proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-08-13 05:33:01 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix #1470: ad: server and client certificate support

Browse Source 
as with ldap we now accept
the verify, capath, cert and certkey parameters for active directory

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak 2017-08-08 11:10:14 +02:00 committed by Wolfgang Bumiller
parent e03c2aef17
commit 23e0cf85fd
1 changed files with 27 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
PVE/Auth/AD.pm
View File

@ -72,6 +72,10 @@ sub options {
default => { optional => 1 },,
comment => { optional => 1 },
tfa => { optional => 1 },
verify => { optional => 1 },
capath => { optional => 1 },
cert => { optional => 1 },
certkey => { optional => 1 },
};
}
@ -83,10 +87,30 @@ my $authenticate_user_ad = sub {
my $scheme = $config->{secure} ? 'ldaps' : 'ldap';
$server = "[$server]" if Net::IP::ip_is_ipv6($server);
my $conn_string = "$scheme://${server}:$port";
my $ldap = Net::LDAP->new($conn_string) || die "$@\n";
$username = "$username\@$config->{domain}"
my %ad_args;
if ($config->{verify}) {
$ad_args{verify} = 'require';
if (defined(my $cert = $config->{cert})) {
$ad_args{clientcert} = $cert;
}
if (defined(my $key = $config->{certkey})) {
$ad_args{clientkey} = $key;
}
if (defined(my $capath = $config->{capath})) {
if (-d $capath) {
$ad_args{capath} = $capath;
} else {
$ad_args{cafile} = $capath;
}
}
} elsif (defined($config->{verify})) {
$ad_args{verify} = 'none';
}
my $ldap = Net::LDAP->new($conn_string, %ad_args) || die "$@\n";
$username = "$username\@$config->{domain}"
if $username !~ m/@/ && $config->{domain};
my $res = $ldap->bind($username, password => $password);