Change to allow override of CA CERT for LDAPS

Using the env LDAP_TLS_CACERTFILE to set a file to use to override
the CA CERT used to verify LDAPS connections. This is to make this
process easier for docker use.

diff --git a/app/Access/LdapService.php b/app/Access/LdapService.php
index 9d266763531685377e41d7d9775d61c9803b5383..56e7aba04f7db005564799578a587fd6d0eff460 100644 (file)
--- a/app/Access/LdapService.php
+++ b/app/Access/LdapService.php
@@ -209,6 +209,12 @@ class LdapService
             $this->ldap->setOption(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
         }
 
+        // Specify CA Cert file for LDAP.
+        // This option works globally and must be set before a connection is created.
+        if ($this->config['tls_cacertfile']) {
+            $this->ldap->setOption(null, LDAP_OPT_X_TLS_CACERTFILE, $this->config['tls_cacertfile']);
+        }
+
         $ldapHost = $this->parseServerString($this->config['server']);
         $ldapConnection = $this->ldap->connect($ldapHost);
 

diff --git a/app/Config/services.php b/app/Config/services.php
index a035f10569500d5c05c552c351e7c5d512117cd3..a407b5dc876c7447ca772e7ad26fc11bae7d2f4c 100644 (file)
--- a/app/Config/services.php
+++ b/app/Config/services.php
@@ -133,6 +133,7 @@ return [
         'group_attribute'        => env('LDAP_GROUP_ATTRIBUTE', 'memberOf'),
         'remove_from_groups'     => env('LDAP_REMOVE_FROM_GROUPS', false),
         'tls_insecure'           => env('LDAP_TLS_INSECURE', false),
+        'tls_cacertfile'            => env('LDAP_TLS_CACERTFILE', false),
         'start_tls'              => env('LDAP_START_TLS', false),
         'thumbnail_attribute'    => env('LDAP_THUMBNAIL_ATTRIBUTE', null),
     ],