IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Use new LDAPClient constructors

Browse Source 
Replace get_ldap_uri() + LDAPClient() with new LDAPClient constructors
like LDAPClient.from_realm().

Some places now use LDAPI with external bind instead of LDAP with simple
bind. Although the FQDN *should* resolve to 127.0.0.1 / [::1], there is
no hard guarantee. The draft
https://tools.ietf.org/html/draft-west-let-localhost-be-localhost-04#section-5.1
specifies that applications must verify that the resulting IP is a
loopback API. LDAPI is always local and a bit more efficient, too.

The simple_bind() method also prevents the caller from sending a
password over an insecure line.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2018-11-30 10:28:32 +01:00
committed by Rob Crittenden
parent 5be9341fba
commit a3934a211d
12 changed files with 55 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
install/migration/migration.py
View File

@@ -54,8 +54,11 @@ def bind(ldap_uri, base_dn, username, password):
logger.error('migration unable to get base dn')
raise IOError(errno.EIO, 'Cannot get Base DN')
bind_dn = DN(('uid', username), ('cn', 'users'), ('cn', 'accounts'), base_dn)
# ldap_uri should be ldapi:// in all common cases. Enforce start_tls just
# in case it's a plain LDAP connection.
start_tls = ldap_uri.startswith('ldap://')
try:
conn = ipaldap.LDAPClient(ldap_uri)
conn = ipaldap.LDAPClient(ldap_uri, start_tls=start_tls)
conn.simple_bind(bind_dn, password)
except (errors.ACIError, errors.DatabaseError, errors.NotFound) as e:
logger.error(