Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support ldap login with start tls #267

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ccl0326
Copy link

@ccl0326 ccl0326 commented Sep 12, 2017

as title.

@@ -10,16 +10,21 @@ class Authenticator:
def __init__(self, config):
root = os.path.abspath('./')
self.ldap_url = config['auth']['ldap_url']
self.cert_path = os.path.join(root, config['auth']['ldap_cert_path'])
self.start_tls = config['auth']['start_tls']
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you update the sample config to add the new usage of this?

self.user_suffix = config['auth']['ldap_user_suffix']
self.authenticate = self.ldap_auth
if config.get('debug'):
self.authenticate = self.debug_auth

def ldap_auth(self, username, password):
ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.cert_path)
if not self.start_tls:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is start tls mutually exclusive with passing a cacert file?

@@ -10,16 +10,21 @@ class Authenticator:
def __init__(self, config):
root = os.path.abspath('./')
self.ldap_url = config['auth']['ldap_url']
self.cert_path = os.path.join(root, config['auth']['ldap_cert_path'])
self.start_tls = config['auth']['start_tls']
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Switch to config['auth'].get('start_tls') to maintain existing behavior without need for config change

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

^ agreed :)

@baryluk
Copy link
Contributor

baryluk commented Nov 3, 2021

I can pick this up and address the remaining issues. I agree, it should use .get() so it works with existing config.

I also would like an option to ignore server certs / name. I have a prototype code to do that.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants