LDAP via simple auth separate bind user and search base #5055
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
change templates so user base shows on simple LDAP new and edit forms Signed-off-by: Tony Homrich <[email protected]>
Pull BindDN code out of findUserDN function so it is more universal. It is only called once so the bind now occurs just before the call. Signed-off-by: Tony Homrich <[email protected]>
if UserBase is set for a simple LDAP auth then use it to find the full UserDN This allows AD users who bind using a special format like domain\user or user@domain and need the fully qualified UserDN Signed-off-by: Tony Homrich <[email protected]>
allow user_base to be required on BindDN LDAP but not simple auth LDAP
Codecov Report
@@ Coverage Diff @@
## master #5055 +/- ##
==========================================
+ Coverage 37.51% 37.53% +0.01%
==========================================
Files 322 322
Lines 47307 47323 +16
==========================================
+ Hits 17748 17761 +13
- Misses 27008 27014 +6
+ Partials 2551 2548 -3
Continue to review full report at Codecov.
|
bkcsoft
added
the
lgtm/need 2
lafriks
approved these changes
Dec 27, 2018
bkcsoft
added
lgtm/need 1
zeripath
approved these changes
Dec 27, 2018
bkcsoft
added
lgtm/done
|
@tenacubus Would it be possible to create a PR to update the documentation for LDAP to match your changes - and explain when the user_base field is required and what it should be? (Or update this PR) |
|
The file is |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #3048
If you're using Active Directory and need to bind using the format [email protected] or DOMAIN\user LDAP simple auth will fail. The problem is that UserDN setting we bind on is also used for the search base and it's not a qualified DN.
To solve this I added the User Search Base field previously only on LDAP via BindDN to the simple auth as well. If you have a setting in this field on simple auth it will use that as the LDAP search base instead of the UserDN.
It works but I'm not a huge fan of my code to have User Search Base only required for BindDN but not simple auth. If somebody has suggestions for how to do it cleanly I'm open. The existing classes and js didn't have a good way for a field to be in both but only required in one.