Added patch for connecting to AD-server with self-signed certificates. #24115

rickyosser · 2019-03-07T16:13:50Z

Pull Request for Issue # .

Summary of Changes

Added patches for connecting to AD-server with self-signed certificates.

Testing Instructions

Just install and enable the Ignore Certificate option.

Expected result

Working authentication using TLS/LDAPS with servers that are configured with self-signed certificates. For example recent SAMBA4.

Actual result

Working authentication using TLS/LDAPS with servers that are configured with self-signed certificates. For example recent SAMBA4.

Documentation Changes Required

Option:
"Ignore Certificate"
Desc:
When enabled ignore the server certificate, this is useful when running for example Samba 4 with a self-signed certificate.

Quy · 2019-03-07T18:37:42Z

libraries/vendor/joomla/ldap/src/LdapClient.php

+ 		{ 
+		        putenv('LDAPTLS_REQCERT=never');
+		}
+


Remove tabs.

I removed the spaces.
Hmm, emacs acting up. php-mode seems to default to PEAR-style. Which uses spaces.

HLeithner

Please change the language keys to match the field name, atm the key says the opposite then the description.

administrator/language/en-GB/en-GB.plg_authentication_ldap.ini

plugins/authentication/ldap/ldap.xml

…D_IGNORE_REQCERT_TLS*.

…nto self-signed-cert

HLeithner · 2019-03-08T09:50:50Z

Now we need 2 testers...

brianteeman · 2019-03-08T10:18:54Z

@HLeithner it is very unlikely that we will get 2 testers for this as it is very specialised and not used often. I suspect the only option is to code review

HLeithner · 2019-03-08T10:21:33Z

Yeah I have the same feeling

HLeithner · 2019-03-08T10:22:11Z

Would you at least test if the plugin screen doesn't break?

brianteeman · 2019-03-08T10:27:02Z

Tested and the screen doesnt break. Not sure if debug should be the very first option. But I have never used LDAP authentication so dont know if it is important or not

HLeithner · 2019-03-08T10:37:29Z

It's the first? request for this feature ;-) so properly the first position is not perfect....

I would suggest moving debug to the last option and the tls thing before debug.

Quy · 2019-03-08T12:29:32Z

administrator/language/en-GB/en-GB.plg_authentication_ldap.ini

@@ -16,6 +16,10 @@ PLG_LDAP_FIELD_HOST_DESC="Eg: openldap.example.com."
 PLG_LDAP_FIELD_HOST_LABEL="Host"
 PLG_LDAP_FIELD_NEGOCIATE_DESC="Negotiate TLS encryption with the LDAP server. This requires all traffic to and from the LDAP server to be encrypted."
 PLG_LDAP_FIELD_NEGOCIATE_LABEL="Negotiate TLS"
+PLG_LDAP_FIELD_LDAPDEBUG_DESC="Enables debug hardcoded to level 7"


Please sort keys in alpha order.

It's the first? request for this feature ;-) so properly the first position is not perfect....

I would suggest moving debug to the last option and the tls thing before debug.

I moved the debug option to last but the Ignore certificate is closely connected to enabling TLS and thus should be the next option.

It should still be sorted in alpha order.

Check the file after last nights commit 224ec41, the file is in order.

Quy · 2019-03-08T12:31:02Z

libraries/vendor/joomla/ldap/src/LdapClient.php

+	 * Ignore TLS Certificate (encrypted communications)
+         *
+         * @var    boolean
+         * @since  1.0


Suggested change

* @since 1.0

* @since __DEPLOY_VERSION__

Quy · 2019-03-08T12:31:10Z

libraries/vendor/joomla/ldap/src/LdapClient.php

+	 * Enable LDAP debug (encrypted communications)
+         *
+         * @var    boolean
+         * @since  1.0


Suggested change

* @since 1.0

* @since __DEPLOY_VERSION__

mbabker · 2019-03-08T13:32:13Z

A Composer dependency is changed without having updated the lock file. That should be a red flag to somebody...

