How to configure LDAP Healthmonitor with STARTTLS on port 389

Products

• VMware Avi Load Balancer

Issue/Introduction

Some customers may have servers that require encrypted sessions even on port 389.

The default LDAPS Healthmonitor configuration enables STARTTLS, but this requires the port to be set to 636.

 

Resolution

In order to configure a LDAP hm with STARTTLS, the only option is to use an external health monitor.

Please see sample script below.

#!/bin/bash
IFS= read -r VAR_USERNAME
IFS= read -r VAR_PASSWORD
ldapsearch -x -D "$VAR_USERNAME" -w "$VAR_PASSWORD" -h $IP -p $PORT -b "dc=$BASEDN,dc=net" -s sub "sAMAccountName=svc_ldapmon" -ZZ | grep "result: 0 Success"

In the sample script above, read commands must use IFS= read -r. Without -r, bash interprets backslash (\) as an escape character and removes it from the credential; without IFS=, leading/trailing spaces are stripped.

For example. Put the bind DN in the username of the external HM's configuration and the password in the password. This script can be adapted to do much more granular query, The example shown above is a simple query for the root object in the directory.

The -ZZ says to use STARTTLS and fail if STARTTLS is not available.