From c2d70db6f14c0fc5bc99d1e2ea0b8a05f92ac3b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20NO=C3=8BL?= <tnoel@entrouvert.com>
Date: Fri, 23 Sep 2022 01:50:18 +0200
Subject: [PATCH] ldap: remove check hostname option (#69470)

OPT_X_TLS_REQUIRE_SAN cannot be used with python3-ldap 3.2 available in Debian 11
---
 ...2_remove_resource_ldap_tls_check_hostname.py | 17 +++++++++++++++++
 passerelle/apps/ldap/models.py                  |  9 ---------
 tests/ldap/test_manager.py                      |  1 -
 tests/ldap/test_search_endpoint.py              | 14 ++++++--------
 tox.ini                                         |  1 +
 5 files changed, 24 insertions(+), 18 deletions(-)
 create mode 100644 passerelle/apps/ldap/migrations/0002_remove_resource_ldap_tls_check_hostname.py

diff --git a/passerelle/apps/ldap/migrations/0002_remove_resource_ldap_tls_check_hostname.py b/passerelle/apps/ldap/migrations/0002_remove_resource_ldap_tls_check_hostname.py
new file mode 100644
index 00000000..6719c803
--- /dev/null
+++ b/passerelle/apps/ldap/migrations/0002_remove_resource_ldap_tls_check_hostname.py
@@ -0,0 +1,17 @@
+# Generated by Django 2.2.26 on 2022-09-22 23:48
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ldap', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='resource',
+            name='ldap_tls_check_hostname',
+        ),
+    ]
diff --git a/passerelle/apps/ldap/models.py b/passerelle/apps/ldap/models.py
index 2f2f3e5a..75728b8d 100644
--- a/passerelle/apps/ldap/models.py
+++ b/passerelle/apps/ldap/models.py
@@ -66,11 +66,6 @@ class Resource(BaseResource):
         blank=True,
         validators=[forms.validate_certificate],
     )
-    ldap_tls_check_hostname = models.BooleanField(
-        verbose_name=_('TLS check hostname'),
-        default=True,
-        blank=True,
-    )
     ldap_tls_check_cert = models.BooleanField(
         verbose_name=_('TLS check certificate'),
         default=True,
@@ -123,10 +118,6 @@ class Resource(BaseResource):
         conn = ldap.initialize(self.ldap_url)
         conn.set_option(ldap.OPT_TIMEOUT, 5)
         conn.set_option(ldap.OPT_NETWORK_TIMEOUT, 5)
-        if self.ldap_tls_check_hostname:
-            conn.set_option(ldap.OPT_X_TLS_REQUIRE_SAN, ldap.OPT_X_TLS_DEMAND)
-        else:
-            conn.set_option(ldap.OPT_X_TLS_REQUIRE_SAN, ldap.OPT_X_TLS_NEVER)
         if self.ldap_tls_check_cert:
             conn.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_DEMAND)
         else:
diff --git a/tests/ldap/test_manager.py b/tests/ldap/test_manager.py
index 7a8aa950..f8cc0a63 100644
--- a/tests/ldap/test_manager.py
+++ b/tests/ldap/test_manager.py
@@ -118,7 +118,6 @@ EXPORT_JSON = {
                 'content': 'LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRRGpHd3VmYm5LSzIxdU8KVGx0d3E5allqek0rSzh2cGhhZll3bUtacEJCSTNNTEQvdzg2WlU4dVl3aHZlVnhtUEowVkZwMzVGUEZsK2U2OApJSW11Y2FzYnVFNndrMTZkTXN0VFM2QTMvSkRYenIxd3pUdHIyMk5MTXZzMExQMGZVMGdyWDVCd0d4TVRGenZ0CjA1YW5CWWoxT09waGhFdjdON0hlYVh4eDJweERzRkJSREVDOERoUlRyY016WWI3azdkMFR1WHk2L0lGUlRlUmIKK3lFZktGL0I1WTFjN3doZGNpTzhOODlpUTZ5TnpwNmZhUVV5djZ3UTFKUXFCOE1xUFA5VE9ySkxzc0Z2aTJRawpBdGt6eEEvbnBWNUFBYlVsa1hZbmIvTFZHb0Y4Z1pFZ1NSaWhvZHlQcFFCTmxyWEZ4bU15NXN2UGVpMUUxaHhGCmNva3hoWVp0QWdNQkFBRUNnZ0VBT1VaSTJCeHlwckpMbE1nT0o0d3ZVKzVKYmhSOWlKYzhqVjM0bitiUWRJKzQKVHRXMGNYVzdVbWVIYVJXaVIrWmhkMEFNOXhSaERPYkxYb2FXTW5oWVB0VnNndnVua04yT2lhTTQ5