net-ldap 0.14.0 → 0.16.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +5 -5
- data/.gitignore +1 -0
- data/.rubocop.yml +5 -2
- data/.rubocop_todo.yml +343 -219
- data/.travis.yml +27 -3
- data/CONTRIBUTING.md +1 -1
- data/History.rdoc +21 -0
- data/README.rdoc +10 -7
- data/Rakefile +1 -1
- data/lib/net-ldap.rb +1 -1
- data/lib/net/ber.rb +5 -6
- data/lib/net/ber/ber_parser.rb +3 -3
- data/lib/net/ber/core_ext.rb +6 -6
- data/lib/net/ldap.rb +65 -55
- data/lib/net/ldap/auth_adapter/gss_spnego.rb +2 -2
- data/lib/net/ldap/auth_adapter/sasl.rb +4 -2
- data/lib/net/ldap/auth_adapter/simple.rb +1 -1
- data/lib/net/ldap/connection.rb +58 -35
- data/lib/net/ldap/dataset.rb +2 -2
- data/lib/net/ldap/dn.rb +13 -14
- data/lib/net/ldap/entry.rb +5 -6
- data/lib/net/ldap/error.rb +1 -0
- data/lib/net/ldap/filter.rb +10 -3
- data/lib/net/ldap/instrumentation.rb +2 -2
- data/lib/net/ldap/password.rb +3 -5
- data/lib/net/ldap/pdu.rb +1 -1
- data/lib/net/ldap/version.rb +1 -1
- data/lib/net/snmp.rb +1 -1
- data/net-ldap.gemspec +4 -4
- data/script/ldap-docker +12 -0
- data/test/ber/test_ber.rb +1 -1
- data/test/fixtures/ca/docker-ca.pem +18 -0
- data/test/fixtures/{openldap/retcode.ldif → ldif/06-retcode.ldif} +7 -8
- data/test/fixtures/ldif/50-seed.ldif +374 -0
- data/test/integration/test_add.rb +1 -3
- data/test/integration/test_ber.rb +2 -2
- data/test/integration/test_bind.rb +193 -14
- data/test/integration/test_delete.rb +1 -3
- data/test/integration/test_open.rb +10 -11
- data/test/integration/test_password_modify.rb +29 -16
- data/test/integration/test_return_codes.rb +12 -4
- data/test/integration/test_search.rb +8 -8
- data/test/test_dn.rb +2 -3
- data/test/test_entry.rb +3 -2
- data/test/test_filter_parser.rb +5 -0
- data/test/test_helper.rb +12 -5
- data/test/test_ldap.rb +5 -5
- data/test/test_ldap_connection.rb +47 -35
- data/test/test_ldif.rb +13 -13
- data/test/test_password.rb +2 -2
- data/test/test_snmp.rb +4 -5
- data/test/test_ssl_ber.rb +7 -3
- data/testserver/ldapserver.rb +13 -22
- metadata +17 -26
- data/script/install-openldap +0 -115
- data/test/fixtures/cacert.pem +0 -20
- data/test/fixtures/openldap/memberof.ldif +0 -33
- data/test/fixtures/openldap/slapd.conf.ldif +0 -67
- data/test/fixtures/seed.ldif +0 -374
- data/test/support/vm/openldap/README.md +0 -32
- data/test/support/vm/openldap/Vagrantfile +0 -33
data/test/test_password.rb
CHANGED
@@ -4,7 +4,7 @@ require_relative 'test_helper'
|
|
4
4
|
|
5
5
|
class TestPassword < Test::Unit::TestCase
|
6
6
|
def test_psw
|
7
|
-
assert_equal("{MD5}xq8jwrcfibi0sZdZYNkSng==", Net::LDAP::Password.generate(
|
8
|
-
assert_equal("{SHA}YE4eGkN4BvwNN1f5R7CZz0kFn14=", Net::LDAP::Password.generate(
|
7
|
+
assert_equal("{MD5}xq8jwrcfibi0sZdZYNkSng==", Net::LDAP::Password.generate(:md5, "cashflow"))
|
8
|
+
assert_equal("{SHA}YE4eGkN4BvwNN1f5R7CZz0kFn14=", Net::LDAP::Password.generate(:sha, "cashflow"))
|
9
9
|
end
|
10
10
|
end
|
data/test/test_snmp.rb
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# $Id: testsnmp.rb 231 2006-12-21 15:09:29Z blackhedd $
|
2
2
|
|
3
3
|
require_relative 'test_helper'
|
4
|
-
|
4
|
+
require_relative '../lib/net/snmp'
|
5
5
|
|
6
6
|
class TestSnmp < Test::Unit::TestCase
|
7
7
|
def self.raw_string(s)
|
@@ -17,7 +17,7 @@ class TestSnmp < Test::Unit::TestCase
|
|
17
17
|
def test_invalid_packet
|
18
18
|
data = "xxxx"
|
19
19
|
assert_raise(Net::BER::BerError) do
|
20
|
-
|
20
|
+
data.read_ber(Net::SNMP::AsnSyntax)
|
21
21
|
end
|
22
22
|
end
|
23
23
|
|
@@ -41,7 +41,7 @@ ary = data.read_ber(Net::SNMP::AsnSyntax)
|
|
41
41
|
|
42
42
|
def test_weird_packet
|
43
43
|
assert_raise(Net::SnmpPdu::Error) do
|
44
|
-
Net::SnmpPdu.parse("aaaaaaaaaaaaaa")
|
44
|
+
Net::SnmpPdu.parse("aaaaaaaaaaaaaa")
|
45
45
|
end
|
46
46
|
end
|
47
47
|
|
@@ -93,7 +93,7 @@ Net::SnmpPdu.parse("aaaaaaaaaaaaaa")
|
|
93
93
|
|
94
94
|
def test_make_bad_response
|
95
95
|
pdu = Net::SnmpPdu.new
|
96
|
-
assert_raise(Net::SnmpPdu::Error) {pdu.to_ber_string}
|
96
|
+
assert_raise(Net::SnmpPdu::Error) { pdu.to_ber_string }
|
97
97
|
pdu.pdu_type = :get_response
|
98
98
|
pdu.request_id = 999
|
99
99
|
pdu.to_ber_string
|
@@ -115,5 +115,4 @@ Net::SnmpPdu.parse("aaaaaaaaaaaaaa")
|
|
115
115
|
pdu = Net::SnmpPdu.parse(ary)
|
116
116
|
assert_equal("xxxxxx", pdu.community)
|
117
117
|
end
|
118
|
-
|
119
118
|
end
|
data/test/test_ssl_ber.rb
CHANGED
@@ -5,7 +5,7 @@ class TestSSLBER < Test::Unit::TestCase
|
|
5
5
|
# Transmits str to @to and reads it back from @from.
|
6
6
|
#
|
7
7
|
def transmit(str)
|
8
|
-
Timeout
|
8
|
+
Timeout.timeout(1) do
|
9
9
|
@to.write(str)
|
10
10
|
@to.close
|
11
11
|
|
@@ -22,18 +22,22 @@ class TestSSLBER < Test::Unit::TestCase
|
|
22
22
|
#
|
23
23
|
# TODO: Replace test with real socket
|
24
24
|
# https://github.com/ruby-ldap/ruby-net-ldap/pull/121#discussion_r18746386
|
25
|
-
flexmock(OpenSSL::SSL::SSLSocket)
|
26
|
-
new_instances.should_receive(:connect => nil)
|
25
|
+
flexmock(OpenSSL::SSL::SSLSocket)
|
26
|
+
.new_instances.should_receive(:connect => nil)
|
27
27
|
|
28
28
|
@to = Net::LDAP::Connection.wrap_with_ssl(@to)
|
29
29
|
@from = Net::LDAP::Connection.wrap_with_ssl(@from)
|
30
30
|
end
|
31
31
|
|
32
32
|
def test_transmit_strings
|
33
|
+
omit_if RUBY_PLATFORM == "java", "JRuby throws an error without a real socket"
|
34
|
+
|
33
35
|
assert_equal "foo", transmit("foo")
|
34
36
|
end
|
35
37
|
|
36
38
|
def test_transmit_ber_encoded_numbers
|
39
|
+
omit_if RUBY_PLATFORM == "java", "JRuby throws an error without a real socket"
|
40
|
+
|
37
41
|
@to.write 1234.to_ber
|
38
42
|
assert_equal 1234, @from.read_ber
|
39
43
|
end
|
data/testserver/ldapserver.rb
CHANGED
@@ -15,7 +15,6 @@
|
|
15
15
|
#------------------------------------------------
|
16
16
|
|
17
17
|
module LdapServer
|
18
|
-
|
19
18
|
LdapServerAsnSyntax = {
|
20
19
|
:application => {
|
21
20
|
:constructed => {
|
@@ -46,7 +45,7 @@ module LdapServer
|
|
46
45
|
@data ||= ""; @data << data
|
47
46
|
while pdu = @data.read_ber!(LdapServerAsnSyntax)
|
48
47
|
begin
|
49
|
-
|
48
|
+
handle_ldap_pdu pdu
|
50
49
|
rescue
|
51
50
|
$logger.error "closing connection due to error #{$!}"
|
52
51
|
close_connection
|
@@ -87,9 +86,7 @@ module LdapServer
|
|
87
86
|
end
|
88
87
|
end
|
89
88
|
|
90
|
-
|
91
|
-
|
92
|
-
#--
|
89
|
+
# --
|
93
90
|
# Search Response ::=
|
94
91
|
# CHOICE {
|
95
92
|
# entry [APPLICATION 4] SEQUENCE {
|
@@ -119,9 +116,9 @@ module LdapServer
|
|
119
116
|
# pdu[1][7] is the list of requested attributes.
|
120
117
|
# If it's an empty array, that means that *all* attributes were requested.
|
121
118
|
requested_attrs = if pdu[1][7].length > 0
|
122
|
-
|
123
|
-
|
124
|
-
|
119
|
+
pdu[1][7].map(&:downcase)
|
120
|
+
else
|
121
|
+
:all
|
125
122
|
end
|
126
123
|
|
127
124
|
filters = pdu[1][6]
|
@@ -131,13 +128,13 @@ module LdapServer
|
|
131
128
|
end
|
132
129
|
|
133
130
|
# TODO, what if this returns nil?
|
134
|
-
filter = Net::LDAP::Filter.parse_ldap_filter(
|
131
|
+
filter = Net::LDAP::Filter.parse_ldap_filter(filters)
|
135
132
|
|
136
133
|
$ldif.each do |dn, entry|
|
137
|
-
if filter.match(
|
134
|
+
if filter.match(entry)
|
138
135
|
attrs = []
|
139
136
|
entry.each do |k, v|
|
140
|
-
if requested_attrs == :all
|
137
|
+
if requested_attrs == :all || requested_attrs.include?(k.downcase)
|
141
138
|
attrvals = v.map(&:to_ber).to_ber_set
|
142
139
|
attrs << [k.to_ber, attrvals].to_ber_sequence
|
143
140
|
end
|
@@ -149,32 +146,27 @@ module LdapServer
|
|
149
146
|
end
|
150
147
|
end
|
151
148
|
|
152
|
-
|
153
149
|
send_ldap_response 5, pdu[0].to_i, 0, "", "Was that what you wanted?"
|
154
150
|
end
|
155
151
|
|
156
|
-
|
157
|
-
|
158
152
|
def send_ldap_response pkt_tag, msgid, code, dn, text
|
159
|
-
send_data(
|
153
|
+
send_data([msgid.to_ber, [code.to_ber, dn.to_ber, text.to_ber].to_ber_appsequence(pkt_tag)].to_ber)
|
160
154
|
end
|
161
|
-
|
162
155
|
end
|
163
156
|
|
164
|
-
|
165
157
|
#------------------------------------------------
|
166
158
|
|
167
159
|
# Rather bogus, a global method, which reads a HARDCODED filename
|
168
160
|
# parses out LDIF data. It will be used to serve LDAP queries out of this server.
|
169
161
|
#
|
170
162
|
def load_test_data
|
171
|
-
ary = File.readlines(
|
163
|
+
ary = File.readlines("./testdata.ldif")
|
172
164
|
hash = {}
|
173
|
-
while line = ary.shift
|
165
|
+
while (line = ary.shift) && line.chomp!
