Skip to content

Commit 2759a8b

Browse files
rhaferrhafer
committed
Use safer defaults for TLS verification on LDAP connections
The LDAP client connections were hardcoded to ignore certificate validation errors everywhere. This commit changes that to uses a secure default, which can be overridden by the new config parameter 'insecure'. Also the LDAP related test configs are updated to set that override for the tests.
1 parent f2109fc commit 2759a8b

File tree

6 files changed

+25
-9
lines changed

6 files changed

+25
-9
lines changed

‎changelog/unreleased/ldap-tls-insecure.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Enhancement: Safer defaults for TLS verification on LDAP connections
2+
3+
The LDAP client connections where hardcoded to ignore certificate validation
4+
errors. Now verification is enable by default and a new config parameter 'insecure'
5+
is introduced to override that default.
6+
7+
https://github.com/cs3org/reva/pull/2053

‎pkg/auth/manager/ldap/ldap.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ type mgr struct {
5252
type config struct {
5353
Hostname string `mapstructure:"hostname"`
5454
Port int `mapstructure:"port"`
55+
Insecure bool `mapstructure:"insecure"`
5556
BaseDN string `mapstructure:"base_dn"`
5657
UserFilter string `mapstructure:"userfilter"`
5758
LoginFilter string `mapstructure:"loginfilter"`
@@ -138,7 +139,7 @@ func (am *mgr) Configure(m map[string]interface{}) error {
138139
func (am *mgr) Authenticate(ctx context.Context, clientID, clientSecret string) (*user.User, map[string]*authpb.Scope, error) {
139140
log := appctx.GetLogger(ctx)
140141

141-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", am.c.Hostname, am.c.Port), &tls.Config{InsecureSkipVerify: true})
142+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", am.c.Hostname, am.c.Port), &tls.Config{InsecureSkipVerify: am.c.Insecure})
142143
if err != nil {
143144
return nil, nil, err
144145
}

‎pkg/group/manager/ldap/ldap.go

+5-4
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ type manager struct {
5252
type config struct {
5353
Hostname string `mapstructure:"hostname"`
5454
Port int `mapstructure:"port"`
55+
Insecure bool `mapstructure:"insecure"`
5556
BaseDN string `mapstructure:"base_dn"`
5657
GroupFilter string `mapstructure:"groupfilter"`
5758
MemberFilter string `mapstructure:"memberfilter"`
@@ -134,7 +135,7 @@ func New(m map[string]interface{}) (group.Manager, error) {
134135

135136
func (m *manager) GetGroup(ctx context.Context, gid *grouppb.GroupId) (*grouppb.Group, error) {
136137
log := appctx.GetLogger(ctx)
137-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
138+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
138139
if err != nil {
139140
return nil, err
140141
}
@@ -211,7 +212,7 @@ func (m *manager) GetGroupByClaim(ctx context.Context, claim, value string) (*gr
211212
}
212213

213214
log := appctx.GetLogger(ctx)
214-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
215+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
215216
if err != nil {
216217
return nil, err
217218
}
@@ -269,7 +270,7 @@ func (m *manager) GetGroupByClaim(ctx context.Context, claim, value string) (*gr
269270
}
270271

271272
func (m *manager) FindGroups(ctx context.Context, query string) ([]*grouppb.Group, error) {
272-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
273+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
273274
if err != nil {
274275
return nil, err
275276
}
@@ -321,7 +322,7 @@ func (m *manager) FindGroups(ctx context.Context, query string) ([]*grouppb.Grou
321322
}
322323

323324
func (m *manager) GetMembers(ctx context.Context, gid *grouppb.GroupId) ([]*userpb.UserId, error) {
324-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
325+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
325326
if err != nil {
326327
return nil, err
327328
}

‎pkg/user/manager/ldap/ldap.go

+5-4
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ type manager struct {
5151
type config struct {
5252
Hostname string `mapstructure:"hostname"`
5353
Port int `mapstructure:"port"`
54+
Insecure bool `mapstructure:"insecure"`
5455
BaseDN string `mapstructure:"base_dn"`
5556
UserFilter string `mapstructure:"userfilter"`
5657
AttributeFilter string `mapstructure:"attributefilter"`
@@ -146,7 +147,7 @@ func (m *manager) Configure(ml map[string]interface{}) error {
146147

