checkId: check.integration.ldap plugin: stellaops.doctor.integration severity: warn tags: [connectivity, ldap, directory, auth]

LDAP/AD Connectivity

This Doctor check verifies that the Stella Ops control plane can reach its configured LDAP or Active Directory server. It is aimed at operators and DevOps engineers diagnosing directory-based authentication problems.

What It Checks

Reads the LDAP host from Ldap:Host, ActiveDirectory:Host, or Authority:Ldap:Host and the port from the corresponding :Port key (defaulting to 389, or 636 when UseSsl is true). Opens a raw TCP connection to the host and port with a 5-second timeout. The check passes if the TCP connection succeeds, fails on timeout, socket error, or connection refusal.

Why It Matters

LDAP or Active Directory integration is used for user authentication, group synchronization, and role mapping. If the LDAP server is unreachable, users cannot log in via directory credentials, group-based access policies cannot be evaluated, and new user provisioning stops. This directly impacts operator access to the control plane.

Common Causes

How to Fix

Docker Compose

# Check LDAP configuration
grep 'LDAP__\|ACTIVEDIRECTORY__' .env

# Test TCP connectivity from the gateway container
docker compose exec gateway bash -c "echo > /dev/tcp/ldap.example.com/389 && echo OK || echo FAIL"

# Update LDAP host/port
echo 'Ldap__Host=ldap.example.com' >> .env
echo 'Ldap__Port=636' >> .env
echo 'Ldap__UseSsl=true' >> .env
docker compose restart gateway

Bare Metal / systemd

# Verify configuration
cat /etc/stellaops/appsettings.Production.json | jq '.Ldap'

# Test connectivity
telnet ldap.example.com 389
# or
nslookup ldap.example.com

# Update configuration
sudo nano /etc/stellaops/appsettings.Production.json
sudo systemctl restart stellaops-platform

Kubernetes / Helm

# values.yaml
ldap:
  host: ldap.example.com
  port: 636
  useSsl: true

helm upgrade stellaops ./chart -f values.yaml

Verification

stella doctor --check check.integration.ldap