T1d0WWIreAo1eERiTzRoSXNsNVpHLzk4bHJuYUtaWWdSeVdNMmZPeUdYaVROZXdmYmppOFkzdUo3Z0ZOeWxtd0dNYVpRamhyCllOYXFORVY3VnMybjdvRVJ4cXpLRzk5NDdvQkF4MmhwbW9hVzZlTXlYY1dsMm92N2lIcEpTS1VCS2hvKzVQV2MKSjczMW5vME9zR3VTKzNqSGEvMG5aWHJUOG5LbWVteURNZFNmV210VHY2NTlML2d1RkluWnBIUGZGVkxmNTZ2YwpKNnpiL0l6RUpWK05oN0NmQnNNYkhsVFlCZVVGbFJXc3k5dDcwK09ad1FLQmdRRDNKNGFWTjR2SmhYWDF6RGdMCmRWQWN6d0xHS1hZMzhCb0JqT2VSdFZoWEhzNXAvZU5JcWVaMlliWXdCQnkzbkw0MTRVbjdncWI5ZkR0ZzBpM24KNW1RSU9XaHZwSVlVeHR3SVBnWXd6dW14eHAvbjdYZFU0QlBEYnhlalp4a3VDN0FSNWJCMzRwd0pBSnZXUkdFZgowWDFUeEpscVVMaGlaNmcxOE8zUzBvaUp0d0tCZ1FEck85Uk9hajZra3hqWUhtbGpCWklYWGhkS0RjbjBBcVBpCncyMEFhYWZ4MG94TlFBb3E4R3R1MjJaMVFId1JkQmVVSndxQ2JtSFZDQ3diTWYvNTY4ekZBQU51VDliS01lNlgKSjBwMG5URGl5bjh3OU1mZHVGdUc0Y1VNbjRvSzZkSXVZbHNjZ3VvUFFDdlFkY2l3RytkanF3VHJIaWI1VEVibQpqZUtFa1kyQSt3S0JnUUR2WHQrd3kyQmVxQnpNRjZNOExiMk9lVXdWZ25pVnlyeFZQaFBWZ2s1eDZrcytTb0FECmsxRzYyLzNvMlVLNjdsc21zZkRHWUE2OXVNR0ZqMnFZakFIY0dVVzF3eUY5SS9CZEp6MDFybUNXSm1vZTVWWEsKNVU4ZTNBeUgzTVY5WENLRjR2Q2IyK1VGcndvL1puQ3VzV1Z4YVJxdzVrYitQNmlodlp1SXNSRStWd0tCZ1FDNwoyZHVCZzNiakZsVVF3YmlIU3p1UFRhUnJqdmRuMVhQcTh3Vm8vdmNQTm9TMGJCK3lpcXhBcXhUM0xiZm1lRDhjCklORlR0N0tJM1MzYnllSVJReTBUWlI5WVNJbk9qbkZxWkFZaGVpWS85bFg4VW40Sm9kLzFwdllsVG9KK2xKczAKVDNkVEhYaXRGU0hvSnlkTSsvdWNyRVlSUE5NQzR0Yjc1dkt0eTA2bFlRS0JnUUN4NDkrZzVrUWFhUlorNHBzdworZW9sTXBBd0tEa3BLNWdZZW42T3NyVDhtNGhweFRtdGl0ZU1zSDVBdmIvZnhxb0pXTE9qaE40RW5FWlRNSnpyCkx5R29Lc1R2N3JoWndoUnpuRTE1ck96eG1sZFdyY0NrbDdER3VNMkdjS2dndWhDWUY3VTdLQSt2VUNlcUNFMEgKTEEyZ3JrWStUeEZwZzFwd1lkRjFoZWttVHc9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCg==',  # pylint: disable=line-too-long
             },
             'ldap_tls_cacert': None,
-            'ldap_tls_check_hostname': True,
             'ldap_tls_check_cert': True,
             'ldap_url': 'ldap://localhost.entrouvert.org:52271',
             'log_level': 'INFO',
diff --git a/tests/ldap/test_search_endpoint.py b/tests/ldap/test_search_endpoint.py
index 2f8dbd4c..36f22f31 100644
--- a/tests/ldap/test_search_endpoint.py
+++ b/tests/ldap/test_search_endpoint.py
@@ -68,14 +68,12 @@ def test_server_unavailaible(app, resource):
             'id_attribute': 'uid',
         },
     )
-    assert response.json == {
-        'data': [{'disabled': True, 'id': '', 'text': 'Directory server is unavailable'}],
-        'err': 1,
-        'err_class': 'directory-server-unavailable',
-        'err_desc': '{\'result\': -1, \'desc\': "Can\'t contact LDAP server", '
-        "'errno': 107, 'ctrls': [], 'info': 'Transport endpoint is not "
-        "connected'}",
-    }
+    assert response.json['err'] == 1
+    assert response.json['data'] == [{'disabled': True, 'id': '', 'text': 'Directory server is unavailable'}]
+    assert response.json['err_class'] == 'directory-server-unavailable'
+    assert "'info': 'Transport endpoint is not connected'" in response.json['err_desc']
+    assert "'errno': 107" in response.json['err_desc']
+    assert "'desc': \"Can't contact LDAP server\"" in response.json['err_desc']
 
 
 def test_q(app, resource, ldap_server):
diff --git a/tox.ini b/tox.ini
index 5f4645f8..c105f819 100644
--- a/tox.ini
+++ b/tox.ini
@@ -47,6 +47,7 @@ deps =
   zeep<3.3
   codestyle: pre-commit
   ldaptools
+  python-ldap<=3.2
 commands =
   ./get_wcs.sh
   py.test {posargs: --numprocesses {env:NUMPROCESSES:1} --dist loadfile {env:FAST:} {env:COVERAGE:} {env:JUNIT:} tests/}
-- 
2.35.1

