475118 - Add LDAP auth support to Weave server

Status: RESOLVED FIXED

(Cloud Services Graveyard :: Server: Sync, defect, P1)

Description

[Anant Narayanan [:anant]]

Attachment: LDAP Authenticaion for Weave server

The weave server needs to support LDAP based authentication

Comment 1

[Anant Narayanan [:anant]]

Attachment: Weave server LDAP authentication

Fix typo

Comment 2

[Toby Elliott [:telliott]]

Attachment integrated. Leaving this bug open as a tracker for implementing the remainder of the skeleton.

Comment 3

[Reed Loden [:reed]]

You allow anonymous binds? Why?

Why isn't this stuff stored in a config rather than hardcoded in the actual code?

Comment 4

[Toby Elliott [:telliott]]

I'll let anant speak to the anonymous binds.

The constants are part of weave_constats file; I just missed pulling that set out of the top of the object when I did the integration. Thanks for the catch.

Comment 5

[Anant Narayanan [:anant]]

> You allow anonymous binds? Why?

I don't think we do. The corresponding lines of code:

> $userdn = WEAVE_LDAP_AUTH_PARAM."=$user,".WEAVE_LDAP_AUTH_DN;
> if (ldap_bind($this->_conn, $userdn, $pass))

We're binding as the user; it's not anonymous. If the bind fails, we assume it was because the password was incorrect and proceed accordingly.

Comment 6

[Anant Narayanan [:anant]]

Added a few more methods to the auth backend: http://hg.mozilla.org/labs/weaveserver/rev/2993d6b9c1f7

create_user will be fine-tuned according to the new schema as soon as I can do some tests on sm-proxy01 (which will be when we switch that box to the new ldap structure)

Comment 7

[Anant Narayanan [:anant]]

http://hg.mozilla.org/labs/weaveserver/rev/30ac838ff9cb makes the backend work with our new cluster

Comment 8

[Dan Mills [:thunder]]

This is done, no?  Or are you keeping this bug open until you port all the web pages too?

Comment 9

[Anant Narayanan [:anant]]

Yes, I'd like to make sure all the methods work as expected before closing the bug.

Comment 10

[Toby Elliott [:telliott]]

LDAP currently does not have support for the X-Weave-Alert fields, though we could move that into its own bug.

Comment 11

[Anant Narayanan [:anant]]

On a similar note we also need support for account status and alert messages, both in the LDAP schema and in this code.

Comment 12

[Dan Mills [:thunder]]

Are you including porting the dashboard as part of this bug as well?  If not I'll file a new bug for that.

Comment 13

[Anant Narayanan [:anant]]

(In reply to comment #12)
> Are you including porting the dashboard as part of this bug as well?  If not
> I'll file a new bug for that.

Separate bug would help, thanks!

Comment 14

[Anant Narayanan [:anant]]

LDAP Auth backend tested and in place (hg tip please!)

Comment 15

[Toby Elliott [:telliott]]

Comment on attachment 358520 [details] [diff] [review]
Weave server LDAP authentication

Clearing this from the review queue. It's been long-incorporated