puppetlabs/vmpooler
2
0
Fork 0
mirror of https://github.com/puppetlabs/vmpooler.git synced 2026-01-26 10:08:40 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

(DIO-2621) Make LDAP encryption configurable

Browse source 
Prior to this, the encryption settings for LDAP auth were hard coded to
start_tls on port 389 with TLSv1. These are still the defaults, as
insecure as they are, so as to not break existing users. This change
facilitates replacing the defaults so that simple_tls over port 636 via
TLS1.2 can be used.
This commit is contained in:
Gene Liverman 2021-09-14 15:01:05 -04:00
parent 5f0d41412c
commit 5cd7658ab4
No known key found for this signature in database
GPG key ID: 3AF83985B6C857C6
4 changed files with 123 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/vmpooler/api/helpers.rb
View file

@ -56,14 +56,11 @@ module Vmpooler
return false
end
def authenticate_ldap(port, host, user_object, base, username_str, password_str)
def authenticate_ldap(port, host, encryption_hash, user_object, base, username_str, password_str)
ldap = Net::LDAP.new(
:host => host,
:port => port,
:encryption => {
:method => :start_tls,
:tls_options => { :ssl_version => 'TLSv1' }
},
:encryption => encryption_hash,
:base => base,
:auth => {
:method => :simple,
@ -86,6 +83,10 @@ module Vmpooler
ldap_port = auth[:ldap]['port'] || 389
ldap_user_obj = auth[:ldap]['user_object']
ldap_host = auth[:ldap]['host']
ldap_encryption_hash = auth[:ldap]['encryption'] || {
:method => :start_tls,
:tls_options => { :ssl_version => 'TLSv1' }
}
unless ldap_base.is_a? Array
ldap_base = ldap_base.split
@ -100,6 +101,7 @@ module Vmpooler
result = authenticate_ldap(
ldap_port,
ldap_host,
ldap_encryption_hash,
search_user_obj,
search_base,
username_str,