Trying to authenticate API calls with LDAP

[EdOro126]

Hi, I have a setup that is using LDAP to authenticate users attempting to access a site that hosts API calls, this is working.

authorization policy mypolicy { set auth url https://example.com/auth allow roles authp/admin authp/user crypto key verify {env.JWT_SHARED_KEY} }

I am also trying to use the with basic auth directive against specific API endpoints to require user authentication to restrict any
API calls on those endpoints, though it does not seem to want to work when I have it check against the LDAP realm.

authorization policy myApiPolicy { with basic auth portal myportal realm ldap-realm allow roles authp/admin authp/user crypto key verify {env.JWT_SHARED_KEY} }
I can see that the syntax is
with basic auth portal <PORTAL_NAME> realm <REALM_NAME>

Is if fair to assume that we should be able to use any realm for REALM_NAME, regardless of identity store, or does it have to be one that resolves to a local backend?

To help clarify, when I do a REST API call, using LDAP credentials, I receive the following:
{"level":"warn","ts":1698414427.114379,"logger":"security","msg":"user authentication failed","source_address":"10.141.0.110","custom_auth":"basicauth","realm":"local","error":"local backed authentication failed: user authentication failed: user not found"}

I also tried changing the portal to one that does not have a local identity store included and I get the following error:
{"level":"warn","ts":1698414617.9613304,"logger":"security","msg":"realm backend not found","source_address":"10.141.0.110","custom_auth":"basicauth","realm":"local"}
{"level":"debug","ts":1698414617.9613986,"logger":"security","msg":"token validation error","session_id":"ax0chgucutKE5JL75jNRgAblbPMb0LdEa0ArS","request_id":"51ef5cb8-d0ba-4d53-8947-45b9959138bc","error":"basic authentication via authproxy failed"}

[stereocarnyx]

Hey @EdOro126

If I'm reading your message correctly it looks like I have a very similar issue with the basic auth credentials validation via LDAP backend.

Here's the link to my issue opened: #291

Does that look similar for you as well?

[EdOro126]

Hi @stereocarnyx,

It looks like a similar issue. I essentially want to know if I'm reading the syntax correctly or if the feature in question is not working as expected.

[greenpau]

@EdOro126 , @stereocarnyx , this API key auth is not available with LDAP, because LDAP does not have the authentication material. Currently, this functionality is not available.