Merge pull request #183 from YunoHost/sasl_authentication

Use sasl authentication for LDAP (by root user)

data/actionsmap/test.yml

@@ -13,7 +13,7 @@ _global:
                 parameters:
                     uri: ldap://localhost:389
                     base_dn: dc=yunohost,dc=org
-                    user_rdn: cn=admin
+                    user_rdn: cn=admin,dc=yunohost,dc=org
             ldap-anonymous:
                 vendor: ldap
                 parameters:
@@ -25,7 +25,14 @@ _global:
                 parameters:
                     uri: ldap://localhost:389
                     base_dn: dc=yunohost,dc=org
-                    user_rdn: cn=admin
+                    user_rdn: cn=admin,dc=yunohost,dc=org
+            as-root:
+                vendor: ldap
+                parameters:
+                    # We can get this uri by (urllib.quote_plus('/var/run/slapd/ldapi')
+                    uri: ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi
+                    base_dn: dc=yunohost,dc=org
+                    user_rdn: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
         argument_auth: true
         lock: false
 
@@ -52,6 +59,11 @@ test:
             configuration:
                 authenticate:
                     - cli
+        root-auth:
+            api: GET /test/root-auth
+            configuration:
+                authenticate: all
+                authenticator: as-root
         anonymous:
             api: GET /test/anon
             configuration:

lib/test/test.py

@@ -17,3 +17,7 @@ def test_auth_cli():
 def test_anonymous():
     return {'action': 'anonymous',
             'authenticator': 'ldap-anonymous', 'authenticate': 'all'}
+
+def test_root():
+    return {'action': 'root-auth',
+            'authenticator': 'as-root', 'authenticate': 'all'}

moulinette/authenticators/ldap.py

@@ -7,6 +7,7 @@ import random
 import string
 import crypt
 import ldap
+import ldap.sasl
 import ldap.modlist as modlist
 
 from moulinette.core import MoulinetteError
@@ -40,8 +41,11 @@ class Authenticator(BaseAuthenticator):
         self.uri = uri
         self.basedn = base_dn
         if user_rdn:
-            self.userdn = '%s,%s' % (user_rdn, base_dn)
+            self.userdn = user_rdn
-            self.con = None
+            if 'cn=external,cn=auth' in user_rdn:
+                self.authenticate(None)
+            else:
+                self.con = None
         else:
             # Initialize anonymous usage
             self.userdn = ''
@@ -77,7 +81,10 @@ class Authenticator(BaseAuthenticator):
         try:
             con = ldap.ldapobject.ReconnectLDAPObject(self.uri, retry_max=10, retry_delay=0.5)
             if self.userdn:
-                con.simple_bind_s(self.userdn, password)
+                if 'cn=external,cn=auth' in self.userdn:
+                    con.sasl_non_interactive_bind_s('EXTERNAL')
+                else:
+                    con.simple_bind_s(self.userdn, password)
             else:
                 con.simple_bind_s()
         except ldap.INVALID_CREDENTIALS: