Преглед изворни кода

[core] LDAP backend should use search/bind semantics

Christopher Conner пре 12 година
родитељ
комит
0a8cd62a23

+ 1 - 10
apps/useradmin/src/useradmin/ldap_access.py

@@ -35,7 +35,6 @@ def get_connection():
     return CACHED_LDAP_CONN
 
   ldap_url = desktop.conf.LDAP.LDAP_URL.get()
-  nt_domain = desktop.conf.LDAP.NT_DOMAIN.get()
   username = desktop.conf.LDAP.BIND_DN.get()
   password = desktop.conf.LDAP.BIND_PASSWORD.get()
   ldap_cert = desktop.conf.LDAP.LDAP_CERT.get()
@@ -43,15 +42,7 @@ def get_connection():
   if ldap_url is None:
     raise Exception('No LDAP URL was specified')
 
-  return LdapConnection(ldap_url, get_ldap_username(username, nt_domain),
-                        password, ldap_cert)
-
-def get_ldap_username(username, nt_domain):
-  if nt_domain:
-    return '%s@%s' % (username, nt_domain)
-  else:
-    return username
-
+  return LdapConnection(ldap_url, username, password, ldap_cert)
 
 class LdapConnection(object):
   """

+ 0 - 7
desktop/conf.dist/hue.ini

@@ -120,9 +120,6 @@
     # The search base for finding users and groups
     ## base_dn="DC=mycompany,DC=com"
 
-    # The NT domain to connect to (only for use with Active Directory)
-    ## nt_domain=mycompany.com
-
     # URL of the LDAP server
     ## ldap_url=ldap://auth.mycompany.com
 
@@ -142,10 +139,6 @@
     # anonymous searches
     ## bind_password=
 
-    # Pattern for searching for usernames -- Use <username> for the parameter
-    # For use when using LdapBackend for Hue authentication
-    ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"
-
     # Create users in Hue when they try to login with their LDAP credentials
     # For use when using LdapBackend for Hue authentication
     ## create_users_on_login = true

+ 0 - 7
desktop/conf/pseudo-distributed.ini.tmpl

@@ -129,9 +129,6 @@
     # The search base for finding users and groups
     ## base_dn="DC=mycompany,DC=com"
 
-    # The NT domain to connect to (only for use with Active Directory)
-    ## nt_domain=mycompany.com
-
     # URL of the LDAP server
     ## ldap_url=ldap://auth.mycompany.com
 
@@ -151,10 +148,6 @@
     # anonymous searches
     ## bind_password=
 
-    # Pattern for searching for usernames -- Use <username> for the parameter
-    # For use when using LdapBackend for Hue authentication
-    ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"
-
     # Create users in Hue when they try to login with their LDAP credentials
     # For use when using LdapBackend for Hue authentication
     ## create_users_on_login = true

+ 15 - 8
desktop/core/src/desktop/auth/backend.py

@@ -41,6 +41,7 @@ from useradmin.views import import_ldap_users
 import pam
 from django_auth_ldap.backend import LDAPBackend, ldap_settings
 import ldap
+from django_auth_ldap.config import LDAPSearch
 
 
 LOG = logging.getLogger(__name__)
@@ -289,14 +290,20 @@ class LdapBackend(object):
       LOG.warn("Could not find LDAP URL required for authentication.")
       return None
 