|
174
166
|
if line =~ /^dn:[\s]*/i
|
175
167
|
dn = $'
|
176
168
|
hash[dn] = {}
|
177
|
-
while attr = ary.shift
|
169
|
+
while (attr = ary.shift) && attr.chomp! && attr =~ /^([\w]+)[\s]*:[\s]*/
|
178
170
|
hash[dn][$1.downcase] ||= []
|
179
171
|
hash[dn][$1.downcase] << $'
|
180
172
|
end
|
@@ -183,7 +175,6 @@ def load_test_data
|
|
183
175
|
hash
|
184
176
|
end
|
185
177
|
|
186
|
-
|
187
178
|
#------------------------------------------------
|
188
179
|
|
189
180
|
if __FILE__ == $0
|
@@ -204,6 +195,6 @@ if __FILE__ == $0
|
|
204
195
|
EventMachine.run do
|
205
196
|
$logger.info "starting LDAP server on 127.0.0.1 port 3890"
|
206
197
|
EventMachine.start_server "127.0.0.1", 3890, LdapServer
|
207
|
-
EventMachine.add_periodic_timer 60, proc {$logger.info "heartbeat"}
|
198
|
+
EventMachine.add_periodic_timer 60, proc { $logger.info "heartbeat" }
|
208
199
|
end
|
209
200
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: net-ldap
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.16.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Francis Cianfrocca
|
@@ -10,10 +10,10 @@ authors:
|
|
10
10
|
- Kaspar Schiess
|
11
11
|
- Austin Ziegler
|
12
12
|
- Michael Schaarschmidt
|
13
|
-
autorequire:
|
13
|
+
autorequire:
|
14
14
|
bindir: bin
|
15
15
|
cert_chain: []
|
16
|
-
date:
|
16
|
+
date: 2020-08-18 00:00:00.000000000 Z
|
17
17
|
dependencies:
|
18
18
|
- !ruby/object:Gem::Dependency
|
19
19
|
name: flexmock
|
@@ -35,28 +35,28 @@ dependencies:
|
|
35
35
|
requirements:
|
36
36
|
- - "~>"
|
37
37
|
- !ruby/object:Gem::Version
|
38
|
-
version:
|
38
|
+
version: 12.3.3
|
39
39
|
type: :development
|
40
40
|
prerelease: false
|
41
41
|
version_requirements: !ruby/object:Gem::Requirement
|
42
42
|
requirements:
|
43
43
|
- - "~>"
|
44
44
|
- !ruby/object:Gem::Version
|
45
|
-
version:
|
45
|
+
version: 12.3.3
|
46
46
|
- !ruby/object:Gem::Dependency
|
47
47
|
name: rubocop
|
48
48
|
requirement: !ruby/object:Gem::Requirement
|
49
49
|
requirements:
|
50
50
|
- - "~>"
|
51
51
|
- !ruby/object:Gem::Version
|
52
|
-
version: 0.
|
52
|
+
version: 0.49.0
|
53
53
|
type: :development
|
54
54
|
prerelease: false
|
55
55
|
version_requirements: !ruby/object:Gem::Requirement
|
56
56
|
requirements:
|
57
57
|
- - "~>"
|
58
58
|
- !ruby/object:Gem::Version
|
59
|
-
version: 0.
|
59
|
+
version: 0.49.0
|
60
60
|
- !ruby/object:Gem::Dependency
|
61
61
|
name: test-unit
|
62
62
|
requirement: !ruby/object:Gem::Requirement
|
@@ -151,17 +151,15 @@ files:
|
|
151
151
|
- lib/net/snmp.rb
|
152
152
|
- net-ldap.gemspec
|
153
153
|
- script/changelog
|
154
|
-
- script/
|
154
|
+
- script/ldap-docker
|
155
155
|
- script/package
|
156
156
|
- script/release
|
157
157
|
- test/ber/core_ext/test_array.rb
|
158
158
|
- test/ber/core_ext/test_string.rb
|
159
159
|
- test/ber/test_ber.rb
|
160
|
-
- test/fixtures/
|
161
|
-
- test/fixtures/
|
162
|
-
- test/fixtures/
|
163
|
-
- test/fixtures/openldap/slapd.conf.ldif
|
164
|
-
- test/fixtures/seed.ldif
|
160
