瀏覽代碼

HUE-1065 [core] ldaps support in Hue

Add config to enable StartTLS
Using wrong parameters for LDAPS
Abraham Elmahrek 12 年之前
父節點
當前提交
841fa9a

+ 1 - 0
desktop/conf.dist/hue.ini

@@ -125,6 +125,7 @@
   # LDAP server certificate must be included among these certificates.
   # See more here http://www.openldap.org/doc/admin24/tls.html.
   ## ldap_cert=
+  ## use_start_tls=true
 
   # Distinguished name of the user to bind as -- not necessary if the LDAP server
   # supports anonymous searches

+ 1 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -134,6 +134,7 @@
   # LDAP server certificate must be included among these certificates.
   # See more here http://www.openldap.org/doc/admin24/tls.html.
   ## ldap_cert=
+  ## use_start_tls=true
 
   # Distinguished name of the user to bind as -- not necessary if the LDAP server
   # supports anonymous searches

+ 4 - 3
desktop/core/src/desktop/auth/backend.py

@@ -291,11 +291,12 @@ class LdapBackend(object):
 
     # Certificate-related config settings
     if desktop.conf.LDAP.LDAP_CERT.get():
-      ldap_settings.AUTH_LDAP_START_TLS = True
-      ldap_settings.AUTH_LDAP_GLOBAL_OPTIONS[ldap.OPT_X_TLS_CACERTFILE] = desktop.conf.LDAP.LDAP_CERT.get()
+      ldap_settings.AUTH_LDAP_START_TLS = desktop.conf.LDAP.USE_START_TLS.get()
+      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
+      ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, desktop.conf.LDAP.LDAP_CERT.get())
     else:
       ldap_settings.AUTH_LDAP_START_TLS = False
-      ldap_settings.AUTH_LDAP_GLOBAL_OPTIONS[ldap.OPT_X_TLS_REQUIRE_CERT] = ldap.OPT_X_TLS_NEVER
+      ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
 
   def authenticate(self, username=None, password=None):
     # Do this check up here, because the auth call creates a django user upon first login per user

+ 4 - 0
desktop/core/src/desktop/conf.py

@@ -297,6 +297,10 @@ LDAP = ConfigSection(
     LDAP_URL=Config("ldap_url",
                      default=None,
                      help=_("The LDAP URL to connect to.")),
+    USE_START_TLS=Config("use_start_tls",
+                         default=True,
+                         type=coerce_bool,
+                         help=_("Use StartTLS when communicating with LDAP server.")),
     LDAP_CERT=Config("ldap_cert",
                      default=None,
                      help=_("A PEM-format file containing certificates for the CA's that Hue will trust for authentication over TLS. The certificate for the CA that signed the LDAP server certificate must be included among these certificates. See more here http://www.openldap.org/doc/admin24/tls.html.")),