HLeithner · 2019-03-08T13:47:59Z

So good that you are here^^

@rickyosser parts of the PR have to be made against https://github.com/joomla-framework/ldap/blob/master/src/LdapClient.php

…n list. And fixed so it says __DEPLOY_VERSION__

…nto self-signed-cert

rickyosser · 2019-03-09T23:43:39Z

A Composer dependency is changed without having updated the lock file. That should be a red flag to somebody...

Can you please point to where the composer dependency would change, I'm looking at the diff-file I originally created and it closeley looks like the git PR I'm trying to create. It only touches 3 files and none of them is a Composer control-file.

brianteeman · 2019-03-09T23:54:54Z

It is this file libraries/vendor/joomla/ldap/src/LdapClient.php
which should be made against https://github.com/joomla-framework/ldap/blob/master/src/LdapClient.php

rickyosser · 2019-03-10T00:06:07Z

So good that you are here^^

@rickyosser parts of the PR have to be made against https://github.com/joomla-framework/ldap/blob/master/src/LdapClient.php

@brianteeman and @HLeithner , I've created a pull request in the LDAP tree for the changes in that file.
Sorry for not knowing the structure of the Joomla development project. I created some patches to solve a real customer case and thought it would be good to add them upstream so future upgrades will be seamless.

Anyway this problem is relatively new as the security hardening of SAMBA4 and the openldap-client library have been made in the last year/years.

rickyosser · 2019-03-10T19:52:29Z

My PR joomla-framework/ldap@c7e30ce has been accepted in joomla-framework/ldap, what do you need me to do here now?

HLeithner · 2019-03-10T20:17:44Z

Remove the changes in the ldapclient file, I will update the lib after releasing 3.9.4.

rickyosser · 2019-03-10T21:51:05Z

Remove the changes in the ldapclient file, I will update the lib after releasing 3.9.4.

@HLeithner, the file is now reverted.

Quy · 2019-04-11T14:18:45Z

administrator/language/en-GB/en-GB.plg_authentication_ldap.ini

@@ -12,8 +12,12 @@ PLG_LDAP_FIELD_EMAIL_DESC="LDAP attribute which has the User's email address."
 PLG_LDAP_FIELD_EMAIL_LABEL="Map: Email"
 PLG_LDAP_FIELD_FULLNAME_DESC="LDAP attribute which has the User's full name."
 PLG_LDAP_FIELD_FULLNAME_LABEL="Map: Full Name"
+PLG_LDAP_FIELD_IGNORE_REQCERT_TLS_DESC="When enabled ignore the server certificate, this is useful when running for example Samba 4 with a self-signed certificate."


Move lines 15-16 after line 18.

HLeithner · 2019-04-23T17:00:14Z

thx

joomla#24115)

Added patch for connecting to AD-server with self-signed certificates.

40446f0

joomla-cms-bot added Composer Dependency Changed Language Change This is for Translators PR-staging labels Mar 7, 2019

rickyosser changed the title ~~Added patch for connecting to AD-server with self-signed certificates.~~ [plugin/authetication/ldap] Added patch for connecting to AD-server with self-signed certificates. Mar 7, 2019

Quy reviewed Mar 7, 2019

View reviewed changes

brianteeman mentioned this pull request Mar 7, 2019

[Feature request][Patch][3.8.11 and others] Ldap authentication plugin to ignore TLS self-signed certificate #21866

Closed

ricky and others added 2 commits March 8, 2019 00:47

Fixed tabs.

b11d096

Merge branch 'staging' into self-signed-cert

920712e

HLeithner requested changes Mar 8, 2019

View reviewed changes

ricky added 3 commits March 8, 2019 10:36

Changed the LABEL-name from PLG_LDAP_FIELD_REQCERT_* to PLG_LDAP_FIEL…

4754bc0

…D_IGNORE_REQCERT_TLS*.

Merge branch 'self-signed-cert' of github.com:rickyosser/joomla-cms i…

64cf8b3

…nto self-signed-cert

Typo: removed an underscore.

f3758cf

HLeithner approved these changes Mar 8, 2019

View reviewed changes

Quy reviewed Mar 8, 2019

View reviewed changes

rickyosser and others added 3 commits March 10, 2019 00:36

Merge branch 'staging' into self-signed-cert

3f0dc65

Changed order of keys to alphabetic order. Moved debug ldap to last i…

224ec41

…n list. And fixed so it says __DEPLOY_VERSION__

Merge branch 'self-signed-cert' of github.com:rickyosser/joomla-cms i…

c0486a6

…nto self-signed-cert

Reverted library file libraries/vendor/joomla/ldap/src/LdapClient.php.

