#Bugzilla ldap Patch

In the docs, it's good that you list ldap and ldaps, but you don't mention ldapi and what it's used for. Unless the LDAP perl module has some kind of global configuration file where one can indicates where their CA cert dir is, this is then a required option.Īnd a CA cert file option is also pratically necessary in case the LDAP server uses a self-signed certificate (you usually don't want to put your own CA cert file with the other official CA certs)Ĭomment on attachment 223097 įirst, thanks for the continued work toward making these changes.įrom my perspective, it looks like some of the conversions of ldap(s) to ldap(s|i) were missed in Bguzilla/Auth/Verify/LDAP.pm, potentially confusing developers in the future. If you don't have it, Bugzilla will have to trust blindly the LDAP server certificate allowing for man-in-the-middle attacks. Like your browser has a list of CA certs to verify the certificates returned by the secure websites.

Bugzilla) to verify the certificate returned by the LDAP server. The CA cert is not for the LDAP server but for the LDAP client (i.e. > Could you give me an actual use case for when somebody would want to specify > reason to support both versions of the SSL connection?īeside old servers that may not support the newer TLS but only the older SSL, it's certainly a configuration option and some server may be configured to not accept TLS because they never had any TLS client. > Are there LDAP servers that support SSL that don't support TLS? Is there any It looks good, and since we're opening up the development cycle for 2.24 now, we'll have time to iron it out until Sep 2006. However this one offers support for v2, TLS, cacerts and has more features (but also more complexity). I like the one there because it makes SSL look much easier, and it automatically switches to 636.

#Bugzilla ldap Patch

Question: do we automatically set the port to 636 in case of SSL? There is a patch in bug 216902 that does this, and it is most likely to conflict with this one. + certificate needed for encrypted LDAP connection, wether SSL + print 'Connecting to LDAP server failed. print 'Connecting to LDAP server failed. This identation is wrong, 3 spaces only instead of 4. It's not clear otherwise that setting the certificate is enough to start using TLS.Ĭomment on attachment 206574 'It is required for ldaps:// URIs (SSL) and will trigger TLS for ldap:// URIs' What about rephrasing the second sentence to something like: >+ 'and SSL with secure LDAP URIs (ldaps://).', It will use TLS with normal LDAP URIs (ldap://), ' _ >+ LDAPcacert => 'The certificate file or directory needed for encrypted LDAP ' _ >Index: template/en/default/admin/params/ Or it's just that tabs and spaces are mixed. It's probably not even necessary to specify the values since the user has a limited choice anyway.Īnd just to be picky, the indentation is wrong in several places in the file. >+ This is the LDAP protocol version used to bind the LDAP This is bound to fail since the value is now 2 or 3 ) >+ unless Param('LDAPversion') eq 'LDAPv3' >+ my ($value) = return 'LDAP version 3 is required' I don't know if it applies to TLS too (likely) and if it is actually a big issue. You cannot have more than one LDAPS connection at any one time, due to restrictions in the underlying Net::SSLeay code. On a side note, reading the documention about Net::LDAPS I saw that: So if 'LDAPcafile' is actually a directory, use 'capath => $LDAPcafile' instead of 'cafile => $LDAPcafile' for both SSL and TLS. It would also be cool if you could support a CA directory instead of a specific CA file. I don't know if it's actually useful or not. My patch is also doing some check on Net::SSLeay and IO::Socket::SSL. >+ if (exists $param) Īlso, when creating the connection (LDAP->new), version 3 of LDAP is required so you may want to add the 'version => 3' back, at least if TLS is going to be used. >+ # switch from ldap server name to ldap uri >Index: webtools/bugzilla/Bugzilla/Config.pm This is only used if your LDAP URI uses LDAPS. >+ desc => 'The certificate file needed for LDAPS connection', Sorry for taking so long to look at this. Patch against CVS head with spaces instead of tabs