|
+
- test/fixtures/ca/docker-ca.pem
|
161
|
+
- test/fixtures/ldif/06-retcode.ldif
|
162
|
+
- test/fixtures/ldif/50-seed.ldif
|
165
163
|
- test/integration/test_add.rb
|
166
164
|
- test/integration/test_ber.rb
|
167
165
|
- test/integration/test_bind.rb
|
@@ -171,8 +169,6 @@ files:
|
|
171
169
|
- test/integration/test_return_codes.rb
|
172
170
|
- test/integration/test_search.rb
|
173
171
|
- test/support/vm/openldap/.gitignore
|
174
|
-
- test/support/vm/openldap/README.md
|
175
|
-
- test/support/vm/openldap/Vagrantfile
|
176
172
|
- test/test_auth_adapter.rb
|
177
173
|
- test/test_dn.rb
|
178
174
|
- test/test_entry.rb
|
@@ -194,7 +190,7 @@ homepage: http://github.com/ruby-ldap/ruby-net-ldap
|
|
194
190
|
licenses:
|
195
191
|
- MIT
|
196
192
|
metadata: {}
|
197
|
-
post_install_message:
|
193
|
+
post_install_message:
|
198
194
|
rdoc_options:
|
199
195
|
- "--main"
|
200
196
|
- README.rdoc
|
@@ -211,9 +207,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
211
207
|
- !ruby/object:Gem::Version
|
212
208
|
version: '0'
|
213
209
|
requirements: []
|
214
|
-
|
215
|
-
|
216
|
-
signing_key:
|
210
|
+
rubygems_version: 3.1.2
|
211
|
+
signing_key:
|
217
212
|
specification_version: 4
|
218
213
|
summary: Net::LDAP for Ruby (also called net-ldap) implements client access for the
|
219
214
|
Lightweight Directory Access Protocol (LDAP), an IETF standard protocol for accessing
|
@@ -222,11 +217,9 @@ test_files:
|
|
222
217
|
- test/ber/core_ext/test_array.rb
|
223
218
|
- test/ber/core_ext/test_string.rb
|
224
219
|
- test/ber/test_ber.rb
|
225
|
-
- test/fixtures/
|
226
|
-
- test/fixtures/
|
227
|
-
- test/fixtures/
|
228
|
-
- test/fixtures/openldap/slapd.conf.ldif
|
229
|
-
- test/fixtures/seed.ldif
|
220
|
+
- test/fixtures/ca/docker-ca.pem
|
221
|
+
- test/fixtures/ldif/06-retcode.ldif
|
222
|
+
- test/fixtures/ldif/50-seed.ldif
|
230
223
|
- test/integration/test_add.rb
|
231
224
|
- test/integration/test_ber.rb
|
232
225
|
- test/integration/test_bind.rb
|
@@ -236,8 +229,6 @@ test_files:
|
|
236
229
|
- test/integration/test_return_codes.rb
|
237
230
|
- test/integration/test_search.rb
|
238
231
|
- test/support/vm/openldap/.gitignore
|
239
|
-
- test/support/vm/openldap/README.md
|
240
|
-
- test/support/vm/openldap/Vagrantfile
|
241
232
|
- test/test_auth_adapter.rb
|
242
233
|
- test/test_dn.rb
|
243
234
|
- test/test_entry.rb
|
data/script/install-openldap
DELETED
@@ -1,115 +0,0 @@
|
|
1
|
-
#!/usr/bin/env sh
|
2
|
-
set -e
|
3
|
-
set -x
|
4
|
-
|
5
|
-
BASE_PATH="$( cd `dirname $0`/../test/fixtures/openldap && pwd )"
|
6
|
-
SEED_PATH="$( cd `dirname $0`/../test/fixtures && pwd )"
|
7
|
-
|
8
|
-
dpkg -s slapd time ldap-utils gnutls-bin ssl-cert > /dev/null ||\
|
9
|
-
DEBIAN_FRONTEND=noninteractive apt-get update -y --force-yes && \
|
10
|
-
DEBIAN_FRONTEND=noninteractive apt-get install -y --force-yes slapd time ldap-utils gnutls-bin ssl-cert
|
11
|
-
|
12
|
-
/etc/init.d/slapd stop
|
13
|
-
|
14
|
-
TMPDIR=$(mktemp -d)
