Attachment 9695 Details for Bug 47932

[patch] Simple_AD_Connection.patch

Simple_AD_Connection.patch (text/plain), 3.98 KB, created by Felix Botner on 2018-10-09 11:38 CEST

(hide)

Description:

Filename:

MIME Type:

Creator: Felix Botner

Created: 2018-10-09 11:38 CEST

Size: 3.98 KB

patch

obsolete

>diff --git a/services/univention-ad-connector/modules/univention/connector/ad/__init__.py b/services/univention-ad-connector/modules/univention/connector/ad/__init__.py
>index 2e479cb..2d3dbec 100644
>--- a/services/univention-ad-connector/modules/univention/connector/ad/__init__.py
>+++ b/services/univention-ad-connector/modules/univention/connector/ad/__init__.py
>@@ -756,7 +756,7 @@ def format_escaped(format_string, *args, **kwargs):
> 	"""
> 	return LDAPEscapeFormatter().format(format_string, *args, **kwargs)
> 
>-class Simple_AD_Connection():
>+class Simple_AD_Connection(object):
> 
> 	''' stripped down univention.connector.ad.ad class
> 		difference: accept "bindpwd" directly instead of "bindpw" filename
>@@ -765,6 +765,22 @@ class Simple_AD_Connection():
> 		difference: don't use TLS
> 	'''
> 
>+	def bind_sasl_gssapi(self, binddn, bindpw, access):
>+		ENV_KRB5CCNAME = 'KRB5CCNAME'
>+		princ = binddn
>+		if ldap.dn.is_dn(princ):
>+			princ = ldap.dn.str2dn(princ)[0][0][1]
>+		os.environ[ENV_KRB5CCNAME] = '/var/cache/univention-ad-connector/krb5.cc.well'
>+		with NamedTemporaryFile('w') as tmp_file:
>+			tmp_file.write(bindpw)
>+			tmp_file.flush()
>+			cmd_block = ['kinit', '--no-addresses', '--password-file=%s' % tmp_file.name, princ]
>+			p1 = subprocess.Popen(cmd_block, close_fds=True)
>+			stdout, stderr = p1.communicate()
>+			auth = ldap.sasl.gssapi("")
>+			access.lo.sasl_interactive_bind_s("", auth)
>+		return access
>+
> 	def __init__(self, CONFIGBASENAME, ucr, host, port, base, binddn, bindpw, certificate):
> 
> 		self.CONFIGBASENAME = CONFIGBASENAME
>@@ -776,37 +792,27 @@ class Simple_AD_Connection():
> 		self.bindpw = bindpw
> 		self.certificate = certificate
> 		self.ucr = ucr
>-		self.protocol = 'ldaps' if ucr.is_true('%s/ad/ldap/ldaps' % CONFIGBASENAME, False) else 'ldap'
>-		self.uri = "%s://%s:%d" % (self.protocol, self.host, int(self.port))
>-
>-		if self.certificate:
>-			ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.certificate)
>-
>-		#ldap.set_option(ldap.OPT_DEBUG_LEVEL, 4095)
>-		#ldap._trace_level = 9
>-		#ldap.set_option(ldap.OPT_X_SASL_SSF_MIN, 1)
>-		#ldap.set_option(ldap.OPT_X_SASL_SECPROPS, "minssf=1")
>-
>-		self.lo = ldap.ldapobject.ReconnectLDAPObject(self.uri, retry_max=10, retry_delay=1)
>-
>+		self.ldaps = self.ucr.is_true('%s/ad/ldap/ldaps' % self.CONFIGBASENAME, False)
>+
>+		access = univention.uldap.access(
>+			host=self.host,
>+			port=int(self.port),
>+			base=self.base,
>+			binddn=None,
>+			bindpw=None,
>+			start_tls=0,
>+			use_ldaps=self.ldaps,
>+			ca_certfile=self.certificate,
>+			follow_referral=True,
>+			decode_ignorelist=['objectSid', 'objectGUID', 'repsFrom', 'replUpToDateVector', 'ipsecData', 'logonHours', 'userCertificate', 'dNSProperty', 'dnsRecord', 'member'])
>+
>+		# TODO move sasl/gssapi ldap authentication to uldap.access
> 		if ucr.is_true('%s/ad/ldap/kerberos' % CONFIGBASENAME):
>-			princ = self.binddn
>-			if ldap.dn.is_dn(self.binddn):
>-				princ = ldap.dn.str2dn(self.binddn)[0][0][1]
>-			os.environ['KRB5CCNAME'] = '/var/cache/univention-ad-connector/krb5.cc.well'
>-			with NamedTemporaryFile('w') as tmp_file:
>-				tmp_file.write(self.bindpw)
>-				tmp_file.flush()
>-				cmd_block = ['kinit', '--no-addresses', '--password-file=%s' % tmp_file.name, princ]
>-				p1 = subprocess.Popen(cmd_block, close_fds=True)
>-				stdout, stderr = p1.communicate()
>-				auth = ldap.sasl.gssapi("")
>-				self.lo.sasl_interactive_bind_s("", auth)
>+			access = self.bind_sasl_gssapi(self.binddn, self.bindpw, access)
> 		else:
>-			self.lo.simple_bind_s(self.binddn, self.bindpw)
>-
>-		self.lo.set_option(ldap.OPT_REFERRALS, 0)
>+			access.bind(self.binddn, self.bindpw)
> 
>+		self.lo = access.lo
> 		self.ad_sid = None
> 		result = self.lo.search_ext_s(self.base, ldap.SCOPE_BASE, 'objectclass=domain', ['objectSid'], timeout=-1, sizelimit=0)
> 		if 'objectSid' in result[0][1]:
>diff --git a/test/ucs-ec2-tools b/test/ucs-ec2-tools
>index 755b752..612aa4a 160000
>--- a/test/ucs-ec2-tools
>+++ b/test/ucs-ec2-tools
>@@ -1 +1 @@
>-Subproject commit 755b752d461b62ba29666294762e04f00ea9a74f
>+Subproject commit 612aa4a35d7ee61d9a57b4102981d8444bdcb22e

Actions: View | Diff

Attachments on bug 47932: 9695 | 10608