Add ability to disable LDAP certificate validation

diff --git a/.env.example b/.env.example
index eda20ea261bb9147a17dd451877fc42b5896311f..3ca612f647dec72a243a448670988d6ef9d862e2 100644 (file)
--- a/.env.example
+++ b/.env.example
@@ -76,6 +76,8 @@ LDAP_GROUP_ATTRIBUTE="memberOf"
 # Would you like to remove users from roles on BookStack if they do not match on LDAP
 # If false, the ldap groups-roles sync will only add users to roles
 LDAP_REMOVE_FROM_GROUPS=false
 # Would you like to remove users from roles on BookStack if they do not match on LDAP
 # If false, the ldap groups-roles sync will only add users to roles
 LDAP_REMOVE_FROM_GROUPS=false

+# Set this option to disable LDAPS Certificate Verification
+LDAP_TLS_INSECURE=false

 
 # Mail settings
 MAIL_DRIVER=smtp
 
 # Mail settings
 MAIL_DRIVER=smtp

diff --git a/app/Auth/Access/LdapService.php b/app/Auth/Access/LdapService.php
index d3a177f8e1dffbac095e4d504550b646182eb690..04af5b370878dc2f63529f353896295be97cc27b 100644 (file)
--- a/app/Auth/Access/LdapService.php
+++ b/app/Auth/Access/LdapService.php
@@ -169,8 +169,14 @@ class LdapService
         }
         $hostName = $ldapServer[0] . ($hasProtocol?':':'') . $ldapServer[1];
         $defaultPort = $ldapServer[0] === 'ldaps' ? 636 : 389;
         }
         $hostName = $ldapServer[0] . ($hasProtocol?':':'') . $ldapServer[1];
         $defaultPort = $ldapServer[0] === 'ldaps' ? 636 : 389;

+

         $ldapConnection = $this->ldap->connect($hostName, count($ldapServer) > 2 ? intval($ldapServer[2]) : $defaultPort);
 
         $ldapConnection = $this->ldap->connect($hostName, count($ldapServer) > 2 ? intval($ldapServer[2]) : $defaultPort);
 

+        // Check if TLS_INSECURE is set
+        if($this->config['tls_insecure']) {
+            $this->ldap->setOption($ldapConnection, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
+        }
+

         if ($ldapConnection === false) {
             throw new LdapException(trans('errors.ldap_cannot_connect'));
         }
         if ($ldapConnection === false) {
             throw new LdapException(trans('errors.ldap_cannot_connect'));
         }

diff --git a/config/services.php b/config/services.php
index 711040386a9ac17c954ad694ac3aece8b11a06de..47fd2f2ff3db736388c0b13f2ff1f535ce043b3f 100644 (file)
--- a/config/services.php
+++ b/config/services.php
@@ -148,6 +148,7 @@ return [
                'user_to_groups' => env('LDAP_USER_TO_GROUPS',false),
                'group_attribute' => env('LDAP_GROUP_ATTRIBUTE', 'memberOf'),
                'remove_from_groups' => env('LDAP_REMOVE_FROM_GROUPS',false),
                'user_to_groups' => env('LDAP_USER_TO_GROUPS',false),
                'group_attribute' => env('LDAP_GROUP_ATTRIBUTE', 'memberOf'),
                'remove_from_groups' => env('LDAP_REMOVE_FROM_GROUPS',false),

+        'tls_insecure' => env('LDAP_TLS_INSECURE', false),

        ]
 
 ];
        ]
 
 ];