Merge pull request #100 from theta42/release/1.10.0

Bump jump-host to v1.7.0; release notes for the ldaps:// fix
2026-07-27 20:31:04 -04:00 · 2026-07-27 20:30:36 -04:00 · 2026-07-27 20:11:28 -04:00 · 2026-07-27 20:10:58 -04:00
3 changed files with 21 additions and 2 deletions
@@ -10,6 +10,16 @@ for what changed inside the apps it composes.

 ## [Unreleased]

+## [1.10.0] - 2026-07-27
+
+### Fixed
+- **`bootstrap/bootstrap.js`'s jump-secrets.js template now points jump-host at `ldaps://sso-manager:636`**, not `ldap://sso-manager:389`. The plain-port URL combined with jump-host's `tlsOptions` made `ldapts` attempt implicit TLS against a port serving plaintext LDAP — slapd dropped every connection before any LDAP message parsed, so SSH password login failed for every account, with any password, indistinguishable from a wrong credential. Root-caused by standing up a local jump-host, editing its config, and calling `getUser`/`checkPassword` directly inside the container. **Existing deployments must edit `./config/jump-secrets.js` themselves** (this template only affects fresh bootstraps) — see theta42/theta-env#99. Companion defensive fix: [simpleworkjs/ldap v1.0.2](https://github.com/simpleworkjs/ldap/releases/tag/v1.0.2) now rejects this `ldap://` + `tlsOptions` combination outright.
+
+### Bumped
+- jump-host -> [v1.7.0](https://github.com/theta42/jump-host/releases/tag/v1.7.0) — adds self-service API tokens (create/list/rotate/revoke from its dashboard); jump-host previously had none.
+
+No `setup.sh` or compose change.
+
 ## [1.9.0] - 2026-07-27

 ### Bumped
@@ -527,7 +527,16 @@ function writeJumpSecrets(apiToken, oidc, localAdminPass) {
 module.exports = {
 \tname: ${JSON.stringify(sso.name || 'SSO Manager')},
 \tldap: {
-\t\turl: 'ldap://sso-manager:389',
+\t\t// ldaps:// (636), not ldap:// (389): @simpleworkjs/ldap's client always
+\t\t// sets tlsOptions (see jump-host's models/user_ldap.js), and ldapts
+\t\t// treats a non-empty tlsOptions as "use implicit TLS" regardless of the
+\t\t// URL scheme -- pointed at the plain port, that means it opens a raw TLS
+\t\t// handshake against a server expecting plaintext LDAP, which slapd just
+\t\t// drops (logged as "connection lost", no BIND ever attempted). This bit
+\t\t// jump-host silently: every SSH login failed with the generic
+\t\t// "Permission denied" for any password, because getUser()/checkPassword()
+\t\t// never even reached slapd.
+\t\turl: 'ldaps://sso-manager:636',
 \t\tbindDN: ${JSON.stringify(BIND_DN)},
 \t\tbindPassword: ${JSON.stringify(ADMIN_PASS)},
 \t\tuserBase: ${JSON.stringify(`ou=people,${BASE_DN}`)},
Author	SHA1	Message	Date
wmantly	79f1f62318	Merge pull request #100 from theta42/release/1.10.0 Bump jump-host to v1.7.0; release notes for the ldaps:// fix	2026-07-27 20:31:04 -04:00
wmantly	d8717fd613	Bump jump-host to v1.7.0; release notes for the ldaps:// fix Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-27 20:30:36 -04:00
wmantly	f8a213a3bf	Merge pull request #99 from theta42/fix/jump-host-ldap-tls Fix jump-host SSH login: point it at ldaps://, not ldap://	2026-07-27 20:11:28 -04:00
wmantly	f90d319eeb	Fix jump-host SSH login: point it at ldaps://, not ldap:// jump-secrets.js's ldap.url was 'ldap://sso-manager:389' with tlsOptions set. ldapts treats a non-empty tlsOptions as "use implicit TLS" regardless of URL scheme, so every LDAP connection from jump-host opened a raw TLS handshake against sso-manager's plaintext-LDAP port — slapd dropped the connection before any LDAP message parsed (visible in slapd.log as "connection lost" right after ACCEPT, no BIND ever logged). Every SSH login failed with a generic "Permission denied" for any account, any password — indistinguishable from a wrong credential. Root-caused by building a local theta-env stack, restarting jump-host with edited config, and calling userLdap.getUser/checkPassword directly inside the container: got "Client network socket disconnected before secure TLS connection was established" instead of a vague auth failure. Switching to ldaps://sso-manager:636 (already exposed by the same container, already what tlsOptions was meant for) fixes it — verified getUser/checkPassword succeed and a real SSH login authenticates. Companion defensive fix: simpleworkjs/ldap#1 (rejects this exact ldap://+tlsOptions combination going forward, for proxy/sso too). Existing deployments must edit their own ./config/jump-secrets.js (this template only affects fresh bootstraps) — see the PR description. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-27 20:10:58 -04:00