LDAP Auth with Synology Directory Server (Active Directory)

[jgarrison]

Im using the Confluence Evaluation installed on MacOS 10.13.6.

Our Active Directory is hosted on our Synology Box using Synology Directory Server (samba). 

Im struggling to get LDAP auth set up. I keep getting

Connection test failed. Response from the server:
auth.companydomain.com:636; nested exception is javax.naming.CommunicationException: auth.companydomain.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching auth.companydomain.com found]

I'm assuming that this has something to do with the certificate Synology is using for active directory by default.

I unchecked Advanced Settings -> Use Secure SSL and that changed my error message to:

Connection test failed. Response from the server:
auth.companydomain.com:636; nested exception is javax.naming.CommunicationException: auth.companydomain.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

I've successfully set up LDAP integration with other software (eg: moodle).

I tried following the steps here:
https://confluence.atlassian.com/kb/how-to-import-a-public-ssl-certificate-into-a-jvm-867025849.html?_ga=2.267991946.521402259.1574196240-1350555410.1548796221#HowtoimportapublicSSLcertificateintoaJVM-commandline

but can't seem to get the paths right.

Any direction would be helpful! 

[Monique Khairuliana[ServiceRocket]]

Hi @jgarrison ,

If you uncheck the SSL option, then you can just use LDAP port 389 I think.

As for the PKIX error message when using SSL, try going through this post: 

• https://community.atlassian.com/t5/Jira-Software-questions/LDAP-SSL-Failed/qaq-p/826767

All the best,

Monique

[Frank Knoepfler]

Hi  jgarison,
I've the same issues here.
did you found a solution for your problem?

Thanks

Frank

[jgarrison]

No, I did not. It does seem to be on synology's end. I had issue trying to do the same with another program. It seems synology does not pass on the full certificate chain.

Hopefully this is addressed in the upcoming DSM 7.