|
15
|
-
cd $TMPDIR
|
16
|
-
|
17
|
-
# Delete data and reconfigure.
|
18
|
-
cp -v /var/lib/ldap/DB_CONFIG ./DB_CONFIG
|
19
|
-
rm -rf /etc/ldap/slapd.d/*
|
20
|
-
rm -rf /var/lib/ldap/*
|
21
|
-
cp -v ./DB_CONFIG /var/lib/ldap/DB_CONFIG
|
22
|
-
slapadd -F /etc/ldap/slapd.d -b "cn=config" -l $BASE_PATH/slapd.conf.ldif
|
23
|
-
# Load memberof and ref-int overlays and configure them.
|
24
|
-
slapadd -F /etc/ldap/slapd.d -b "cn=config" -l $BASE_PATH/memberof.ldif
|
25
|
-
# Load retcode overlay and configure
|
26
|
-
slapadd -F /etc/ldap/slapd.d -b "cn=config" -l $BASE_PATH/retcode.ldif
|
27
|
-
|
28
|
-
# Add base domain.
|
29
|
-
slapadd -F /etc/ldap/slapd.d <<EOM
|
30
|
-
dn: dc=rubyldap,dc=com
|
31
|
-
objectClass: top
|
32
|
-
objectClass: domain
|
33
|
-
dc: rubyldap
|
34
|
-
EOM
|
35
|
-
|
36
|
-
chown -R openldap.openldap /etc/ldap/slapd.d
|
37
|
-
chown -R openldap.openldap /var/lib/ldap
|
38
|
-
|
39
|
-
/etc/init.d/slapd start
|
40
|
-
|
41
|
-
# Import seed data.
|
42
|
-
# NOTE: use ldapadd in order for memberOf and refint to apply, instead of:
|
43
|
-
# cat $SEED_PATH/seed.ldif | slapadd -F /etc/ldap/slapd.d
|
44
|
-
/usr/bin/time ldapadd -x -D "cn=admin,dc=rubyldap,dc=com" -w passworD1 \
|
45
|
-
-h localhost -p 389 \
|
46
|
-
-f $SEED_PATH/seed.ldif
|
47
|
-
|
48
|
-
rm -rf $TMPDIR
|
49
|
-
|
50
|
-
# SSL
|
51
|
-
|
52
|
-
sh -c "certtool --generate-privkey > /etc/ssl/private/cakey.pem"
|
53
|
-
|
54
|
-
sh -c "cat > /etc/ssl/ca.info <<EOF
|
55
|
-
cn = rubyldap
|
56
|
-
ca
|
57
|
-
cert_signing_key
|
58
|
-
EOF"
|
59
|
-
|
60
|
-
# Create the self-signed CA certificate:
|
61
|
-
certtool --generate-self-signed \
|
62
|
-
--load-privkey /etc/ssl/private/cakey.pem \
|
63
|
-
--template /etc/ssl/ca.info \
|
64
|
-
--outfile /etc/ssl/certs/cacert.pem
|
65
|
-
|
66
|
-
# Make a private key for the server:
|
67
|
-
certtool --generate-privkey \
|
68
|
-
--bits 1024 \
|
69
|
-
--outfile /etc/ssl/private/ldap01_slapd_key.pem
|
70
|
-
|
71
|
-
sh -c "cat > /etc/ssl/ldap01.info <<EOF
|
72
|
-
organization = Example Company
|
73
|
-
cn = ldap01.example.com
|
74
|
-
tls_www_server
|
75
|
-
encryption_key
|
76
|
-
signing_key
|
77
|
-
expiration_days = 3650
|
78
|
-
EOF"
