ldap3.core.exceptions.LDAPStartTLSError

JupyterHub Zero to JupyterHub on Kubernetes
1

Hi,

JupyterHub version 0.9.x works just fine with this LDAP authentication configuration

auth:
  type: ldap
  ldap:
    server:
      address: ldap.example.org
    dn:
      templates:
        - 'uid={username},ou=People,dc=example,dc=org'

However, I found that versions 0.10+ of JupyterHub produce the following error in the hub’s pod:

ldap3.core.exceptions.LDAPStartTLSError: ('wrap socket error: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1123)',)

with the equivalent LDAP configuration

hub:
  config:
    JupyterHub:
      authenticator_class: ldapauthenticator.LDAPAuthenticator
    LDAPAuthenticator:
      bind_dn_template:
        - uid={username},ou=People,dc=example,dc=org
      server_address: ldap.example.org

Does anyone know why?

Many thanks,
Sebastian

2

Well, the ldapauthenticator relies on ldap3 and probably one year ago they did some major changes in their library API. This in turn led to changes in how the the ldapauthicator uses the library. Could it be that for JupyterHub 0.9 just a lower ldapauthenticator or ldap3 library version is pinned? So that with a newer JupyterHub version you automatically updated these two libraries as well?

Therefore, please provide your library versions before and after the update. I guess it is the best to create an issue in the ldapauthenticator github repo.

3

Thanks!

Here it is: ldap3.core.exceptions.LDAPStartTLSError · Issue #194 · jupyterhub/ldapauthenticator · GitHub

Best regards,
Sebastian

1 Like
4

Hi @sluna

I am facing the same issue with openldap integration on Jupyterhub, were you able to resolve the issue?

Regards,
Sathya

5

Hi,

Sorry, I wasn’t able to narrow down the root cause of the issue.

I followed it up with no success in the following threads, in case it helps:

Best regards,
Sebastian

6

Have you checked the ssl library manual? Is this exception well-known or is it a bug which might be worth reporting?

7

Hi,

I haven’t sorry. Could you please point me to right place? I will see if I can find something and report back.

Best regards,
Sebastian