Authentication against an internal LDAP server

Google Cloud Apigee
1

On Apigee Edge (not private cloud), I am trying to authenticate external (non-console) users against an LDAP server. Our network team has opened the appropriate routes, and I have set the LDAP server up as follows:

<LdapResource name="myldap">
    <Connection>
        <Hosts>
            <Host port="636">myldapserver.internal.mycompany.com</Host>
            <!-- ldaps -->
        </Hosts>
        <SSLEnabled>true</SSLEnabled>
        <Version>3</Version>
        <Authentication>simple</Authentication>
        <ConnectionProvider>jndi</ConnectionProvider>
    </Connection>
    <ConnectPool enabled="true">
        <Timeout>30000</Timeout>
        <Maxsize>50</Maxsize>
        <Prefsize>30</Prefsize>
        <Initsize></Initsize>
        <Protocol></Protocol>
    </ConnectPool>
    <Admin>
        <DN>uid=admin,ou=ou1,ou=apps,dc=dc1,dc=dc2</DN>
        <Password>mypassword</Password>
    </Admin>
</LdapResource>

This LDAP server uses a self-signed certificate. The signing root has been installed into the Apigee TLS keystore using the Apigee Edge administration console. I am trying to authenticate the user with the following policy:

<Ldap name="MyLdapPolicy">
    <LdapResource>myldap</LdapResource>
    <Authentication>
        <UserName ref="request.header.username"/>
        <Password ref="request.header.password"/>
        <Scope>subtree</Scope>
        <BaseDN>ou=ou1,ou=apps,dc=dc1,dc=dc2</BaseDN>
    </Authentication>
</Ldap>

But I get the following error message:

error: Naming exception simple bind failed: myldapserver.internal.mycompany.com:636 occurred. Reason: simple bind failed: myldapserver.internal.mycompany.com:636.
error.class: com.apigee.rest.framework.security.AuthenticationException

Where am I going wrong? Is it possible to access LDAP like this from Apigee Edge, or are we stuck? Is there a way to get more detailed logs?

2

here binding is failing. So you need to fix that issue. After that do a search instead of authentication. If the connection establishes you will not see any policy failure.

Once it works , then add the authentication code.