Browse Source

[core] LDAP search bind authentication should be at server record level

Abraham Elmahrek 11 năm trước cách đây
mục cha
commit
f795a9f2ff

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -259,6 +259,9 @@
         # For use when using LdapBackend for Hue authentication
         ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"
 
+        ## Use search bind authentication.
+        ## search_bind_authentication=true
+
         ## [[[[[users]]]]]
 
           # Base filter for searching for users

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -266,6 +266,9 @@
         # For use when using LdapBackend for Hue authentication
         ## ldap_username_pattern="uid=<username>,ou=People,dc=mycompany,dc=com"
 
+        ## Use search bind authentication.
+        ## search_bind_authentication=true
+
         ## [[[[[users]]]]]
 
           # Base filter for searching for users

+ 1 - 1
desktop/core/src/desktop/auth/backend.py

@@ -330,7 +330,7 @@ class LdapBackend(object):
     else:
       setattr(self._backend.settings, 'SERVER_URI', ldap_config.LDAP_URL.get())
 
-    if desktop.conf.LDAP.SEARCH_BIND_AUTHENTICATION.get():
+    if ldap_config.SEARCH_BIND_AUTHENTICATION.get():
       # New Search/Bind Auth
       base_dn = ldap_config.BASE_DN.get()
       user_name_attr = ldap_config.USERS.USER_NAME_ATTR.get()

+ 39 - 37
desktop/core/src/desktop/conf.py

@@ -453,39 +453,6 @@ LDAP = ConfigSection(
       type=int,
       default=10),
 
-    USERS = ConfigSection(
-      key="users",
-      help=_("Configuration for LDAP user schema and search."),
-      members=dict(
-        USER_FILTER=Config("user_filter",
-                           default="objectclass=*",
-                           help=_("A base filter for use when searching for users.")),
-        USER_NAME_ATTR=Config("user_name_attr",
-                              default="sAMAccountName",
-                              help=_("The username attribute in the LDAP schema. "
-                                   "Typically, this is 'sAMAccountName' for AD and 'uid' "
-                                   "for other LDAP systems.")),
-      )
-    ),
-
-    GROUPS = ConfigSection(
-      key="groups",
-      help=_("Configuration for LDAP group schema and search."),
-      members=dict(
-        GROUP_FILTER=Config("group_filter",
-                           default="objectclass=*",
-                           help=_("A base filter for use when searching for groups.")),
-        GROUP_NAME_ATTR=Config("group_name_attr",
-                              default="cn",
-                              help=_("The group name attribute in the LDAP schema. "
-                                  "Typically, this is 'cn'.")),
-        GROUP_MEMBER_ATTR=Config("group_member_attr",
-                                 default="member",
-                                 help=_("The LDAP attribute which specifies the "
-                                      "members of a group.")),
-      )
-    ),
-
     LDAP_SERVERS = UnspecifiedConfigSection(
       key="ldap_servers",
       help=_("LDAP server record."),
@@ -514,9 +481,13 @@ LDAP = ConfigSection(
                          default=None,
                          help=_("The distinguished name to bind as, when importing from LDAP.")),
           BIND_PASSWORD=Config("bind_password",
-                         default=None,
-                         private=True,
-                         help=_("The password for the bind user.")),
+                               default=None,
+                               private=True,
+                               help=_("The password for the bind user.")),
+          SEARCH_BIND_AUTHENTICATION=Config("search_bind_authentication",
+                                            default=True,
+                                            type=coerce_bool,
+                                            help=_("Use search bind authentication.")),
 
           USERS = ConfigSection(
             key="users",
@@ -580,7 +551,38 @@ LDAP = ConfigSection(
     SEARCH_BIND_AUTHENTICATION=Config("search_bind_authentication",
                    default=True,
                    type=coerce_bool,
-                   help=_("Use search bind authentication."))))
+                   help=_("Use search bind authentication.")),
+
+    USERS = ConfigSection(
+      key="users",
+      help=_("Configuration for LDAP user schema and search."),
+      members=dict(
+        USER_FILTER=Config("user_filter",
+                           default="objectclass=*",
+                           help=_("A base filter for use when searching for users.")),
+        USER_NAME_ATTR=Config("user_name_attr",
+                              default="sAMAccountName",
+                              help=_("The username attribute in the LDAP schema. "
+                                   "Typically, this is 'sAMAccountName' for AD and 'uid' "
+                                   "for other LDAP systems.")),
+      )),
+
+    GROUPS = ConfigSection(
+      key="groups",
+      help=_("Configuration for LDAP group schema and search."),
+      members=dict(
+        GROUP_FILTER=Config("group_filter",
+                           default="objectclass=*",
+                           help=_("A base filter for use when searching for groups.")),
+        GROUP_NAME_ATTR=Config("group_name_attr",
+                              default="cn",
+                              help=_("The group name attribute in the LDAP schema. "
+                                  "Typically, this is 'cn'.")),
+        GROUP_MEMBER_ATTR=Config("group_member_attr",
+                                 default="member",
+                                 help=_("The LDAP attribute which specifies the "
+                                      "members of a group.")),
+      ))))
 
 
 OAUTH = ConfigSection(