-    nt_domain = desktop.conf.LDAP.NT_DOMAIN.get()
-    if nt_domain is None:
-      pattern = desktop.conf.LDAP.LDAP_USERNAME_PATTERN.get()
-      pattern = pattern.replace('<username>', '%(user)s')
-      ldap_settings.AUTH_LDAP_USER_DN_TEMPLATE = pattern
-    else:
-      # %(user)s is a special string that will get replaced during the authentication process
-      ldap_settings.AUTH_LDAP_USER_DN_TEMPLATE = "%(user)s@" + nt_domain
+    # New Search/Bind Auth
+    base_dn = desktop.conf.LDAP.BASE_DN.get()
+    user_name_attr = desktop.conf.LDAP.USERS.USER_NAME_ATTR.get()
+
+    if desktop.conf.LDAP.BIND_DN.get():
+      bind_dn = desktop.conf.LDAP.BIND_DN.get()
+      ldap_settings.AUTH_LDAP_BIND_DN = bind_dn
+      bind_password = desktop.conf.LDAP.BIND_PASSWORD.get()
+      ldap_settings.AUTH_LDAP_BIND_PASSWORD = bind_password
+
+    search_bind_results = LDAPSearch(base_dn,
+        ldap.SCOPE_SUBTREE, "(" + user_name_attr + "=%(user)s)")
+
+    ldap_settings.AUTH_LDAP_USER_SEARCH = search_bind_results
 
     # Certificate-related config settings
     if desktop.conf.LDAP.LDAP_CERT.get():

+ 7 - 24
desktop/core/src/desktop/conf.py

@@ -310,9 +310,6 @@ LDAP = ConfigSection(
     BASE_DN=Config("base_dn",
                    default=None,
                    help=_("The base LDAP distinguished name to use for LDAP search.")),
-    NT_DOMAIN=Config("nt_domain",
-                     default=None,
-                     help=_("The NT domain used for LDAP authentication.")),
     LDAP_URL=Config("ldap_url",
                      default=None,
                      help=_("The LDAP URL to connect to.")),
@@ -323,9 +320,6 @@ LDAP = ConfigSection(
     LDAP_CERT=Config("ldap_cert",
                      default=None,
                      help=_("A PEM-format file containing certificates for the CA's that Hue will trust for authentication over TLS. The certificate for the CA that signed the LDAP server certificate must be included among these certificates. See more here http://www.openldap.org/doc/admin24/tls.html.")),
-    LDAP_USERNAME_PATTERN=Config("ldap_username_pattern",
-                                 default=None,
-                                 help=_("A pattern to use for constructing LDAP usernames.")),
     BIND_DN=Config("bind_dn",
                    default=None,
                    help=_("The distinguished name to bind as, when importing from LDAP.")),
@@ -526,24 +520,13 @@ def config_validator(user):
     res.extend(validate_path(KERBEROS.KINIT_PATH, is_dir=False))
     res.extend(validate_path(KERBEROS.CCACHE_PATH, is_dir=False))
 
-  if LDAP.NT_DOMAIN.get() is not None or \
-      LDAP.LDAP_USERNAME_PATTERN.get() is not None:
-    if LDAP.LDAP_URL.get() is None:
-      res.append((LDAP.LDAP_URL,
-                  unicode(_("LDAP is only partially configured. An LDAP URL must be provided."))))
-
-  if LDAP.LDAP_URL.get() is not None:
-    if LDAP.NT_DOMAIN.get() is None and \
-        LDAP.LDAP_USERNAME_PATTERN.get() is None:
-      res.append((LDAP.LDAP_URL,
-                  unicode(_("LDAP is only partially configured. An NT Domain or username "
-                  "search pattern must be provided."))))
-
-  if LDAP.LDAP_USERNAME_PATTERN.get() is not None and \
-      '<username>' not in LDAP.LDAP_USERNAME_PATTERN.get():
-      res.append(LDAP.LDAP_USERNAME_PATTERN,
-                 unicode(_("The LDAP username pattern should contain the special"
-                 "<username> replacement string for authentication.")))
+  if LDAP.LDAP_URL.get() is None:
+    res.append((LDAP.LDAP_URL,
+                unicode(_("LDAP is only partially configured. An LDAP URL must be provided."))))
 
+  if LDAP.BIND_DN.get():
+    if LDAP.BIND_PASSWORD.get() is None:
+      res.append((LDAP.BIND_PASSWORD,
+                  unicode(_("If you set bind_dn, then you must set bind_password."))))
 
   return res