Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LDAP group membership #45347

Merged
merged 3 commits into from Jan 31, 2018
Merged

LDAP group membership #45347

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
288575f
Log an error if python-ldap is not installed and ldap auth is used
amendlik Jan 5, 2018
c297b95
Allow authinticatied bind for listing LDAP groups
amendlik Jan 5, 2018
edf770d
Merge branch 'develop' into ldap-groups
Jan 18, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
20 changes: 15 additions & 5 deletions salt/auth/ldap.py
View file
Open in desktop
Expand Up @@ -276,12 +276,17 @@ def auth(username, password):
'''
Simple LDAP auth
'''
#If bind credentials are configured, use them instead of user's
if not HAS_LDAP:
log.error('LDAP authentication requires python-ldap module')
return False

# If bind credentials are configured, use them instead of user's
if _config('binddn', mandatory=False) and _config('bindpw', mandatory=False):
bind = _bind_for_search(anonymous=_config('anonymous', mandatory=False))
else:
bind = _bind(username, password, anonymous=_config('auth_by_group_membership_only', mandatory=False) and
_config('anonymous', mandatory=False))
bind = _bind(username, password,
anonymous=_config('auth_by_group_membership_only', mandatory=False)
and _config('anonymous', mandatory=False))

if bind:
log.debug('LDAP authentication successful')
Expand All @@ -308,8 +313,13 @@ def groups(username, **kwargs):
'''
group_list = []

# Perform un-authenticated bind to determine group membership
bind = _bind_for_search(anonymous=_config('anonymous', mandatory=False))
# If bind credentials are configured, use them instead of user's
if _config('binddn', mandatory=False) and _config('bindpw', mandatory=False):
bind = _bind_for_search(anonymous=_config('anonymous', mandatory=False))
else:
bind = _bind(username, kwargs.get('password', ''),
anonymous=_config('auth_by_group_membership_only', mandatory=False)
and _config('anonymous', mandatory=False))

if bind:
log.debug('ldap bind to determine group membership succeeded!')
Expand Down