> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAPS

LDAP over SSL, or LDAPS, allows you to encrypt your LDAP server data while it travels during communications, in order to protect it from attacks like certificate theft. For more information, see the [official Keycloak documentation on LDAPS](https://www.keycloak.org/docs/latest/server_admin/#connecting-to-ldap-over-ssl).

**On this page:**

* [Prerequisites](#prerequisites)
* [Establishing LDAPS](#establishing-ldaps)
* [Troubleshooting](#troubleshooting)

## Prerequisites

You must have the Java `jre` package installed to complete this procedure.

## Establishing LDAPS

1. Open a terminal and connect to your instance of Anaconda Server.

2. Generate a truststore on your host by running the following command:

   ```sh theme={null}
   # Replace <PASSWORD> with the password for your truststore file
   # Replace <CA_CERT> with the path to the root certificate authority
   keytool -keystore truststore.jks -storepass <PASSWORD> -noprompt -trustcacerts -importcert -alias ldap-ca -file <CA_CERT>
   ```

3. Copy the `truststore.jks` file you just generated to the following location:

   ```sh theme={null}
   /opt/anaconda/repo/config/keycloak
   ```

4. Find and open your `docker-compose.yml` file in your installer directory using your preferred file editor.

5. Find the `services: keycloak: volumes:` section of the file and add the following line:

   ```sh theme={null}
   - ${BASE_INSTALL_DIR}/config/keycloak/truststore.jks:/opt/keycloak/keystores/truststore.jks
   ```

6. Find the `services: keycloak: depends_on:` section of the file and add the following line:

   ```sh theme={null}
   # Replace <PASSWORD> with the password for your truststore file
   command: /opt/keycloak/entrypoint.sh --import-realm --spi-truststore-file-file=/opt/keycloak/keystores/truststore.jks --spi-truststore-file-password=<PASSWORD>
   ```

   <Warning>
     Pay close attention to the indentation of your added lines. If you do not add them at the correct level of indentation, your configurations will not be readable.
   </Warning>

   Here is an example of what your `docker-compose.yml` file should look like when you are finished adding these lines:

   <Frame>
     <img src="https://mintcdn.com/anaconda-29683c67/atV1FF4bOzhiwIx6/images/docker_compose_yml_add_LDAPS.png?fit=max&auto=format&n=atV1FF4bOzhiwIx6&q=85&s=eb14cb4908554bfc3a59e876db696660" alt="" width="1795" height="602" data-path="images/docker_compose_yml_add_LDAPS.png" />
   </Frame>

7. Enter your base installer directory by running the following command:

   ```sh theme={null}
   # Replace <INSTALLER_DIR> with your installer directory folder
   cd <INSTALLER_DIR>
   ```

8. Restart your containers by running the following command:

   ```sh theme={null}
   docker-compose up -d
   ```

## Troubleshooting

If you have any issues, verify the certificate authority against the LDAPS server by running the following command:

```sh theme={null}
# Replace <CERT_AUTH.pem> with your certificate authority
openssl s_client -CAfile <CERT_AUTH.pem> -connect ldapserver.com:636
```

This returns the following string:

```sh theme={null}
Verify return code: 0 (ok)
```

You can inspect the keystore you created with the following command:

```sh theme={null}
# Replace <PASSWORD> with the password for your truststore file
keytool -list -v -keystore /opt/keycloak/standalone/configuration/keystores/truststore -storepass <PASSWORD>
```