|
79
|
-
|
80
|
-
# Create the server certificate
|
81
|
-
certtool --generate-certificate \
|
82
|
-
--load-privkey /etc/ssl/private/ldap01_slapd_key.pem \
|
83
|
-
--load-ca-certificate /etc/ssl/certs/cacert.pem \
|
84
|
-
--load-ca-privkey /etc/ssl/private/cakey.pem \
|
85
|
-
--template /etc/ssl/ldap01.info \
|
86
|
-
--outfile /etc/ssl/certs/ldap01_slapd_cert.pem
|
87
|
-
|
88
|
-
ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF | true
|
89
|
-
dn: cn=config
|
90
|
-
add: olcTLSCACertificateFile
|
91
|
-
olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
|
92
|
-
-
|
93
|
-
add: olcTLSCertificateFile
|
94
|
-
olcTLSCertificateFile: /etc/ssl/certs/ldap01_slapd_cert.pem
|
95
|
-
-
|
96
|
-
add: olcTLSCertificateKeyFile
|
97
|
-
olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem
|
98
|
-
EOF
|
99
|
-
|
100
|
-
# LDAP over TLS/SSL (ldaps://) is deprecated in favour of StartTLS. The latter
|
101
|
-
# refers to an existing LDAP session (listening on TCP port 389) becoming
|
102
|
-
# protected by TLS/SSL whereas LDAPS, like HTTPS, is a distinct
|
103
|
-
# encrypted-from-the-start protocol that operates over TCP port 636. But we
|
104
|
-
# enable it for testing here.
|
105
|
-
sed -i -e 's|^SLAPD_SERVICES="\(.*\)"|SLAPD_SERVICES="ldap:/// ldapi:/// ldaps:///"|' /etc/default/slapd
|
106
|
-
|
107
|
-
adduser openldap ssl-cert
|
108
|
-
chgrp ssl-cert /etc/ssl/private/ldap01_slapd_key.pem
|
109
|
-
chmod g+r /etc/ssl/private/ldap01_slapd_key.pem
|
110
|
-
chmod o-r /etc/ssl/private/ldap01_slapd_key.pem
|
111
|
-
|
112
|
-
# Drop packets on a secondary port used to specific timeout tests
|
113
|
-
iptables -A OUTPUT -p tcp -j DROP --dport 8389
|
114
|
-
|
115
|
-
service slapd restart
|
data/test/fixtures/cacert.pem
DELETED
@@ -1,20 +0,0 @@
|
|
1
|
-
-----BEGIN CERTIFICATE-----
|
2
|
-
MIIDRzCCAf+gAwIBAgIEVHpbmjANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDEwhy
|
3
|
-
dWJ5bGRhcDAeFw0xNDExMjkyMzQ5NDZaFw0xNTExMjkyMzQ5NDZaMBMxETAPBgNV
|
4
|
-
BAMTCHJ1YnlsZGFwMIIBUjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEA4pKe
|
5
|
-
cDCNuL53fkpO/WSAS+gmMTsOs+oOK71kZlk2QT/MBz8TxC6m358qCADjnXcMVVxa
|
6
|
-
ySQbQlVKZMkIvLNciZbiLDgC5II0NbHACNa8rqenoKRjS4J9W3OhA8EmnXn/Me+8
|
7
|
-
uMCI9tfnKNRZYdkQZlra4I+Idn+xYfl/5q5b/7ZjPS2zY/585hFEYE+5vfOZVBSU
|
8
|
-
3HMNSeuJvTehLv7dD7aQfXNM4cRgHXequkJQ/HLLFAO4AgJ+LJrFWpj7GWz3crgr
|
9
|
-
9G5px4T78wJH3NQiOsG6UBXPw8c4T+Z6GAWX2l1zs1gZsaiCVbAraqK3404lL7yp
|
10
|
-
+ThbsW3ifzgNPhmjScXBLdbEDrrAKosW7kkTOGzxiMCBmNlj2SKhcztoduAtfF1f
|
11
|
-
Fs2Jk8MRTHwO8ThD7wIDAQABo0MwQTAPBgNVHRMBAf8EBTADAQH/MA8GA1UdDwEB
|
12
|
-
/wQFAwMHBAAwHQYDVR0OBBYEFJDm67ekyFu4/Z7VcO6Vk/5pinGcMA0GCSqGSIb3
|
13
|
-
DQEBCwUAA4IBMQDHeEPzfYRtjynpUKyrtxx/6ZVOfCLuz4eHkBZggz/pJacDCv/a
|
14
|
-
I//W03XCk8RWq/fWVVUzvxXgPwnYcw992PLM7XW81zp6ruRUDWooYnjHZZz3bRhe
|
15
|
-
kC4QvM2mZhcsMVmhmWWKZn81qXgVdUY1XNRhk87cuXjF/UTpEieFvWAsCUkFZkqB
|
16
|
-
AmySCuI/FuPaauT1YAltkIlYAEIGNJGZDMf2BTVUQpXhTXeS9/AZWLNDBwiq+fwo
|
17
|
-
YYnsr9MnBXCEmg1gVSR/Ay2AZmbYfiYtb5kU8uq2lSWAUb4LX6HZl82wo3OilrJ2
|
18
|
-
WXl6Qf+Fcy4qqkRt4AKHjtzizpEDCOVYuuG0Zoy+QnxNXRsEzpb8ymnJFrcgYfk/
|
19
|
-
6Lv2gWAFl5FqCZp7gBWg55eL2coT4C+mbNTF
|
20
|
-
-----END CERTIFICATE-----
|