tommy/mobilizon
1
0
Fork 0
forked from potsda.mn/mobilizon
Code Pull requests Activity

[LDAP] Allow to bind to an admin with a different FQDN

Browse source 
By directly providing the full DN

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel 2020-11-30 17:53:17 +01:00
parent bc8ea10bb0
commit 0f5941a046
No known key found for this signature in database
GPG key ID: A061B9DDE0CA0773
2 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
config/config.exs
View file

@ -146,6 +146,8 @@ config :mobilizon, :ldap,
base: System.get_env("LDAP_BASE") || "dc=example,dc=com", base: System.get_env("LDAP_BASE") || "dc=example,dc=com",
uid: System.get_env("LDAP_UID") || "cn", uid: System.get_env("LDAP_UID") || "cn",
require_bind_for_search: !(System.get_env("LDAP_REQUIRE_BIND_FOR_SEARCH") == "false"), require_bind_for_search: !(System.get_env("LDAP_REQUIRE_BIND_FOR_SEARCH") == "false"),
# Either the admin UID matching the field in `uid`,
# Either a tuple with the fully qualified DN: {:full, uid=admin,dc=example.com,dc=local}
bind_uid: System.get_env("LDAP_BIND_UID"), bind_uid: System.get_env("LDAP_BIND_UID"),
bind_password: System.get_env("LDAP_BIND_PASSWORD") bind_password: System.get_env("LDAP_BIND_PASSWORD")

9
lib/service/auth/ldap_authenticator.ex
View file

@ -97,6 +97,15 @@ defmodule Mobilizon.Service.Auth.LDAPAuthenticator do
end end
end end
# Bind user with full DN
@spec bind_user(any(), String.t(), String.t(), {:full, String.t()}, String.t()) ::
User.t() | any()
defp bind_user(connection, _base, _uid, {:full, field}, password) do
Logger.debug("Binding to LDAP with \"#{field}\"")
:eldap.simple_bind(connection, field, password)
end
# Bind user with only uid field on top of base
@spec bind_user(any(), String.t(), String.t(), String.t(), String.t()) :: @spec bind_user(any(), String.t(), String.t(), String.t(), String.t()) ::
User.t() | any() User.t() | any()
defp bind_user(connection, base, uid, field, password) do defp bind_user(connection, base, uid, field, password) do