Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1lk3sR-0001kS-Fg
	for pgsql-admin@arkaria.postgresql.org; Fri, 21 May 2021 12:03:39 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1lk3rs-0005ae-MZ
	for pgsql-admin@arkaria.postgresql.org; Fri, 21 May 2021 12:03:04 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <r.kreutz@prodat-sql.de>)
	id 1lk3rs-0005aM-Dc
	for pgsql-admin@lists.postgresql.org; Fri, 21 May 2021 12:03:04 +0000
Received: from mail.prodat-sql.de ([116.202.227.166])
	by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <r.kreutz@prodat-sql.de>)
	id 1lk3rm-0001pJ-Kk
	for pgsql-admin@postgresql.org; Fri, 21 May 2021 12:03:03 +0000
Received: from [192.168.122.168] ([116.202.227.166])
        by mail.prodat-sql.de (IceWarp 12.0.2.1 x64) with ASMTP (SSL) id
 202105211402568513
        for <pgsql-admin@postgresql.org>; Fri, 21 May 2021 14:02:56 +0200
To: pgsql-admin@postgresql.org
From: Rocco Kreutz <r.kreutz@prodat-sql.de>
Subject: Secure LDAP auth on windows machine inside domain
Message-ID: <09ba8d97-6d81-2be9-0ada-7036c7d490df@prodat-sql.de>
Date: Fri, 21 May 2021 14:02:56 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
List-Id: <pgsql-admin.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-admin@lists.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-admin>
Archived-At: 
 <https://www.postgresql.org/message-id/09ba8d97-6d81-2be9-0ada-7036c7d490df%40prodat-sql.de>
Precedence: bulk

I'm looking for some help with setting up LDAP-Auth.

Scenaria is:
- Computer in Windows Domain runs postgreSQL
- The AD-DC is using a self-signed certificate
- That cert is already imported to trusted root cert store on that computer
- LDAP auth without encryption does work fine
   (
   ldap ldapserver=???.???.???.de ldaptls=0 
ldapbasedn="CN=Users,DC=???,DC=???,DC=???" 
ldapbinddn="CN=prodatbind,CN=Users,DC=???,DC=???,DC=???" 
ldapbindpasswd="???" ldapsearchattribute="sAMAccountName"
   )
- i'm trying to logon as prodatadmin (prodatbind account is just for the 
ldap-bind)
- Now either tls or ldaps needs to be activated



If i change to tls=1 i get the errormessage:

2021-05-21 13:38:35.639 CEST [968] LOG:  could not start LDAP TLS 
session: Lokaler Fehler
2021-05-21 13:38:35.639 CEST [968] DETAIL:  LDAP diagnostics: Lokaler Fehler
2021-05-21 13:38:35.640 CEST [968] FATAL:  LDAP authentication failed 
for user "prodatadmin"

Lokaler Fehler -> local error


if i change to ldaps i get the errormessage:

2021-05-21 13:41:34.759 CEST [13412] LOG:  could not perform initial 
LDAP bind for ldapbinddn "CN=prodatbind,CN=Users,DC=???,DC=???,DC=???" 
on server "???.???.???.???": Server heruntergefahren
2021-05-21 13:41:34.759 CEST [13412] DETAIL:  LDAP diagnostics: Server 
heruntergefahren
2021-05-21 13:41:34.760 CEST [13412] FATAL:  LDAP authentication failed 
for user "prodatadmin"

Server heruntergefahren -> Server is down


with ldapadmin (ldapadmin.org) i can connect with ssl or tls. I just get 
a warning about the certificate.
So what do i need to do, to get postgrSQL LDAP to accept that certificate?

Thx