Use safer defaults for TLS verification on LDAP connections #2053
Conversation
|
Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes. |
|
This pull request fixes 9 alerts when merging 6c787c5 into f2109fc - view on LGTM.com fixed alerts:
|
rhafer
force-pushed
the
ldap-tls-inscure
branch
from
6c787c5 to
2759a8b
Compare
AFAICS those were the only remaining places where i was hardcoded. |
|
This pull request fixes 9 alerts when merging 2759a8b into f2109fc - view on LGTM.com fixed alerts:
|
|
Converted to draft for now. As I think this needs some adjustments in ocis. |
rhafer
force-pushed
the
ldap-tls-inscure
branch
from
2759a8b to
2b7410f
Compare
|
This pull request fixes 9 alerts when merging 2b7410f into 36d6211 - view on LGTM.com fixed alerts:
|
|
@rhafer please remove the draft state if you think is completed. |
The LDAP client connections were hardcoded to ignore certificate validation errors everywhere. This commit changes that to uses a secure default, which can be overridden by the new config parameter 'insecure'. Also the LDAP related test configs are updated to set that override for the tests.
This should reduce code duplication a bit. Currently this only handles the initial setup of the LDAP connection (e.g. the TLS parameters). Could be enhanced to also handle the initial authentication in the future.
This add a new configparameter "cacert" to allow to add trusted CAs and Server Certificates for the LDAP connections. This allows us to avoid using "insecure" when running against self-signed certificates. (As e.g. issued for glauth by default)
rhafer
force-pushed
the
ldap-tls-inscure
branch
from
2b7410f to
ee401dd
Compare
|
This pull request fixes 9 alerts when merging ee401dd into d04e363 - view on LGTM.com fixed alerts:
|
The LDAP client connections where hardcoded to ignore certificate validation
errors everywhere. This commit changes that to uses a secure default,
which can be overridden by the new config parameter 'insecure'.
Also the LDAP related test configs are updated to set that override for
the tests.