147148
func (m *manager) GetUser(ctx context.Context, uid *userpb.UserId) (*userpb.User, error) {
148149
log := appctx.GetLogger(ctx)
149-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
150+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
150151
if err != nil {
151152
return nil, err
152153
}
@@ -234,7 +235,7 @@ func (m *manager) GetUserByClaim(ctx context.Context, claim, value string) (*use
234235
}
235236

236237
log := appctx.GetLogger(ctx)
237-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
238+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
238239
if err != nil {
239240
return nil, err
240241
}
@@ -306,7 +307,7 @@ func (m *manager) GetUserByClaim(ctx context.Context, claim, value string) (*use
306307
}
307308

308309
func (m *manager) FindUsers(ctx context.Context, query string) ([]*userpb.User, error) {
309-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
310+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
310311
if err != nil {
311312
return nil, err
312313
}
@@ -376,7 +377,7 @@ func (m *manager) FindUsers(ctx context.Context, query string) ([]*userpb.User,
376377
}
377378

378379
func (m *manager) GetUserGroups(ctx context.Context, uid *userpb.UserId) ([]string, error) {
379-
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: true})
380+
l, err := ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", m.c.Hostname, m.c.Port), &tls.Config{InsecureSkipVerify: m.c.Insecure})
380381
if err != nil {
381382
return []string{}, err
382383
}

‎tests/oc-integration-tests/drone/ldap-users.toml

+3
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ auth_manager = "ldap"
1313
[grpc.services.authprovider.auth_managers.ldap]
1414
hostname="ldap"
1515
port=636
16+
insecure=true
1617
base_dn="dc=owncloud,dc=com"
1718
loginfilter="(&(objectclass=posixAccount)(|(cn={{login}}))(uid={{login}}))"
1819
bind_username="cn=admin,dc=owncloud,dc=com"
@@ -30,6 +31,7 @@ driver = "ldap"
3031
[grpc.services.userprovider.drivers.ldap]
3132
hostname="ldap"
3233
port=636
34+
insecure=true
3335
base_dn="dc=owncloud,dc=com"
3436
userfilter="(&(objectclass=posixAccount)(|(uid={{.OpaqueId}})(cn={{.OpaqueId}})))"
3537
findfilter="(&(objectclass=posixAccount)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))"
@@ -51,6 +53,7 @@ driver = "ldap"
5153
[grpc.services.groupprovider.drivers.ldap]
5254
hostname="ldap"
5355
port=636
56+
insecure=true
5457
base_dn="dc=owncloud,dc=com"
5558
groupfilter="(&(objectclass=posixGroup)(|(gid={{.OpaqueId}})(cn={{.OpaqueId}})))"
5659
findfilter="(&(objectclass=posixGroup)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))"

‎tests/oc-integration-tests/local/ldap-users.toml

+3
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ auth_manager = "ldap"
1313
[grpc.services.authprovider.auth_managers.ldap]
1414
hostname="localhost"
1515
port=636
16+
insecure=true
1617
base_dn="dc=owncloud,dc=com"
1718
loginfilter="(&(objectclass=posixAccount)(|(cn={{login}}))(uid={{login}}))"
1819
bind_username="cn=admin,dc=owncloud,dc=com"
@@ -30,6 +31,7 @@ driver = "ldap"
3031
[grpc.services.userprovider.drivers.ldap]
3132
hostname="localhost"
3233
port=636
34+
insecure=true
3335
base_dn="dc=owncloud,dc=com"
3436
userfilter="(&(objectclass=posixAccount)(|(uid={{.OpaqueId}})(cn={{.OpaqueId}})))"
3537
findfilter="(&(objectclass=posixAccount)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))"
@@ -51,6 +53,7 @@ driver = "ldap"
5153
[grpc.services.groupprovider.drivers.ldap]
5254
hostname="localhost"
5355
port=636
56+
insecure=true
5457
base_dn="dc=owncloud,dc=com"
5558
groupfilter="(&(objectclass=posixGroup)(|(gid={{.OpaqueId}})(cn={{.OpaqueId}})))"
5659
findfilter="(&(objectclass=posixGroup)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))"

0 commit comments

Comments
 (0)