# Continuous errors since enabling LDAP TLS, but everything works **URL:** \ **Category:** Pydio 8\ **Tags:** apache\ **Created:** [February 12, 2019, 4:15pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139 "2019-02-12T16:15:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![LogErrorMan](https://avatars.discourse-cdn.com/v4/letter/l/a3d4f5/32.png) [@LogErrorMan](https://forum.pydio.com/u/LogErrorMan)\ **Post date:** [February 12, 2019, 4:15pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/1 "2019-02-12T16:15:07Z")
Pydio version 8, Debian. ![Screenshot%20from%202019-02-12%2016-31-21](https://canada1.discourse-cdn.com/flex032/uploads/pydio/original/1X/6bff170309e52546d95dd356fa44629c8029c4f8.png) So since last wednesday I’ve been getting these error messages in the picture every few minutes. They all started coming after I enabled the mod ldap.conf (etc/apache2/mods-enabled/ldap.conf) and configured it to use TLS. Exactly like I’ve done with all our other apache machines I configured it and pointed it to our cert that is in usr/local/share/ca-certificates/extra. That plus enabling starttls in the pydio gui. The thing is that everthing in pydio works. It’s just that it’s spamming errors. I know TLS works because if I delete a line in the cert I get a start\_tls error when trying to log in. I tried to disable TLS in the GUI, but that only stopped the error message containing tls. So my best guess is that all the other error messages comes from ldap.conf. Because that’s the only other change I’ve done (except adding the cert). Do you guys have any idea what causes this? I’m only an apprentice so I’m terribly new to all this, and have googled all day trying different solutions without getting through. Would love to get some help. Thanks for reading. ---
**Author:** ![c12simple](https://yyz2.discourse-cdn.com/flex032/user_avatar/forum.pydio.com/c12simple/32/90_2.png) [@c12simple](https://forum.pydio.com/u/c12simple)\ **Post date:** [February 14, 2019, 9:24am UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/2 "2019-02-14T09:24:14Z")
Hi, Could you please post the version of PHP, os version ? Please post the ldap.conf as well. ---
**Author:** ![LogErrorMan](https://avatars.discourse-cdn.com/v4/letter/l/a3d4f5/32.png) [@LogErrorMan](https://forum.pydio.com/u/LogErrorMan)\ **Post date:** [February 14, 2019, 9:32am UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/3 "2019-02-14T09:32:28Z")
PHP 5.6.39-0+deb8u1 “Debian GNU/Linux 8 (jessie)” Ldap.conf looks like this: \ SetHandler ldap-status Require ip 127.0.0.1 ::1 LDAPTrustedGlobalCert CA\_BASE64 /usr/local/share/ca-certificates/extra/ldapsslcertificate.cer LDAPTrustedMode TLS LDAPSharedCacheSize 500000 LDAPCacheEntries 1024 LDAPCacheTTL 600 LDAPOpCacheEntries 1024 LDAPOpCacheTTL 600 ---
**Author:** ![c12simple](https://yyz2.discourse-cdn.com/flex032/user_avatar/forum.pydio.com/c12simple/32/90_2.png) [@c12simple](https://forum.pydio.com/u/c12simple)\ **Post date:** [February 14, 2019, 9:38am UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/4 "2019-02-14T09:38:58Z")
Hello, A stupid question: You are configure ldap for apache or for PHP? If you are config ldap for php (which necessary for ldap plugin) please config (of create if it’s not existed) in /etc/ldap/ldap.conf [https://pydio.com/forum/f/topic/ldap-over-ssl/](https://pydio.com/forum/f/topic/ldap-over-ssl/) ---
**Author:** ![LogErrorMan](https://avatars.discourse-cdn.com/v4/letter/l/a3d4f5/32.png) [@LogErrorMan](https://forum.pydio.com/u/LogErrorMan)\ **Post date:** [February 14, 2019, 9:55am UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/5 "2019-02-14T09:55:17Z")
It was for apache since that is how we log in. But the errors are php. Don’t know how php ldap works or where it is used? (Btw we don’t use openldap and we are authenticating ourselves to a microsoft AD server) But if if I would configure /etc/ldap/ldap.conf would it look like this aaand what service should I restart after doing those changes? BASE ou=COMPANYNAME, dc=companyname,dc=local URI ldap://dc.companyname.local #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS\_CACERT /usr/local/share/ca-certificates/extra/ldapsslcertificate.cer ---
