===== Notes for configuring Jenkins with LDAP inside FreeBSD cluster =====

==== Configuring LDAP client ====

(this looks out-of-dated)
  - pkg install openldap-client      (Not really necessary, but useful for testing LDAP)
  - copy /usr/local/etc/openldap/* files from freefall.freebsd.org to the Jenkins host

==== Configuring LDAP in Jenkins ====

  - make sure that [[https://wiki.jenkins-ci.org/display/JENKINS/LDAP+Plugin|Jenkins LDAP Plugin]] is installed
  - follow [[https://wiki.jenkins-ci.org/display/JENKINS/Standard+Security+Setup|Jenkins Standard Security Setup]], configuring LDAP
    - Enabled **Matrix Based Security**.  Create a user in the UI with the same login id as in LDAP.
    - Look at the config files in /usr/local/etc/openldap/ and put enter the parameters in the Jenkins LDAP Plugin cofiguration UI
    - Use ldaps:%%//%% for the URL so that SSL is used.

==== Configuring the certificate ====

**This is not needed anymore since ldap.freebsd.org is using letsencrypt and the CA information is in base now**

For ldaps:%%//%% , it may be necessary to add the certificate associated with the LDAP server to the JDK's list of trusted certificates.
This is especially true if the certificate is self-signed or not built-in JDK.
If you don't do this, then authentication errors will occur.

If this is necessary, then you should:

  - Make sure that the opendjk is installed from ports / pkg.
  - Read: https://issues.jenkins-ci.org/browse/JENKINS-3810 
  - Obtain the certificate for the LDAP server from https://www.gandi.net/static/CAs/GandiStandardSSLCA2.pem
  - Copy default cacert file from $JAVA_HOME/lib/security/cacerts to $JENKINS_HOME/cacerts
  - Import certificate:

<code>
keytool -import -trustcacerts -alias gandistandardsslca2 -file GandiStandardSSLCA2.pem -keystore $JENKINS_HOME/cacerts
</code>

(Default password for openjdk certificate store is: **changeit**)
  - Make jenkins use this new keystore by adding this line to /etc/rc.conf:

<code>
jenkins_java_opts="-Djavax.net.ssl.trustStore=/usr/local/jenkins/cacerts"
</code>