Merge lp:~matt.hall/endroid/ldap into lp:endroid

[Matthew Hall]

Enhance the ldapauth plugin to support LDAP directories that do not allow anonymous access.

Enhance the ldapauth plugin to support LDAP directories that do not allow anonymous access.

The Twisted ldaptor module, used by Endroid's ldapauth plugin, unfortunately doesn't already provide a suitable credential checker for this purpose, so we instead define one in the plugin. This is done by sub-classing ldaptor's existing checker, overriding the callback called once connected to the directory so that it skips the attempt to lookup the user's entry and instead proceeds straight to the authentication attempt (i.e. the LDAP bind.)

Skipping the entry look up means the name of the attribute forming the entry's relative distinguished name (e.g. "cn" or "name") must be provided to the checker some other way, so the plugin now supports an "identityrdn" config option.

[Phil Connell (pconnell)]

This is fine to go in to get things working, but strictly speaking it's a massive hack since it relies on internal details (e.g. _connect method and semantics) of ldaptor.

An ideal outcome would be getting a patch into ldaptor upstream to implement this within ldaptor: https://github.com/twisted/ldaptor

review: Approve

[Matthew Hall (matt.hall)]

> This is fine to go in to get things working, but strictly speaking it's a
> massive hack since it relies on internal details (e.g. _connect method and
> semantics) of ldaptor.
>
> An ideal outcome would be getting a patch into ldaptor upstream to implement
> this within ldaptor: https://github.com/twisted/ldaptor

Thanks, Phil. Yes, agreed it's a hack. Good point about submitting a patch to ldaptor; I'll try to do that over Xmas :-)

=== modified file 'src/endroid/plugins/ldapauth.py'
--- src/endroid/plugins/ldapauth.py	2014-04-05 11:42:51 +0000
+++ src/endroid/plugins/ldapauth.py	2015-12-20 12:23:42 +0000
@@ -3,7 +3,6 @@
 #
 
 from ldaptor import checkers, config
-from ldaptor.protocols.ldap import distinguishedname
 
 from endroid.pluginmanager import Plugin
 
@@ -11,7 +10,61 @@
     hidden = True
     name = "ldapauth"
     def http_cred_checker(self):
-        return checkers.LDAPBindingChecker(
-            config.LDAPConfig(','.join(self.vars.get("basedn")),
-            {','.join(self.vars.get("basedn")): (self.vars.get("ldaphost"),
-                                       int(self.vars.get("ldapport", 389)))}))
+        # Check whether we've been configured with the attribute forming the
+        # relative DN for identity entries within the directory and use the
+        # appropriate LDAP credential checker object.
+        rdn = self.vars.get("identityrdn")
+        if rdn:
+            return LDAPAuthedBindingChecker(
+                LDAPAuthedConfig(','.join(self.vars.get("basedn")),
+                                 {','.join(self.vars.get("basedn")):
+                                      (self.vars.get("ldaphost"),
+                                       int(self.vars.get("ldapport", 389)))},
+                                 identityRelativeDN=rdn))
+        else:
+            return checkers.LDAPBindingChecker(
+                config.LDAPConfig(','.join(self.vars.get("basedn")),
+                                  {','.join(self.vars.get("basedn")):
+                                       (self.vars.get("ldaphost"),
+                                        int(self.vars.get("ldapport", 389)))}))
+
+# Subclass the ldaptor package's LDAPBindingChecker with a variant that
+# supplies the user's credentials to the bind call; do this by overriding the
+# _connected callback method.
+#
+# On the assumption that this will be used when anonymous access to the LDAP
+# server is not allowed, the user's entry is not looked up before binding.
+# Instead the full distinguished name of the user is constructed from this
+# plugin's config.
+#
+# Also subclass LDAPConfig, so that we can attach an extra bit of config to
+# it.
+class LDAPAuthedBindingChecker(checkers.LDAPBindingChecker):
+    def _connected(self, client, filt, credentials):
+        d = client.bind(self.config.getIdentityDN(credentials.username),
+                        credentials.password)
+        d.addCallback(self._bound)
+        return d
+
+    def _bound(self, bindresult):
+        # Doesn't matter what we return here: it's never used.
+        return bindresult
+
+class LDAPAuthedConfig(config.LDAPConfig):
+    def __init__(self,
+                 baseDN=None,
+                 serviceLocationOverrides=None,
+                 identityBaseDN=None,
+                 identitySearch=None,
+                 identityRelativeDN="cn"):
+        super(LDAPAuthedConfig, self).__init__(baseDN,
+                                               serviceLocationOverrides,
+                                               identityBaseDN,
+                                               identitySearch)
+        self.identityRelativeDN = identityRelativeDN
+
+    def getIdentityDN(self, name):
+        return "{}={},{}".format(self.identityRelativeDN,
+                                 name,
+                                 str(self.getIdentityBaseDN()))
+