From: lpsolit%gmail.com <>
Date: Fri, 2 Jun 2006 18:52:48 +0000 (+0000)
Subject: Bug 282687: LDAP: TLS Support - Patch by guillomovitch@zarb.org r=mkanat a=justdave
X-Git-Tag: bugzilla-2.23.2~142
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ba60234f46f8f5a291983111951c6158671f7d7;p=thirdparty%2Fbugzilla.git

Bug 282687: LDAP: TLS Support - Patch by guillomovitch@zarb.org r=mkanat a=justdave
---

diff --git a/Bugzilla/Auth/Verify/LDAP.pm b/Bugzilla/Auth/Verify/LDAP.pm
index dccfa0b7c2..2ee5247ec5 100644
--- a/Bugzilla/Auth/Verify/LDAP.pm
+++ b/Bugzilla/Auth/Verify/LDAP.pm
@@ -164,6 +164,14 @@ sub ldap {
     my $conn_string = "$protocol://$server:$port";
     $self->{ldap} = new Net::LDAP($conn_string) 
         || ThrowCodeError("ldap_connect_failed", { server => $conn_string });
+
+    # try to start TLS if needed
+    if (Param("LDAPstarttls")) {
+        my $mesg = $self->{ldap}->start_tls();
+        ThrowCodeError("ldap_start_tls_failed", { error => $mesg->error() })
+            if $mesg->code();
+    }
+
     return $self->{ldap};
 }
 
diff --git a/Bugzilla/Config/LDAP.pm b/Bugzilla/Config/LDAP.pm
index 3f123243b1..a9b46382e3 100644
--- a/Bugzilla/Config/LDAP.pm
+++ b/Bugzilla/Config/LDAP.pm
@@ -46,6 +46,12 @@ sub get_param_list {
    default => ''
   },
 
+  {
+   name => 'LDAPstarttls',
+   type => 'b',
+   default => 0
+  },
+
   {
    name => 'LDAPbinddn',
    type => 't',
diff --git a/template/en/default/admin/params/ldap.html.tmpl b/template/en/default/admin/params/ldap.html.tmpl
index 0490aa6758..aef2713b10 100644
--- a/template/en/default/admin/params/ldap.html.tmpl
+++ b/template/en/default/admin/params/ldap.html.tmpl
@@ -29,6 +29,9 @@
                 "(e.g. ldap.company.com, or ldap.company.com:portnum). " _
                 "Can be prefixed with ldap:// (default) or ldaps:// (for a secure connection).",
 
+  LDAPstartls => "Whether to require encrypted communication once normal " _
+                 "LDAP connection achieved with the server.",
+
   LDAPbinddn => "If your LDAP server requires that you use a binddn and password " _
                 "instead of binding anonymously, enter it here " _
                 "(e.g. cn=default,cn=user:password). " _
diff --git a/template/en/default/global/code-error.html.tmpl b/template/en/default/global/code-error.html.tmpl
index a836297136..0ec46461f8 100644
--- a/template/en/default/global/code-error.html.tmpl
+++ b/template/en/default/global/code-error.html.tmpl
@@ -270,6 +270,9 @@
   [% ELSIF error == "ldap_connect_failed" %]
     Could not connect to the LDAP server <code>[% server FILTER html %]</code>.
 
+  [% ELSIF error == "ldap_start_tls_failed" %]
+    Could not start TLS with LDAP server: <code>[% error FILTER html %]</code>.
+
   [% ELSIF error == "ldap_search_error" %]
     An error occurred while trying to search LDAP for 
     &quot;[% username FILTER html %]&quot;: