update-ca-certificates (LDAPS)

[Aphetoros]

Hello,

In order for us to get LDAPS (and certificates to authenticate with AD) to work with Intel Owl, our process is a bit manual. We have to do the following

1. docker ps
2. Find container ID of intelowl_uwsgi
3. docker cp /root_ca/directory/. [container_id]:/usr/local/share/ca-certificates
4. docker exec -it [container_id] /bin/bash
5. update-ca-certificates

Is there a way we can add the above and update-ca-certificates to the dockerfile? If so, how would we accomplish this? Please and thank you

[mlodic]

Hey!

Certificates are to be considered as secrets so we cannot add them in the build in the Dockerfile. On the contrary, we can upload them at the time of the container execution, via docker-compose.

Are you following the official doc and using this configuration in the python file, right? https://intelowl.readthedocs.io/en/latest/Advanced-Usage.html#ldap

Referring to that configuration, one possible solution is the following one but still requires a customization by your side:

Add this to the default.yml docker-compose file (mount the folder with the certificates in the uwsgi container):

volumes:
    - /usr/local/share/ca-certificates:/opt/deploy/intel_owl/certs

In settings.py extract the directory of the folder and the names of the certificates you need to use:

    CERTDIR = "/opt/deploy/intel_owl/certs"
    LDAP_PEM = CERTDIR + "/certificate.pem"

in that ldap_config.py file:

from intel_owl.settings import LDAP_PEM
AUTH_LDAP_GLOBAL_OPTIONS = {ldap.OPT_X_TLS_CACERTFILE: f"{LDAP_PEM}"}

[Aphetoros]

I appreciate it! Thank you!!

[mlodic]

anyway, for such SSL configuration, it is normal that some customization is required by the user side. We can just provide the best way to do that but it is impossible to avoid cause there are secrets to handle