public_git
/
nginx-ldap-auth
mirror of https://github.com/nginxinc/nginx-ldap-auth.git
1
0
Fork 1
Code Issues Releases Wiki Activity

Added configuration option to disable referrals. 

The options is boolean, header name is  'X-Ldap-DisableReferrals' and
the command-line switch is '--disable-referrals', default value is
false.
This commit is contained in:
Vladimir Homutov 2018-08-20 12:31:55 +03:00
parent 732eb15f07
commit f56178b6ee
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
nginx-ldap-auth-daemon.py
View File

@ -149,6 +149,7 @@ class LDAPAuthHandler(AuthHandler):
'realm': ('X-Ldap-Realm', 'Restricted'), 'realm': ('X-Ldap-Realm', 'Restricted'),
'url': ('X-Ldap-URL', None), 'url': ('X-Ldap-URL', None),
'starttls': ('X-Ldap-Starttls', 'false'), 'starttls': ('X-Ldap-Starttls', 'false'),
'disable_referrals': ('X-Ldap-DisableReferrals', 'false'),
'basedn': ('X-Ldap-BaseDN', None), 'basedn': ('X-Ldap-BaseDN', None),
'template': ('X-Ldap-Template', '(cn=%(username)s)'), 'template': ('X-Ldap-Template', '(cn=%(username)s)'),
'binddn': ('X-Ldap-BindDN', ''), 'binddn': ('X-Ldap-BindDN', ''),
@ -208,9 +209,9 @@ class LDAPAuthHandler(AuthHandler):
if ctx['starttls'] == 'true': if ctx['starttls'] == 'true':
ldap_obj.start_tls_s() ldap_obj.start_tls_s()
# See http://www.python-ldap.org/faq.shtml # See https://www.python-ldap.org/en/latest/faq.html
# uncomment, if required if ctx['disable_referrals'] == 'true':
# ldap_obj.set_option(ldap.OPT_REFERRALS, 0) ldap_obj.set_option(ldap.OPT_REFERRALS, 0)
ctx['action'] = 'binding as search user' ctx['action'] = 'binding as search user'
ldap_obj.bind_s(ctx['binddn'], ctx['bindpasswd'], ldap.AUTH_SIMPLE) ldap_obj.bind_s(ctx['binddn'], ctx['bindpasswd'], ldap.AUTH_SIMPLE)
@ -275,6 +276,9 @@ if __name__ == '__main__':
group.add_argument('-s', '--starttls', metavar="starttls", group.add_argument('-s', '--starttls', metavar="starttls",
default="false", default="false",
help=("Establish a STARTTLS protected session (Default: false)")) help=("Establish a STARTTLS protected session (Default: false)"))
group.add_argument('--disable-referrals', metavar="disable_referrals",
default="false",
help=("Sets ldap.OPT_REFERRALS to zero (Default: false)"))
group.add_argument('-b', metavar="baseDn", dest="basedn", default='', group.add_argument('-b', metavar="baseDn", dest="basedn", default='',
help="LDAP base dn (Default: unset)") help="LDAP base dn (Default: unset)")
group.add_argument('-D', metavar="bindDn", dest="binddn", default='', group.add_argument('-D', metavar="bindDn", dest="binddn", default='',
@ -298,6 +302,7 @@ if __name__ == '__main__':
'realm': ('X-Ldap-Realm', args.realm), 'realm': ('X-Ldap-Realm', args.realm),
'url': ('X-Ldap-URL', args.url), 'url': ('X-Ldap-URL', args.url),
'starttls': ('X-Ldap-Starttls', args.starttls), 'starttls': ('X-Ldap-Starttls', args.starttls),
'disable_referrals': ('X-Ldap-DisableReferrals', args.disable_referrals),
'basedn': ('X-Ldap-BaseDN', args.basedn), 'basedn': ('X-Ldap-BaseDN', args.basedn),
'template': ('X-Ldap-Template', args.filter), 'template': ('X-Ldap-Template', args.filter),
'binddn': ('X-Ldap-BindDN', args.binddn), 'binddn': ('X-Ldap-BindDN', args.binddn),

5
nginx-ldap-auth.conf
View File

@ -103,6 +103,11 @@ http {
# Set the LDAP template by uncommenting the following directive. # Set the LDAP template by uncommenting the following directive.
#proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)"; #proxy_set_header X-Ldap-Template "(sAMAccountName=%(username)s)";
# (May be required if using Microsoft Active Directory and
# getting "In order to perform this operation a successful bind
# must be completed on the connection." errror)
#proxy_set_header X-Ldap-DisableReferrals "true";
# (Optional if using OpenLDAP as the LDAP server) Set the LDAP # (Optional if using OpenLDAP as the LDAP server) Set the LDAP
# template by uncommenting the following directive and replacing # template by uncommenting the following directive and replacing
# '(cn=%(username)s)' which is the default set in # '(cn=%(username)s)' which is the default set in