Browse Source

HUE-8170 [useradmin] Fix LDAP sync (ldap_access.py) certificate validation logic

Ben Gooley 7 years ago
parent
commit
399b5fd00a
1 changed files with 6 additions and 3 deletions
  1. 6 3
      apps/useradmin/src/useradmin/ldap_access.py

+ 6 - 3
apps/useradmin/src/useradmin/ldap_access.py

@@ -141,9 +141,12 @@ class LdapConnection(object):
     self._username = bind_user
     self._ldap_cert = cert_file
 
-    if cert_file is not None:
-      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
-      ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, cert_file)
+    # Certificate-related config settings
+    if ldap_config.LDAP_CERT.get():
+      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_DEMAND)
+      ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, ldap_config.LDAP_CERT.get())
+    else:
+      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
 
     if self.ldap_config.FOLLOW_REFERRALS.get():
       ldap.set_option(ldap.OPT_REFERRALS, 1)