0001-ldap-do-not-block-check_password-and-get_attributes-.patch

Benjamin Dauvergne, 26 juin 2019 11:15

Voir les différences: en ligne côte à côte

Subject: [PATCH] ldap: do not block check_password and get_attributes if LDAP
 is down (#34316)

 src/authentic2/attributes_ng/sources/ldap.py |  2 +-
 src/authentic2/backends/ldap_backend.py      | 36 ++++++++++++-----
 tests/test_ldap.py                           | 42 ++++++++++++++++++++
 3 files changed, 68 insertions(+), 12 deletions(-)

src/authentic2/attributes_ng/sources/ldap.py
38	38	def get_attributes(instance, ctx):
39	39	user = ctx.get('user')
40	40	if user and isinstance(user, LDAPUser):
41		ctx.update(user.get_attributes())
	41	ctx.update(user.get_attributes(instance, ctx))
42	42	return ctx

     # You should have received a copy of the GNU Affero General Public License
     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     import hashlib
     try:
         import ldap
         import ldap.modlist
-...
     # code originaly copied from by now merely inspired by
     # http://www.amherst.k12.oh.us/django-ldap.html
     from django.core.cache import cache
     from django.core.exceptions import ImproperlyConfigured
     from django.conf import settings
     from django.contrib.auth import get_user_model
-...
         '/var/lib/ca-certificates/ca-bundle.pem',  # OpenSuse
+    ]
     # Select a system certificate store
     for bundle_path in CA_BUNDLE_PATHS:
         if os.path.exists(bundle_path):
-...
         def check_password(self, raw_password):
             connection = self.ldap_backend.get_connection(self.block)
             try:
                 connection.simple_bind_s(self.dn, raw_password)
             except ldap.INVALID_CREDENTIALS:
                 return False
             except ldap.LDAPError as e:
                 log.error('LDAPUser.check_password() failed: %r', e)
                 return False
             self._current_password = raw_password
             return True
             if connection:
                 try:
                     connection.simple_bind_s(self.dn, raw_password)
                     self._current_password = raw_password
                     return True
                 except ldap.INVALID_CREDENTIALS:
                     return False
                 except ldap.LDAPError as e:
                     log.warning('LDAPUser.check_password() failed: %r', e)
             if getattr(self, '_current_password', None) is not None:
                 return raw_password == self._current_password
             return False
         def set_password(self, new_password):
             # Allow change password to work in all cases, as the form does a check_password() first
-...
             self.ldap_backend.update_default(self.block, validate=False)
             return self.ldap_backend.get_connection(self.block, credentials=credentials)
         def get_attributes(self):
         def get_attributes(self, attribute_source, ctx):
             conn = self.get_connection()
             return self.ldap_backend.get_ldap_attributes(self.block, conn, self.dn) or {}
             key = hashlib.md5((force_text(str(self.pk)) + ';' + force_text(self.dn)).encode('utf-8')).hexdigest()
             # prevents blocking on temporary LDAP failures
             if conn is not None:
                 attributes = self.ldap_backend.get_ldap_attributes(self.block, conn, self.dn) or {}
                 # keep attributes in cache for 8 hours
                 cache.set(key, attributes, 3600 * 8)
                 return attributes
             return cache.get(key, {})
         def save(self, *args, **kwargs):
             if hasattr(self, 'keep_pk'):

     CN = 'Étienne Michu'
     DN = 'cn=%s,o=ôrga' % escape_dn_chars(CN)
     PASS = 'passé'
     UPASS = u'passé'
     EMAIL = 'etienne.michu@example.net'
     base_dir = os.path.dirname(__file__)
-...
             response = client.post('/login/', {'login-password-submit': '1',
                                                'username': USERNAME,
                                                'password': PASS}, follow=True)
     def test_get_attributes(slapd, settings, db, rf):
         settings.LDAP_AUTH_SETTINGS = [{
             'url': [slapd.ldap_url],
             'basedn': u'o=ôrga',
             'use_tls': False,
         }]
         user = authenticate(username=USERNAME, password=UPASS)
         assert user
         assert user.get_attributes(object(), {}) == {
             'dn': u'cn=\xc9tienne Michu,o=\xf4rga',
             'givenname': [u'\xc9tienne'],
             'mail': [u'etienne.michu@example.net'],
             'sn': [u'Michu'],
             'uid': [u'etienne.michu'],
+        }
         # simulate LDAP down
         slapd.stop()
         assert user.get_attributes(object(), {}) == {
             'dn': u'cn=\xc9tienne Michu,o=\xf4rga',
             'givenname': [u'\xc9tienne'],
             'mail': [u'etienne.michu@example.net'],
             'sn': [u'Michu'],
             'uid': [u'etienne.michu'],
+        }
         assert not user.check_password(UPASS)
         # simulate LDAP come back up
         slapd.start()
         assert user.check_password(UPASS)
         # modify LDAP record and check attributes are updated
         conn = slapd.get_connection_admin()
         ldif = [(ldap.MOD_REPLACE, 'sn', ['Micho'])]
         conn.modify_s(DN, ldif)
         assert user.get_attributes(object(), {}) == {
             'dn': u'cn=\xc9tienne Michu,o=\xf4rga',
             'givenname': [u'\xc9tienne'],
             'mail': [u'etienne.michu@example.net'],
             'sn': [u'Micho'],
             'uid': [u'etienne.michu'],
+        }
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-ldap-do-not-block-check_password-and-get_attributes-.patch