Browse Source

HUE-1065 [core] ldaps support in Hue

Add config to enable StartTLS
Using wrong parameters for LDAPS
Abraham Elmahrek 12 years ago
parent
commit
841fa9a5b8

+ 1 - 0
desktop/conf.dist/hue.ini

@@ -125,6 +125,7 @@
   # LDAP server certificate must be included among these certificates.
   # See more here http://www.openldap.org/doc/admin24/tls.html.
   ## ldap_cert=
+  ## use_start_tls=true
 
   # Distinguished name of the user to bind as -- not necessary if the LDAP server
   # supports anonymous searches

+ 1 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -134,6 +134,7 @@
   # LDAP server certificate must be included among these certificates.
   # See more here http://www.openldap.org/doc/admin24/tls.html.
   ## ldap_cert=
+  ## use_start_tls=true
 
   # Distinguished name of the user to bind as -- not necessary if the LDAP server
   # supports anonymous searches

+ 4 - 3
desktop/core/src/desktop/auth/backend.py

@@ -291,11 +291,12 @@ class LdapBackend(object):
 
     # Certificate-related config settings
     if desktop.conf.LDAP.LDAP_CERT.get():
-      ldap_settings.AUTH_LDAP_START_TLS = True
-      ldap_settings.AUTH_LDAP_GLOBAL_OPTIONS[ldap.OPT_X_TLS_CACERTFILE] = desktop.conf.LDAP.LDAP_CERT.get()
+      ldap_settings.AUTH_LDAP_START_TLS = desktop.conf.LDAP.USE_START_TLS.get()
+      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
+      ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, desktop.conf.LDAP.LDAP_CERT.get())
     else:
       ldap_settings.AUTH_LDAP_START_TLS = False
-      ldap_settings.AUTH_LDAP_GLOBAL_OPTIONS[ldap.OPT_X_TLS_REQUIRE_CERT] = ldap.OPT_X_TLS_NEVER
+      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
 
   def authenticate(self, username=None, password=None):
     # Do this check up here, because the auth call creates a django user upon first login per user

+ 4 - 0
desktop/core/src/desktop/conf.py

@@ -297,6 +297,10 @@ LDAP = ConfigSection(
     LDAP_URL=Config("ldap_url",
                      default=None,
                      help=_("The LDAP URL to connect to.")),
+    USE_START_TLS=Config("use_start_tls",
+                         default=True,
+                         type=coerce_bool,
+                         help=_("Use StartTLS when communicating with LDAP server.")),
     LDAP_CERT=Config("ldap_cert",
                      default=None,
                      help=_("A PEM-format file containing certificates for the CA's that Hue will trust for authentication over TLS. The certificate for the CA that signed the LDAP server certificate must be included among these certificates. See more here http://www.openldap.org/doc/admin24/tls.html.")),