0001-ldap_backend-skip-authentication-on-wrong-user-filte.patch

Paul Marillonnet, 25 mars 2019 18:42

Voir les différences: en ligne côte à côte

Subject: [PATCH] ldap_backend: skip authentication on wrong user filter
 (#31590)

 src/authentic2/backends/ldap_backend.py |  4 ++++
 tests/test_ldap.py                      | 14 ++++++++++++++
 2 files changed, 18 insertions(+)

                         uid, realm = username.rsplit('@', 1)
                     if realm and block.get('realm') != realm:
                         continue
                 if '%s' not in block['user_filter']:
                     log.error(
                         "account name authentication filter doesn't contain '%s'")
                     continue
                 user = self.authenticate_block(block, uid, password)
                 if user is not None:
                     return user

         assert all([user.userexternalid_set.first().external_id
                     == urlparse.quote(user.username.split('@')[0].encode('utf-8'))
                     for user in User.objects.all()])
     def test_alert_on_wrong_user_filter(slapd, settings, client, db, caplog):
         settings.LDAP_AUTH_SETTINGS = [{
             'url': [slapd.ldap_url],
             'basedn': u'o=ôrga',
             'use_tls': False,
             'user_filter': '(&(objectClass=user)(sAMAccountName=*)', #wrong
         }]
         with utils.check_log(caplog, "account name authentication filter doesn't contain '%s'"):
             response = client.post('/login/', {'login-password-submit': '1',
                                                'username': USERNAME,
                                                'password': PASS}, follow=True)
+    -

Produits Entr'ouvert » Authentic 2