StartTLS settings not honored by NextCloud conf

[DavidePrincipi]

The account provider StartTLS flag configuration is ignored by our NextCloud configuration. We must honor it as clear text LDAP binds are unsecure and discouraged by MS AD.

If the remote AD account provider supports StartTLS or TLS wrap over port 636 we must use it to avoid sending clear-text passwords over the network. The following command (used by the accounts provider UI setup procedure) checks if TLS and StartTLS are available in the remote AD:

 /usr/sbin/account-provider-test probead <REALM> <IP_DNS> 

Proposed solution

Add a new e-smith DB prop that enables/disables enforcing of the sssd/StartTls prop value. The default value must be "not enforcing" to avoid changing the behavior of existing installations.

Starting from NS 7.9 we can switch to "enforcing" for new installations.

Existing installations can still upgrade to the new "enforcing" behavior manually.

Alternative solutions

No alternative has been considered.

See also

https://community.nethserver.org/t/nc-fails-when-installed-on-a-seperate-instance-which-is-joined-to-remote-ad/16749/13

[DavidePrincipi]

Test case 1

Check the old behavior is still enforced

• configure remote AD accounts provider
• install nextcloud from testing

Ensure StartTLS is always disabled, despite the SSSD configuration. Switch on/off the StartTLS checkbox in the account provider settings, and ensure ldapTLS is always 0.

occ ldap:show-config  s01 | grep ldapTLS

Test case 2

As in test case 1, but update an existing installation

Test case 3

Check the new behavior is enforced if nextcloud/HonorAdStartTls is enabled

• Change the prop value

  config setprop nextcloud HonorAdStartTls enabled
  

• Switch on/off the StartTLS checkbox in the account provider settings

The ldapTLS value must reflect the UI switch position:

    occ ldap:show-config  s01 | grep ldapTLS

[nethbot]

in 7.8.2003/testing:

• nethserver-nextcloud-1.14.1-1.2.gd813f83.ns7.noarch.rpm x86_64 armhfp aarch64

[gsanchietti]

All test cases have been verified: the configuration of ldapTLS option is changed only if HonorAdStartTls has been enabled.

[nethbot]

in 7.8.2003/updates:

• nethserver-nextcloud-1.14.2-1.ns7.noarch.rpm x86_64 armhfp aarch64