proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-08-14 07:32:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ldap auth: add sslversion option

Browse Source 
default to tls1.2

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
This commit is contained in:
Alexandre Derumier 2019-11-04 10:18:05 +01:00 committed by Thomas Lamprecht
parent 6e5bbca424
commit 07dd90d731
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
PVE/Auth/AD.pm
View File

@ -33,6 +33,12 @@ sub properties {
optional => 1, optional => 1,
}, },
sslversion => {
description => "LDAPS ssl version.",
type => 'string',
enum => [qw(tlsv1 tlsv1_1 tlsv1_2)],
optional => 1,
},
default => { default => {
description => "Use this as default realm", description => "Use this as default realm",
type => 'boolean', type => 'boolean',
@ -69,6 +75,7 @@ sub options {
domain => {}, domain => {},
port => { optional => 1 }, port => { optional => 1 },
secure => { optional => 1 }, secure => { optional => 1 },
sslversion => { optional => 1 },
default => { optional => 1 },, default => { optional => 1 },,
comment => { optional => 1 }, comment => { optional => 1 },
tfa => { optional => 1 }, tfa => { optional => 1 },
@ -108,6 +115,10 @@ my $authenticate_user_ad = sub {
$ad_args{verify} = 'none'; $ad_args{verify} = 'none';
} }
if ($config->{secure}) {
$ad_args{sslversion} = $config->{sslversion} ? $config->{sslversion} : 'tlsv1_2';
}
my $ldap = Net::LDAP->new($conn_string, %ad_args) || die "$@\n"; my $ldap = Net::LDAP->new($conn_string, %ad_args) || die "$@\n";
$username = "$username\@$config->{domain}" $username = "$username\@$config->{domain}"

5
PVE/Auth/LDAP.pm
View File

@ -70,6 +70,7 @@ sub options {
user_attr => {}, user_attr => {},
port => { optional => 1 }, port => { optional => 1 },
secure => { optional => 1 }, secure => { optional => 1 },
sslversion => { optional => 1 },
default => { optional => 1 }, default => { optional => 1 },
comment => { optional => 1 }, comment => { optional => 1 },
tfa => { optional => 1 }, tfa => { optional => 1 },
@ -109,6 +110,10 @@ my $authenticate_user_ldap = sub {
$ldap_args{verify} = 'none'; $ldap_args{verify} = 'none';
} }
if ($config->{secure}) {
$ldap_args{sslversion} = $config->{sslversion} ? $config->{sslversion} : 'tlsv1_2';
}
my $ldap = Net::LDAP->new($conn_string, %ldap_args) || die "$@\n"; my $ldap = Net::LDAP->new($conn_string, %ldap_args) || die "$@\n";
if (my $bind_dn = $config->{bind_dn}) { if (my $bind_dn = $config->{bind_dn}) {