Merge pull request #1096 from christophert/add-ldaptlsinsecure

Add option to disable LDAPS Certificate Validation

diff --git a/.env.example b/.env.example
index 6e015335efa711ccfd1adeb1134df655a516c30a..11dafa2ab26b75870f660324ed3ac45d2338036e 100644 (file)
--- a/.env.example
+++ b/.env.example
@@ -77,6 +77,8 @@ LDAP_GROUP_ATTRIBUTE="memberOf"
 # Would you like to remove users from roles on BookStack if they do not match on LDAP
 # If false, the ldap groups-roles sync will only add users to roles
 LDAP_REMOVE_FROM_GROUPS=false
+# Set this option to disable LDAPS Certificate Verification
+LDAP_TLS_INSECURE=false
 
 # Mail settings
 MAIL_DRIVER=smtp

diff --git a/app/Auth/Access/LdapService.php b/app/Auth/Access/LdapService.php
index b49ecf129fc1d5b606c60ecb668f2e0c6736eea1..1e95ac513a340705d251d394045d39f1d0cdbe93 100644 (file)
--- a/app/Auth/Access/LdapService.php
+++ b/app/Auth/Access/LdapService.php
@@ -170,6 +170,16 @@ class LdapService
         }
         $hostName = $ldapServer[0] . ($hasProtocol?':':'') . $ldapServer[1];
         $defaultPort = $ldapServer[0] === 'ldaps' ? 636 : 389;
+
+        /*
+         * Check if TLS_INSECURE is set. The handle is set to NULL due to the nature of
+         * the LDAP_OPT_X_TLS_REQUIRE_CERT option. It can only be set globally and not
+         * per handle.
+         */
+        if($this->config['tls_insecure']) {
+            $this->ldap->setOption(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
+        }
+
         $ldapConnection = $this->ldap->connect($hostName, count($ldapServer) > 2 ? intval($ldapServer[2]) : $defaultPort);
 
         if ($ldapConnection === false) {

diff --git a/config/services.php b/config/services.php
index 857a7caa28ca197904fcf61fc3c7ff7ac9709e7b..ba16488918ab085cdc35e00fd5b29e9c0a958e59 100644 (file)
--- a/config/services.php
+++ b/config/services.php
@@ -149,6 +149,7 @@ return [
                'user_to_groups' => env('LDAP_USER_TO_GROUPS',false),
                'group_attribute' => env('LDAP_GROUP_ATTRIBUTE', 'memberOf'),
                'remove_from_groups' => env('LDAP_REMOVE_FROM_GROUPS',false),
+               'tls_insecure' => env('LDAP_TLS_INSECURE', false),
        ]
 
 ];