Verified Commit cc00c72b by Luc Didry

Improve LDAP User Authentication Support

- Authorize anonymous bind
- Small code change

This commit is dedicated to Squeeek, who is supporting me with Ğ1.
Many thanks :-)
parent 0dcabb86
......@@ -83,18 +83,25 @@ sub startup {
if (defined($c->config('ldap'))) {
my $ldap = Net::LDAP->new($c->config->{ldap}->{uri});
# connect to the ldap server using the search credentials
my $mesg = $ldap->bind($c->config->{ldap}->{bind_dn},
password => $c->config->{ldap}->{bind_pwd}
);
my $mesg;
if (defined($c->config->{ldap}->{bind_dn}) && defined($c->config->{ldap}->{bind_pwd})) {
# connect to the ldap server using the bind credentials
$mesg = $ldap->bind(
$c->config->{ldap}->{bind_dn},
password => $c->config->{ldap}->{bind_pwd}
);
} else {
# anonymous bind
$mesg = $ldap->bind
}
if ($mesg->code) {
$c->app->log->info("[LDAP search authentication failed] login: ".$c->config->{ldap}->{bind_dn});
$c->app->log->error("[LDAP search authentication failed] ".$mesg->error);
$c->app->log->info('[LDAP INFO] Authenticated bind failed - Login: '.$c->config->{ldap}->{bind_dn}) if defined($c->config->{ldap}->{bind_dn});
$c->app->log->error('[LDAP ERROR] Error on bind: '.$mesg->error);
return undef;
}
my $ldap_user_attr = $c->config->{ldap}->{user_attr};
my $ldap_user_attr = $c->config->{ldap}->{user_attr};
my $ldap_user_filter = $c->config->{ldap}->{user_filter};
# search the ldap database for the user who is trying to login
......@@ -104,32 +111,34 @@ sub startup {
);
if ($mesg->code) {
$c->app->log->error($mesg->error);
$c->app->log->error('[LDAP ERROR] Error on search: '.$mesg->error);
return undef;
}
# check to make sure that the ldap search returned at least one entry
if (scalar $mesg->entries <= 0) {
$c->app->log->error("[LDAP search] no results returned for search");
my @entries = $mesg->entries;
my $entry = $entries[0];
if (defined $entry) {
$c->app->log->info("[LDAP INFO] Authentication failed - User $username filtered out, IP: ".$c->ip);
return undef;
}
# retrieve the first user returned by the search
my $ldap_userdn = $mesg->entry(0)->{asn}->{objectName};
$c->app->log->debug("[LDAP search] found user dn: ".$ldap_userdn);
$c->app->log->debug("[LDAP DEBUG] Found user dn: ".$entry->dn);
# Now we know that the user exists
$mesg = $ldap->bind($ldap_userdn,
$mesg = $ldap->bind($entry->dn,
password => $password
);
if ($mesg->code) {
$c->app->log->info("[LDAP authentication failed] login: $username, IP: ".$c->ip);
$c->app->log->error("[LDAP authentication failed] ".$mesg->error);
$c->app->log->info("[LDAP INFO] Authentication failed - Login: $username, IP: ".$c->ip);
$c->app->log->error('[LDAP ERROR] Authentication failed '.$mesg->error);
return undef;
}
$c->app->log->info("[LDAP authentication successful] login: $username, IP: ".$c->ip);
$c->app->log->info("[LDAP INFO] Authentication successful - Login: $username, IP: ".$c->ip);
} elsif (defined($c->config('htpasswd'))) {
my $htpasswd = new Apache::Htpasswd(
{
......
......@@ -154,7 +154,7 @@ msgstr ""
msgid "Password"
msgstr ""
#: lib/Lstu.pm:246 themes/default/templates/api.html.ep:23
#: lib/Lstu.pm:275 themes/default/templates/api.html.ep:23
msgid "Please, check your credentials: unable to authenticate."
msgstr ""
......@@ -195,17 +195,17 @@ msgid "Statistics"
msgstr ""
#. ($url->host)
#: lib/Lstu/Plugin/Helpers.pm:159
#: lib/Lstu/Plugin/Helpers.pm:161
msgid "The URL host or one of its redirection(s) (%1) is blacklisted at Spamhaus. I refuse to shorten it."
msgstr ""
#. ($c->config('max_redir')
#: lib/Lstu/Plugin/Helpers.pm:175
#: lib/Lstu/Plugin/Helpers.pm:177
msgid "The URL redirects %1 times or most. It's most likely a dangerous URL (spam, phishing, etc.). I refuse to shorten it."
msgstr ""
#. ($url->host)
#: lib/Lstu/Plugin/Helpers.pm:151
#: lib/Lstu/Plugin/Helpers.pm:153
msgid "The URL you want to shorten comes from a domain (%1) that is blacklisted on this server (usually because of spammers that use this domain)."
msgstr ""
......@@ -249,11 +249,11 @@ msgstr ""
msgid "You asked to shorten too many URLs too quickly. You're banned for %1 hour(s)."
msgstr ""
#: lib/Lstu.pm:237 lib/Lstu/Controller/Admin.pm:52 themes/default/templates/api.html.ep:126 themes/default/templates/api.html.ep:22
#: lib/Lstu.pm:266 lib/Lstu/Controller/Admin.pm:52 themes/default/templates/api.html.ep:126 themes/default/templates/api.html.ep:22
msgid "You have been successfully logged in."
msgstr ""
#: lib/Lstu.pm:276 lib/Lstu/Controller/Admin.pm:73 themes/default/templates/api.html.ep:134 themes/default/templates/api.html.ep:36 themes/default/templates/logout.html.ep:3
#: lib/Lstu.pm:305 lib/Lstu/Controller/Admin.pm:73 themes/default/templates/api.html.ep:134 themes/default/templates/api.html.ep:36 themes/default/templates/logout.html.ep:3
msgid "You have been successfully logged out."
msgstr ""
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment