From ca62d94c56df7ee24a46c0de657930b48a04711d Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Sat, 24 Nov 2007 23:23:08 +0000
Subject: [PATCH] fixup ldap SSL/TLS options, make TLS default in helper,
Closes: Trac#13
---
AUTHORS | 1 +
ChangeLog | 2 ++
handlers/ldap.helper.in | 10 +++++++++-
handlers/ldap.in | 13 +++++++++----
4 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/AUTHORS b/AUTHORS
index ea31cba..71a032b 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -24,3 +24,4 @@ Jamie McClelland -- cstream patches
ale -- ldap cleanup
Sami Haahtinen <ressu@ressukka.net>
Matthew Palmer -- mysql enhancements
+romain.tartiere@healthgrid.org -- ldap fixes
diff --git a/ChangeLog b/ChangeLog
index 6ebf602..34589c2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -26,6 +26,8 @@ version 0.9.5 -- unreleased
instead of on/off
. Fixed problem that caused combination of slapcat and compress to not work
together (Closes: Trac#29)
+ . Applied patch from romain.tartiere@healthgrid.org to fix the SSL/TLS options
+ to be correct, also set TLS to be the default over SSL (Closes: Trac#13)
maildir:
. Added an examples file (Closes: Trac#23)
. Applied patch from Anarcat that fixes the cp/mkdir calls to not use GNU
diff --git a/handlers/ldap.helper.in b/handlers/ldap.helper.in
index 5ccbe7e..35b47a3 100644
--- a/handlers/ldap.helper.in
+++ b/handlers/ldap.helper.in
@@ -7,13 +7,17 @@ while true; do
checkBox "ldap action wizard" "check options (slapcat OR ldapsearch)" \
"slapcat" "export ldif using slapcat" yes \
"ldapsearch" "export ldif using ldapsearch" no \
- "compress" "compress the ldif output files" yes
+ "compress" "compress the ldif output files" yes \
+ "ssl" "use SSL (deprecated)" no \
+ "tls" "use TLS extended operations (RFC2246, RFC2830)" yes
status=$?
compress="compress = no"
method="method = <unset>"
restart="restart = no"
binddn=""
passwordfile=""
+ ssl="ssl = no"
+ tls="tls = no"
[ $status = 1 ] && return;
result="$REPLY"
for opt in $result; do
@@ -33,6 +37,8 @@ while true; do
binddn="binddn = $REPLY"
require_packages ldap-utils
;;
+ '"ssl"') ssl="ssl = yes";;
+ '"tls"') tls="tls = yes";;
esac
done
get_next_filename $configdirectory/30.ldap
@@ -42,6 +48,8 @@ $compress
$restart
$binddn
$passwordfile
+$ssl
+$tls
# backupdir = /var/backups/ldap
# conf = /etc/ldap/slapd.conf
# databases = all
diff --git a/handlers/ldap.in b/handlers/ldap.in
index f6f87c7..e5e21ba 100644
--- a/handlers/ldap.in
+++ b/handlers/ldap.in
@@ -13,9 +13,10 @@ getconf method ldapsearch
getconf passwordfile
getconf binddn
getconf ldaphost
-getconf tls yes
+getconf ssl yes
+getconf tls no
-if [ $tls = 'yes' ]; then
+if [ $ssl = 'yes' ]; then
URLBASE="ldaps"
else
URLBASE="ldap"
@@ -56,10 +57,14 @@ if [ "$ldif" == "yes" ]; then
if [ "$method" == "slapcat" ]; then
execstr="$SLAPCAT -f $conf -b $dbsuffix"
else
+ LDAPARGS=""
+ if [ "$tls" == "yes" ]; then
+ LDAPARGS="-ZZ"
+ fi
if [ -n "$ldaphost" ]; then
- execstr="$LDAPSEARCH -H $URLBASE://$ldaphost -x -L -b ""$dbsuffix"" -D ""$binddn"" -y $passwordfile"
+ execstr="$LDAPSEARCH $LDAPARGS -H $URLBASE://$ldaphost -x -L -b ""$dbsuffix"" -D ""$binddn"" -y $passwordfile"
else
- execstr="$LDAPSEARCH -x -L -b ""$dbsuffix"" -D ""$binddn"" -y $passwordfile"
+ execstr="$LDAPSEARCH -H $URLBASE://$ldaphost -x -L -b ""$dbsuffix"" -D ""$binddn"" -y $passwordfile"
fi
[ -f "$passwordfile" ] || fatal "Password file $passwordfile not found. When method is set to ldapsearch, you must also specify a password file."
debug "$execstr"
--
GitLab