Ver Fonte

HUE-8821 [core] Fix Hue LDAP StartTLS implementation

In testing LDAPS SSL based setup, python ldap module does not need explicit start_tls operation it by default enables secure communication.
Prakash Ranade há 6 anos atrás
pai
commit
a64ddfc72c

+ 1 - 1
apps/useradmin/src/useradmin/ldap_access.py

@@ -157,7 +157,7 @@ class LdapConnection(object):
       ldap.set_option(ldap.OPT_DEBUG_LEVEL, ldap_config.DEBUG_LEVEL.get())
 
     self.ldap_handle = ldap.initialize(uri=ldap_url, trace_level=ldap_config.TRACE_LEVEL.get())
-    if self.ldap_config.USE_START_TLS.get():
+    if self.ldap_config.USE_START_TLS.get() and not ldap_url.lower().startswith('ldaps'):
       self.ldap_handle.start_tls_s()
 
     if bind_user:

+ 4 - 1
desktop/core/src/desktop/auth/backend.py

@@ -433,8 +433,11 @@ class LdapBackend(object):
         # %(user)s is a special string that will get replaced during the authentication process
         setattr(self._backend.settings, 'USER_DN_TEMPLATE', "%(user)s@" + nt_domain)
 
+    # If Secure ldaps is specified in hue.ini then ldap code automatically use SSL/TLS communication
+    if not ldap_url.lower().startswith('ldaps'):
+      setattr(self._backend.settings, 'START_TLS', ldap_config.USE_START_TLS.get())
+
     # Certificate-related config settings
-    setattr(self._backend.settings, 'START_TLS', ldap_config.USE_START_TLS.get())
     if ldap_config.LDAP_CERT.get():
       ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_DEMAND)
       ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, ldap_config.LDAP_CERT.get())