**Author:** ![LogErrorMan](https://avatars.discourse-cdn.com/v4/letter/l/a3d4f5/32.png) [@LogErrorMan](https://forum.pydio.com/u/LogErrorMan)\ **Post date:** [March 6, 2019, 2:26pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/6 "2019-03-06T14:26:43Z")
Still wonder about this. Anyone can help? ---
**Author:** ![c12simple](https://yyz2.discourse-cdn.com/flex032/user_avatar/forum.pydio.com/c12simple/32/90_2.png) [@c12simple](https://forum.pydio.com/u/c12simple)\ **Post date:** [March 6, 2019, 3:07pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/7 "2019-03-06T15:07:10Z")
Could you please post the configuration of Pydio \>\> Settings \>\> Authentication \>\> Master Driver & Secondary Driver ? ---
**Author:** ![LogErrorMan](https://avatars.discourse-cdn.com/v4/letter/l/a3d4f5/32.png) [@LogErrorMan](https://forum.pydio.com/u/LogErrorMan)\ **Post date:** [March 6, 2019, 3:47pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/8 "2019-03-06T15:47:12Z")
**Master Driver** **SERVER CONNECTION** LDAP/AD Directory LDAP url ldap://dcname.local,ldap://dcname2.local Protocol: StartsTLS | LDAP Port: 389 | Ldap bind username: username | password: password | **USERS SCHEMA** People DN: ou=Users, ou=COMPANY, dc = company, dc = local LDAP Filter: objectClass=person User attribute: sAMAccountname **GROUPS SCHEMA** ou=Certain Groups1, ou=COMPANY, dc=company, dc=local ou=Certains Group2, ou=COMPANY, dc=company, dc=local LDAP Filter: objectClass=person User attribute: sAMAccountname **ATTRIBUTES MAPPING** Seems pretty empty but there is memberOf LDAP attribute: memberOf Mapping Type: Role Id displayName LDAP attribute: displayName Mapping Type: Plugin Parameter Plugin parameter: core.conf/USER\_DISPLAY\_NAME mail LDAP attribute: mail Mapping Type: Plugin Parameter Plugin parameter: core.conf/email **ADVANCED PARAMETERS** Fake MemberOf. value of member/memberUid: Turned on Search Users by Attribute: displayName LDAP Server page size: 500 Cache User Count (hours): 1 All other settings are off **AUTH DRIVER COMMONS** Nothing turned on or filled in here **Secondary Driver** **Multiple Instances Mode** Mode: Master/Slave Cache master users: Turned on Users Listing: Both **Secondary Instance Driver** Instance Type: DB Auth Storage Connection: Core Connexion The Database Connection: SQL TABLES **Auth Driver Commons** Auto Create User: Turned on Rest is empty. That’s all 🙂 ---
**Author:** ![LogErrorMan](https://avatars.discourse-cdn.com/v4/letter/l/a3d4f5/32.png) [@LogErrorMan](https://forum.pydio.com/u/LogErrorMan)\ **Post date:** [March 6, 2019, 3:48pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/9 "2019-03-06T15:48:31Z")
And on General Options the only things turned on are “Standard Login Screen”, API Keystore and Enable Users. ---
**Author:** ![c12simple](https://yyz2.discourse-cdn.com/flex032/user_avatar/forum.pydio.com/c12simple/32/90_2.png) [@c12simple](https://forum.pydio.com/u/c12simple)\ **Post date:** [March 6, 2019, 4:01pm UTC](https://forum.pydio.com/t/continuous-errors-since-enabling-ldap-tls-but-everything-works/2139/10 "2019-03-06T16:01:32Z")
hi, Ldap Url: please use one ip or domain name without ldap:// Such as: dcname.local or: dcname2.local Note: Default port for StartsTLS is 636 and SSL is 389 If you use StartsTLS, please make sure that /etc/ldap/ldap.conf is configured ([https://pydio.com/forum/f/topic/ldap-over-ssl/](https://pydio.com/forum/f/topic/ldap-over-ssl/)) > [@LogErrorMan](#): > > **USERS SCHEMA** > > People DN: ou=Users, ou=COMPANY, dc = company, dc = local > LDAP Filter: objectClass=person > User attribute: sAMAccountname LDAP Filter: (objectClass=person) > [@LogErrorMan](#): > > **GROUPS SCHEMA** > ou=Certain Groups1, ou=COMPANY, dc=company, dc=local > ou=Certains Group2, ou=COMPANY, dc=company, dc=local > LDAP Filter: objectClass=person > User attribute: sAMAccountname LDAP Filter: (objectClass=group) > [@LogErrorMan](#): > > **ADVANCED PARAMETERS** > > Fake MemberOf. value of member/memberUid: Turned on Should be turnof if you are running Active Directory