Solve LDAP Trouble When Update Docker Images on WordPress
Tags: docker, wordpress, ldap, devops
Published: 2024-04-09 14:00:00

## Introduction
Hi, I am Kouki, a system engineer from _WESEEK, Inc._ in Japan.

We, _WESEEK, Inc._, offer the internal Wiki service called [GROWI.cloud](https://growi.cloud/?utm_source=dev+community+&utm_medium=referral&utm_campaign=Solve_LDAP_Trouble_When_Update_Docker_Images_on_WordPress) that supports Markdown and provides powerful functions.

Our blog shares insights on our online wiki service “GROWI.cloud” and emerging IT knowledge.

If you like the content, please feel free to follow us on DEV or go to [GROWI.cloud](https://growi.cloud/?utm_source=dev+community+&utm_medium=referral&utm_campaign=Solve_LDAP_Trouble_When_Update_Docker_Images_on_WordPress) to learn more about us!✨

---
## Today’s Topic
In this post, I would like to share some LDAP troubles I encountered when updating WordPress and how I dealt with them. I think it is interesting to share so I made a post to summarize it.

Furthermore, if you are interested in the process of how I targeted and solved the problem, I would appreciate it if you could also check the **Log Analysis** Section.

---
### The Environment
First, I want to talk a little about the environment in which trouble was encountered.

This issue happened when I installed a plugin called [LDAP Login for Intranet Sites](https://plugins.miniorange.com/wordpress-ldap-login-intranet-sites) provided by miniOrange within WordPress.

In fact, this issue would happen not only to the above plugins, if you have code that uses PHP’s LDAP extension, you would encounter this trouble too.

### The Issue
- Updated [bitnami/wordpress](https://hub.docker.com/r/bitnami/wordpress/) docker image from 5.9.3 to 6.0.0
- While updating, I had an issue where I could not connect to OpenLDAP from WordPress.
- The logs were showing “Can’t contact LDAP server”.

---

### Failure Analysis and Solution
The file`/etc/ldap/ldap.conf`,  which was present in `thebitnami/wordpress` 5.9.3, was deleted in 6.0.0. As a result, the PHP LDAP extension could not find the file path for “TLS_CACERT” and failed to validate the certificate, resulting in an error during the TLS connection.

As a workaround, by specifying `TLS_CACERT=/etc/ssl/certs/ca-certificates.crt` an environment variable when starting the WordPress container, the PHP LDAP extension could connect to the LDAP server. 

`/etc/ldap/ldap.conf` does not exist in the 5.9.3 image as of 2022/09/08. (Aware that the internal `bitnami/wordpress` 5.9.3 custom image also included in it)

The 5.9.2 image is confirmed with the existence of `/etc/ldap/ldap.conf`. If you want to check it out, you can try it with 5.9.2 by yourself.

---

### Log Analysis
From here, I will dig deep into the log analysis that I debugged.

In the beginning, I had no idea why this issue happened.

First, I tried to connect to the LDAP server with openssl command and there seemed no problem. (be aware the domain is replaced with example.com here)

![Image 1](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/skcq78kpc7icckwx4l1t.png)

When there is a transmission from the WordPress plugin, the logs on the LDAP server side are as follows:

![Image 2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uqfhxwap0kcgo24quuty.png)

Since only `connection lost` was logged, all I could tell was that there must be some trouble with the connection.

This is where the analysis stalled for a time. However, I soon tried to modify the source code `LDAP Login for Intranet Sites` and started debugging work

I put the following code in the file `/opt/bitnami/wordpress/wp-content/plugins/ldap-login-for-intranet-sites/class-mo-ldap-config.php` and checked the container logs.

![Image 3](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gakwwrwcw8ecscp4wy2q.png)

This lets me confirm that the `ldap_bind` function outputs the message `Can't contact LDAP server`.

My analysis stalled again in this place. After taking some time, I found out that there is a function called `ldap_set_option` and I planted that code

![Image 4](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0b4oos5rqc00d0olf0wf.png)

Then the following log is output.

![Image 5](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9hmrp4laut8n61sjhq5u.png)

This is where I realized that there seems to be a problem with the certificate.

So I added the code `putenv('LDAPTLS_REQCERT=never')` to the plugin and confirmed that the connection works (aware this is just a temporary solution).

However, the workaround `LDAPTLS_REQCERT=never` makes little sense and it also has a security problem.

This is when another member of my team found [this article](https://stackoverflow.com/questions/60938882/can-not-connect-to-server-via-ldaps-using-lets-encrypt-certificates).

With this, I realized that the `/etc/ldap/ldap.conf` file exists for the bitnami/wordpress 5.9.3 version but does not for the 6.0.0 version.

![Image 6](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/prayx2dte3ckor1bs3bm.png)

Then, I chose to specify `TLS_CACERT=/etc/ssl/certs/ca-certificates.crt` in the environment variable when activating the image and I deleted the `LDAPTLS_REQCERT=never` above.

In the end, I solved the issue with `TLS_CACERT`.

---
## Summary
The troubleshooting method that I introduced today can be applied to other docker images as well.

NextCloud, for example, is also built with PHP. Thus, if you are experiencing this problem, you may want to take the same steps to solve this problem.

---
## About Us💡
In addition, we want to introduce a little more about GROWI, an open software developed by _WESEEK, Inc._

_GROWI_ is a wiki service with features-rich support for efficient information storage within the company. It also boasts high security and various authentication methods are available to simplify authentication management, including **LDAP/OAuth/SAML**.

GROWI originated in Japan and **GROWI OSS** is **FREE** for anyone to [download](https://docs.growi.org/en/admin-guide/?utm_source=dev+community+&utm_medium=referral&utm_campaign=Solve_LDAP_Trouble_When_Update_Docker_Images_on_WordPress) and use **in English**.

For more information, go to [GROWI.org](https://growi.org/en/?utm_source=dev+community+&utm_medium=referral&utm_campaign=Solve_LDAP_Trouble_When_Update_Docker_Images_on_WordPress) to learn more about us. 

![GROWI.org](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xqhifh7sj8oz7n96y6aj.png)