Browse Source

[useradmin] Fix looking up ldap bind password

Erick Tryzelaar 10 years ago
parent
commit
108c8bad66

+ 1 - 1
apps/useradmin/src/useradmin/ldap_access.py

@@ -45,7 +45,7 @@ def get_connection(ldap_config):
 
   ldap_url = ldap_config.LDAP_URL.get()
   username = ldap_config.BIND_DN.get()
-  password = desktop.conf.get_ldap_password(ldap_config)
+  password = desktop.conf.get_ldap_bind_password(ldap_config)
   ldap_cert = ldap_config.LDAP_CERT.get()
   search_bind_authentication = ldap_config.SEARCH_BIND_AUTHENTICATION.get()
 

+ 68 - 0
apps/useradmin/src/useradmin/tests.py

@@ -19,11 +19,13 @@
 import json
 import ldap
 import re
+import sys
 import urllib
 
 from nose.plugins.attrib import attr
 from nose.tools import assert_true, assert_equal, assert_false
 
+import desktop.conf
 from desktop.lib.django_test_util import make_logged_in_client
 from django.contrib.auth.models import User, Group
 from django.utils.encoding import smart_unicode
@@ -34,6 +36,7 @@ from useradmin.models import HuePermission, GroupPermission, UserProfile
 from useradmin.models import get_profile, get_default_user_group
 
 import useradmin.conf
+import useradmin.ldap_access
 from hadoop import pseudo_hdfs4
 from useradmin.password_policy import reset_password_policy
 
@@ -721,3 +724,68 @@ def test_list_for_autocomplete():
   assert_equal(['test_list_for_autocomplete', 'test_list_for_autocomplete2'], users)
   assert_true('test_list_for_autocomplete' in groups, groups)
   assert_true('test_list_for_autocomplete_other_group' in groups, groups)
+
+class MockLdapConnection(object):
+  def __init__(self, ldap_config, ldap_url, username, password, ldap_cert):
+    self.ldap_config = ldap_config
+    self.ldap_url = ldap_url
+    self.username = username
+    self.password = password
+    self.ldap_cert = ldap_cert
+
+def test_get_connection_bind_password():
+  # Monkey patch the LdapConnection class as we don't want to make a real connection.
+  OriginalLdapConnection = useradmin.ldap_access.LdapConnection
+  reset = [
+      desktop.conf.LDAP.LDAP_URL.set_for_testing('default.example.com'),
+      desktop.conf.LDAP.BIND_PASSWORD.set_for_testing('default-password'),
+      desktop.conf.LDAP.LDAP_SERVERS.set_for_testing({
+        'test': {
+          'ldap_url': 'test.example.com',
+          'bind_password': 'test-password',
+        }
+      })
+  ]
+  try:
+    useradmin.ldap_access.LdapConnection = MockLdapConnection
+
+    connection = useradmin.ldap_access.get_connection_from_server()
+    assert_equal(connection.password, 'default-password')
+
+    connection = useradmin.ldap_access.get_connection_from_server('test')
+    assert_equal(connection.password, 'test-password')
+  finally:
+    useradmin.ldap_access.LdapConnection = OriginalLdapConnection
+    for f in reset:
+      f()
+
+def test_get_connection_bind_password_script():
+  SCRIPT = '%s -c "print \'\\n password from script \\n\'"' % sys.executable
+
+  # Monkey patch the LdapConnection class as we don't want to make a real connection.
+  OriginalLdapConnection = useradmin.ldap_access.LdapConnection
+  reset = [
+      desktop.conf.LDAP.LDAP_URL.set_for_testing('default.example.com'),
+      desktop.conf.LDAP.BIND_PASSWORD_SCRIPT.set_for_testing(
+        '%s -c "print \'\\n default password \\n\'"' % sys.executable
+      ),
+      desktop.conf.LDAP.LDAP_SERVERS.set_for_testing({
+        'test': {
+          'ldap_url': 'test.example.com',
+          'bind_password_script':
+            '%s -c "print \'\\n test password \\n\'"' % sys.executable,
+        }
+      })
+  ]
+  try:
+    useradmin.ldap_access.LdapConnection = MockLdapConnection
+
+    connection = useradmin.ldap_access.get_connection_from_server()
+    assert_equal(connection.password, ' default password ')
+
+    connection = useradmin.ldap_access.get_connection_from_server('test')
+    assert_equal(connection.password, ' test password ')
+  finally:
+    useradmin.ldap_access.LdapConnection = OriginalLdapConnection
+    for f in reset:
+      f()

+ 8 - 0
desktop/conf.dist/hue.ini

@@ -256,6 +256,10 @@
     # anonymous searches
     ## bind_password=
 
+    # Execute this script to produce the bind user password. This will be used
+    # when `bind_password` is not set.
+    ## bind_password_script=
+
     # Pattern for searching for usernames -- Use <username> for the parameter
     # For use when using LdapBackend for Hue authentication
     ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"
@@ -337,6 +341,10 @@
         # anonymous searches
         ## bind_password=
 
+        # Execute this script to produce the bind user password. This will be used
+        # when `bind_password` is not set.
+        ## bind_password_script=
+
         # Pattern for searching for usernames -- Use <username> for the parameter
         # For use when using LdapBackend for Hue authentication
         ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"

+ 8 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -259,6 +259,10 @@
     # anonymous searches
     ## bind_password=
 
+    # Execute this script to produce the bind user password. This will be used
+    # when `bind_password` is not set.
+    ## bind_password_script=
+
     # Pattern for searching for usernames -- Use <username> for the parameter
     # For use when using LdapBackend for Hue authentication
     ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"
@@ -340,6 +344,10 @@
         # anonymous searches
         ## bind_password=
 
+        # Execute this script to produce the bind user password. This will be used
+        # when `bind_password` is not set.
+        ## bind_password_script=
+
         # Pattern for searching for usernames -- Use <username> for the parameter
         # For use when using LdapBackend for Hue authentication
         ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"

+ 5 - 0
desktop/core/src/desktop/conf.py

@@ -669,6 +669,11 @@ LDAP = ConfigSection(
                    default=None,
                    private=True,
                    help=_("The password for the bind user.")),
+    BIND_PASSWORD_SCRIPT=Config("bind_password_script",
+                   default=None,
+                   private=True,
+                   type=coerce_password_from_script,
+                   help=_("Execute this script to produce the LDAP bind user password. This will be used when `bind_password` is not set.")),
     SEARCH_BIND_AUTHENTICATION=Config("search_bind_authentication",
                    default=True,
                    type=coerce_bool,