-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add LDAP feature support #16969
Merged
liat-grozovik
merged 4 commits into
sonic-net:master
from
davidpil2002:dev-add-ldap-support
May 7, 2024
Merged
Add LDAP feature support #16969
Changes from all commits
Commits
Show all changes
4 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
16 changes: 16 additions & 0 deletions
16
src/sonic-yang-models/tests/yang_model_tests/tests/ldap.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| { | ||
| "LDAP_TABLE": { | ||
| "desc": "Configure LDAP global fields." | ||
| }, | ||
| "LDAP_INVALID_TIMEOUT_TEST": { | ||
| "desc": "LDAP global configuration with invalid timeout value in LDAP table.", | ||
| "eStr": "LDAP timeout must be 1..60" | ||
| }, | ||
| "LDAP_SERVER_TEST" : { | ||
| "desc": "LDAP server configuration in LDAP_SERVER table." | ||
| }, | ||
| "LDAP_SERVER_INVALID_PRIORITY_TEST": { | ||
| "desc": "LDAP server configuration with invalid priority value in LDAP_SERVER table.", | ||
| "eStr": "LDAP server priority must be 1..8" | ||
| } | ||
| } |
61 changes: 61 additions & 0 deletions
61
src/sonic-yang-models/tests/yang_model_tests/tests_config/ldap.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| { | ||
| "LDAP_TABLE": { | ||
| "sonic-system-ldap:sonic-system-ldap": { | ||
| "sonic-system-ldap:LDAP": { | ||
| "global":{ | ||
| "bind_dn": "test_bind", | ||
| "bind_password": "secret", | ||
| "bind_timeout": "5", | ||
| "version": "3", | ||
| "base_dn": "test_base", | ||
| "port": "389", | ||
| "timeout": "5" | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "LDAP_INVALID_TIMEOUT_TEST": { | ||
| "sonic-system-ldap:sonic-system-ldap": { | ||
| "sonic-system-ldap:LDAP": { | ||
| "global": { | ||
| "bind_dn": "test_bind", | ||
| "bind_password": "secret", | ||
| "bind_timeout": "5", | ||
| "version": "3", | ||
| "base_dn": "test_base", | ||
| "port": "389", | ||
| "timeout": 150 | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "LDAP_SERVER_TEST": { | ||
| "sonic-system-ldap:sonic-system-ldap": { | ||
| "sonic-system-ldap:LDAP_SERVER": { | ||
| "LDAP_SERVER_LIST": [ | ||
| { | ||
| "hostname": "192.168.1.1", | ||
| "priority": 1 | ||
| }, | ||
| { | ||
| "hostname": "ldap_server_1", | ||
| "priority": 2 | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
|
|
||
| "LDAP_SERVER_INVALID_PRIORITY_TEST": { | ||
| "sonic-system-ldap:sonic-system-ldap": { | ||
| "sonic-system-ldap:LDAP_SERVER": { | ||
| "LDAP_SERVER_LIST": [ | ||
| { | ||
| "hostname": "192.168.1.1", | ||
| "priority": 70 | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
108 changes: 108 additions & 0 deletions
108
src/sonic-yang-models/yang-models/sonic-system-ldap.yang
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| module sonic-system-ldap { | ||
| yang-version 1.1; | ||
| namespace "http://github.com/Azure/sonic-system-ldap"; | ||
| prefix ssys-ldap; | ||
|
|
||
| import ietf-inet-types { | ||
| prefix inet; | ||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
|
|
||
| description "LDAP YANG Module for SONiC OS"; | ||
|
|
||
| revision 2023-10-01 { | ||
| description "First Revision"; | ||
| } | ||
|
|
||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| container sonic-system-ldap { | ||
|
|
||
| container LDAP_SERVER { | ||
| list LDAP_SERVER_LIST { | ||
| max-elements 8; | ||
| key "hostname"; | ||
|
|
||
| leaf hostname { | ||
| type inet:host; | ||
| description | ||
| "LDAP server's Domain name or IP address (IPv4 or IPv6)"; | ||
| } | ||
|
|
||
| leaf priority { | ||
| default 1; | ||
| type uint8 { | ||
| range "1..8" { | ||
| error-message "LDAP server priority must be 1..8"; | ||
| } | ||
| } | ||
| description "Server priority"; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| container LDAP { | ||
|
|
||
| container global { | ||
|
|
||
|
|
||
| leaf bind_dn { | ||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| type string { | ||
| length "1..65"; | ||
| } | ||
| description | ||
| 'LDAP global bind dn'; | ||
| } | ||
|
|
||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| leaf bind_password { | ||
| type string { | ||
| length "1..65"; | ||
| pattern "[^ #,]*" { | ||
| error-message 'LDAP shared secret (Valid chars are ASCII printable except SPACE, "#", and ",")'; | ||
| } | ||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| description "Shared secret used for encrypting the communication"; | ||
| } | ||
|
|
||
| leaf bind_timeout { | ||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| default 5; | ||
| type uint16 { | ||
| range "1..120" { | ||
| error-message "Ldap bind timeout must be 1..120"; | ||
| } | ||
| } | ||
| description "Ldap bind timeout"; | ||
| } | ||
|
|
||
| leaf version { | ||
| default 3; | ||
| type uint16 { | ||
| range "1..3" { | ||
| error-message "Ldap version must be 1..3"; | ||
| } | ||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| description "Ldap version"; | ||
| } | ||
|
|
||
| leaf base_dn { | ||
| type string { | ||
| length "1..65"; | ||
| } | ||
| description "Ldap user base dn"; | ||
| } | ||
|
|
||
| leaf port { | ||
| type inet:port-number; | ||
| default 389; | ||
| description "TCP port to communicate with LDAP server"; | ||
| } | ||
|
|
||
| leaf timeout { | ||
davidpil2002 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| description "Ldap timeout duration in sec"; | ||
| type uint16 { | ||
| range "1..60" { | ||
| error-message "LDAP timeout must be 1..60"; | ||
| } | ||
| } | ||
| } | ||
| } /* container global */ | ||
| } /* container LDAP */ | ||
| }/* container sonic-system-ldap */ | ||
| }/* end of module sonic-system-ldap */ | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Suggest to add build time config, so deployers not using LDAP could reduce image size, and reduce the security concerns.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why should this be different than radius/tacacs? Why show different approaches for a feature in the same domain?