431c0a2

joomla-cms-bot removed the Composer Dependency Changed label Mar 10, 2019

ghost added J3 Issue and removed J3 Issue labels Apr 5, 2019

Quy reviewed Apr 11, 2019

View reviewed changes

ghost changed the title ~~[plugin/authetication/ldap] Added patch for connecting to AD-server with self-signed certificates.~~ Added patch for connecting to AD-server with self-signed certificates. Apr 19, 2019

ghost removed the J3 Issue label Apr 19, 2019

Merge branch 'staging' into self-signed-cert

00cb5d4

HLeithner merged commit 380fd61 into joomla:staging Apr 23, 2019

HLeithner added this to the Joomla 3.9.6 milestone Apr 23, 2019

tecpromotion mentioned this pull request Apr 24, 2019

Added patch for connecting to AD-server with self-signed certificates. #24115 joomlagerman/joomla#721

Closed

Bakual mentioned this pull request Apr 26, 2019

Semver j3 #24728

Closed

tecpromotion pushed a commit to tecpromotion/joomla-cms that referenced this pull request May 23, 2019

Added patch for connecting to AD-server with self-signed certificates. (

6e0bca3

joomla#24115)

wilsonge mentioned this pull request Jul 4, 2019

[4.0] Merge conflict from LDAP #25434

Open

tatankat mentioned this pull request Jan 28, 2023

[4.x] Fix LDAP over SSL #37962

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added patch for connecting to AD-server with self-signed certificates. #24115

Added patch for connecting to AD-server with self-signed certificates. #24115

rickyosser commented Mar 7, 2019

Quy Mar 7, 2019

rickyosser Mar 7, 2019

HLeithner left a comment

HLeithner commented Mar 8, 2019

brianteeman commented Mar 8, 2019

HLeithner commented Mar 8, 2019

HLeithner commented Mar 8, 2019

brianteeman commented Mar 8, 2019

HLeithner commented Mar 8, 2019

Quy Mar 8, 2019

rickyosser Mar 9, 2019

Quy Mar 10, 2019

rickyosser Mar 10, 2019

Quy Mar 8, 2019

rickyosser Mar 9, 2019

Quy Mar 8, 2019

rickyosser Mar 9, 2019

mbabker commented Mar 8, 2019

HLeithner commented Mar 8, 2019

rickyosser commented Mar 9, 2019

brianteeman commented Mar 9, 2019

rickyosser commented Mar 10, 2019 •

edited

rickyosser commented Mar 10, 2019 •

edited

HLeithner commented Mar 10, 2019 •

edited

rickyosser commented Mar 10, 2019

Quy Apr 11, 2019

HLeithner commented Apr 23, 2019

Added patch for connecting to AD-server with self-signed certificates. #24115

Added patch for connecting to AD-server with self-signed certificates. #24115

Conversation

rickyosser commented Mar 7, 2019

Summary of Changes

Testing Instructions

Expected result

Actual result

Documentation Changes Required

Choose a reason for hiding this comment

Choose a reason for hiding this comment

HLeithner left a comment

Choose a reason for hiding this comment

HLeithner commented Mar 8, 2019

brianteeman commented Mar 8, 2019

HLeithner commented Mar 8, 2019

HLeithner commented Mar 8, 2019

brianteeman commented Mar 8, 2019

HLeithner commented Mar 8, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mbabker commented Mar 8, 2019

HLeithner commented Mar 8, 2019

rickyosser commented Mar 9, 2019

brianteeman commented Mar 9, 2019

rickyosser commented Mar 10, 2019 • edited

rickyosser commented Mar 10, 2019 • edited

HLeithner commented Mar 10, 2019 • edited

rickyosser commented Mar 10, 2019

Choose a reason for hiding this comment

HLeithner commented Apr 23, 2019

rickyosser commented Mar 10, 2019 •

edited

rickyosser commented Mar 10, 2019 •

edited

HLeithner commented Mar 10, 2019 •

edited