Skip to content
This repository has been archived by the owner on Sep 9, 2024. It is now read-only.

Support authn-ldap #411

Merged
merged 1 commit into from
Jun 23, 2022
Merged

Support authn-ldap #411

merged 1 commit into from
Jun 23, 2022

Conversation

szh
Copy link
Contributor

@szh szh commented Jun 1, 2022 •
edited
Loading

Depends on #410, cyberark/conjur-api-python#23

Desired Outcome

The conjur init command should support LDAP authentication. It should be possible to specify the authentication type using the
-t or --authn-type option. The default value should be authn (same as current), and it should additionally support ldap.
When using ldap, a --service-id option should be mandatory.
If the --service-id option is specified, then --authn-type should default to ldap.

The CLI implementation should be straightforward. It needs to support the new CLI arguments in the init command,
and it will need to pass them to the conjur-api-python library.

Create new and update existing unit and integration tests.

Implemented Changes

  • Updated README.md to state that the project is at the Community certification level, reflecting the lack of adequate testing in this and the cyberark/conjur-api-python repository which it depends on.

Connected Issue/Story

Resolves #264, #324

CyberArk internal issue link: ONYX-20431

Definition of Done

  • conjur init supports --authn-type and --service-id parameters

Changelog

  • The CHANGELOG has been updated, or
  • This PR does not include user-facing changes and doesn't require a
    CHANGELOG update

Test coverage

  • This PR includes new unit and integration tests to go with the code
    changes, or
  • The changes in this PR do not require tests

Documentation

  • Docs (e.g. READMEs) were updated in this PR
  • A follow-up issue to update official docs has been filed here: insert issue ID
  • This PR does not require updating any documentation

Behavior

  • This PR changes product behavior and has been reviewed by a PO, or
  • These changes are part of a larger initiative that will be reviewed later, or
  • No behavior was changed with this PR

Security

  • Security architect has reviewed the changes in this PR,
  • These changes are part of a larger initiative with a separate security review, or
  • There are no security aspects to these changes

@szh szh self-assigned this Jun 1, 2022
@szh szh force-pushed the authn-ldap branch 13 times, most recently from 6a86d5c to d005641 Compare June 3, 2022 18:12
@szh szh changed the title WIP: Authn ldap Support authn-ldap Jun 3, 2022
@szh szh mentioned this pull request Jun 3, 2022
Closed
4 tasks
@szh szh force-pushed the authn-ldap branch 2 times, most recently from f65ad41 to 485afae Compare June 3, 2022 18:31
@szh szh force-pushed the authn-ldap branch 7 times, most recently from 9b9b3d5 to 6734311 Compare June 9, 2022 16:39
@szh
Copy link
Contributor Author

szh commented Jun 9, 2022

@jdumas I'd love to hear your input on this since you were the one behind #324. Does this solve your use case? Are you able to test this locally and see if it works for you?

@szh szh marked this pull request as ready for review June 9, 2022 17:11
@szh szh requested a review from a team as a code owner June 9, 2022 17:11
@jdumas
Copy link

jdumas commented Jun 9, 2022

Sorry I'm not using Conjur much these days, so I won't be able to test this for a while :(

@szh szh force-pushed the authn-ldap branch 4 times, most recently from 5be2805 to ecf7204 Compare June 15, 2022 18:44
@szh szh mentioned this pull request Jun 16, 2022
Merged
13 tasks
@szh szh requested a review from rpothier June 22, 2022 17:45
rpothier
rpothier reviewed Jun 23, 2022
View reviewed changes
Copy link
Contributor

@rpothier rpothier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! Just a couple questions.

conjur/data_object/conjurrc_data.py
@@ -5,33 +5,40 @@

This module represents an object that holds conjurrc data
"""
# pylint: disable=too-few-public-methods
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is pylint run on these files?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. It was listing an error which is why I added this ignore statement.

docker-compose.yml
@@ -64,6 +71,25 @@ services:
- conjur
- conjur-https

ldap-server:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems like a lot of duplication with github.com/cyberark/conjur-api-python/pull/22,
Is there any around the duplication? or is this just something from splitting up the repos

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True. This sets up a test environment with an ldap server the same way the cyberark/conjur-api-python#22 does. But the tests it runs are different. The ones in the api repo test the API functions by themselves, while the ones in this PR test them E2E in the CLI.

test/test_config/ldap/ldap.ldif
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: top
userPassword: ldapuser
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do these ldif files prefer no newline?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question, I don't know. Probably doesn't matter.

rpothier
rpothier previously approved these changes Jun 23, 2022
View reviewed changes
Copy link
Contributor

@rpothier rpothier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Just saw one tiny formatting thing, but I don't want to stop this commit because of it.

@szh szh merged commit dc6c634 into main Jun 23, 2022
@szh szh deleted the authn-ldap branch June 23, 2022 19:47
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@rpothier rpothier rpothier approved these changes

Assignees

@szh szh

Labels
kind/enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

LDAP authentication
3 participants
@szh @jdumas @rpothier