0e0/32.png) [@Darkhan](https://forum.ansible.com/u/Darkhan)\
**Post date:** [February 20, 2019, 3:54pm UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669/2 "2019-02-20T15:54:40Z")

</div>

Can you login to your awx\_web container and check the /var/lib/awx/ path and see if you actually have your certificates there?

---

<div class="post-metadata">

**Author:** ![kristopher.d.ayala](https://avatars.discourse-cdn.com/v4/letter/k/a88e57/32.png) [@kristopher.d.ayala](https://forum.ansible.com/u/kristopher.d.ayala)\
**Post date:** [February 20, 2019, 5:01pm UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669/3 "2019-02-20T17:01:22Z")

</div>

I just double checked and I have 2 of the same certs with different name.

/var/lib/awx/Root\_CA.pem and /var/lib/awx/ca.crt

The ca.crt one is what I have been using since 1.0.6 and it worked until now.

I created the Root\_CA.pem one when I was googling and found the following commands to add the .pem file to the systems trust store.

Below are the command I added to my Dockerfile.j2 template in the image build role.

ADD Root\_CA.pem /etc/pki/ca-trust/source/anchors/Root\_CA.pem  
RUN update-ca-trust enable && update-ca-trust extract

Here is what I had originally in the dockerfile before I added the above to try and fix the ssl issue.

ADD ca.crt /var/lib/awx/ca.crt

---

<div class="post-metadata">

**Author:** ![Darkhan](https://avatars.discourse-cdn.com/v4/letter/d/34f0e0/32.png) [@Darkhan](https://forum.ansible.com/u/Darkhan)\
**Post date:** [February 20, 2019, 6:42pm UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669/4 "2019-02-20T18:42:20Z")

</div>

What installation method are you using? If it’s docker, you have a ca\_cert\_trust variable you can set in there to the location of the certs on your host machine and it will be mounted in your containers.

---

<div class="post-metadata">

**Author:** ![kristopher.d.ayala](https://avatars.discourse-cdn.com/v4/letter/k/a88e57/32.png) [@kristopher.d.ayala](https://forum.ansible.com/u/kristopher.d.ayala)\
**Post date:** [February 20, 2019, 6:55pm UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669/5 "2019-02-20T18:55:40Z")

</div>

I am deploying to a Kubernetes cluster.

So I build the images, push them to a private docker repo and deploy them to kubernetes using the kubernetes role in the installer directory.

---

<div class="post-metadata">

**Author:** ![Darkhan](https://avatars.discourse-cdn.com/v4/letter/d/34f0e0/32.png) [@Darkhan](https://forum.ansible.com/u/Darkhan)\
**Post date:** [February 21, 2019, 9:46am UTC](https://forum.ansible.com/t/new-ldap-error-in-awx-3-0-1/29669/6 "2019-02-21T09:46:16Z")

</div>

Does ldapsearch work from the shell inside awx\_web container?