Skip to content
This repository was archived by the owner on Nov 17, 2020. It is now read-only.

Commit 87af60b

Browse files
michaelklishinmichaelklishin
committed
Make it possible to configure TLS options via auth_ldap.ssl_options
Much like we do for the server. Closes #88. [#156159684]
1 parent cba1a4c commit 87af60b

File tree

5 files changed

+257
-15
lines changed

5 files changed

+257
-15
lines changed

‎priv/schema/rabbitmq_auth_backend_ldap.schema‎

Lines changed: 128 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -33,20 +33,6 @@ fun(Conf) ->
3333
end
3434
end}.
3535

36-
%% Connect to the LDAP server using SSL
37-
%%
38-
%% {use_ssl, false},
39-
40-
{mapping, "auth_ldap.use_ssl", "rabbitmq_auth_backend_ldap.use_ssl",
41-
[{datatype, {enum, [true, false]}}]}.
42-
43-
%% Connect to the LDAP server using StartTLS
44-
%%
45-
%% {use_starttls, false},
46-
47-
{mapping, "auth_ldap.use_starttls", "rabbitmq_auth_backend_ldap.use_starttls",
48-
[{datatype, {enum, [true, false]}}]}.
49-
5036
%% Specify the LDAP port to connect to
5137
%%
5238
%% {port, 389},
@@ -210,3 +196,131 @@ end}.
210196
%%
211197
%% {tag_queries, []}
212198
% ]},
199+
200+
%% Connect to the LDAP server using TLS
201+
%%
202+
%% {use_ssl, false},
203+
204+
{mapping, "auth_ldap.use_ssl", "rabbitmq_auth_backend_ldap.use_ssl",
205+
[{datatype, {enum, [true, false]}}]}.
206+
207+
%% Connect to the LDAP server using StartTLS
208+
%%
209+
%% {use_starttls, false},
210+
211+
{mapping, "auth_ldap.use_starttls", "rabbitmq_auth_backend_ldap.use_starttls",
212+
[{datatype, {enum, [true, false]}}]}.
213+
214+
215+
%% TLS options
216+
217+
{mapping, "auth_ldap.ssl_options", "rabbitmq_auth_backend_ldap.ssl_options", [
218+
{datatype, {enum, [none]}}
219+
]}.
220+
221+
{translation, "rabbitmq_auth_backend_ldap.ssl_options",
222+
fun(Conf) ->
223+
case cuttlefish:conf_get("auth_ldap.ssl_options", Conf, undefined) of
224+
none -> [];
225+
_ -> cuttlefish:invalid("Invalid auth_ldap.ssl_options")
226+
end
227+
end}.
228+
229+
{mapping, "auth_ldap.ssl_options.verify", "rabbitmq_auth_backend_ldap.ssl_options.verify", [
230+
{datatype, {enum, [verify_peer, verify_none]}}]}.
231+
232+
{mapping, "auth_ldap.ssl_options.fail_if_no_peer_cert", "rabbitmq_auth_backend_ldap.ssl_options.fail_if_no_peer_cert", [
233+
{datatype, {enum, [true, false]}}]}.
234+
235+
{mapping, "auth_ldap.ssl_options.cacertfile", "rabbitmq_auth_backend_ldap.ssl_options.cacertfile",
236+
[{datatype, string}, {validators, ["file_accessible"]}]}.
237+
238+
{mapping, "auth_ldap.ssl_options.certfile", "rabbitmq_auth_backend_ldap.ssl_options.certfile",
239+
[{datatype, string}, {validators, ["file_accessible"]}]}.
240+
241+
{mapping, "auth_ldap.ssl_options.cacerts.$name", "rabbitmq_auth_backend_ldap.ssl_options.cacerts",
242+
[{datatype, string}]}.
243+
244+
{translation, "rabbitmq_auth_backend_ldap.ssl_options.cacerts",
245+
fun(Conf) ->
246+
Settings = cuttlefish_variable:filter_by_prefix("auth_ldap.ssl_options.cacerts", Conf),
247+
[ list_to_binary(V) || {_, V} <- Settings ]
248+
end}.
249+
250+
{mapping, "auth_ldap.ssl_options.cert", "rabbitmq_auth_backend_ldap.ssl_options.cert",
251+
[{datatype, string}]}.
252+
253+
{translation, "rabbitmq_auth_backend_ldap.ssl_options.cert",
254+
fun(Conf) ->
255+
list_to_binary(cuttlefish:conf_get("auth_ldap.ssl_options.cert", Conf))
256+
end}.
257+
258+
{mapping, "auth_ldap.ssl_options.client_renegotiation", "rabbitmq_auth_backend_ldap.ssl_options.client_renegotiation",
259+
[{datatype, {enum, [true, false]}}]}.
260+
261+
{mapping, "auth_ldap.ssl_options.crl_check", "rabbitmq_auth_backend_ldap.ssl_options.crl_check",
262+
[{datatype, [{enum, [true, false, peer, best_effort]}]}]}.
263+
264+
{mapping, "auth_ldap.ssl_options.depth", "rabbitmq_auth_backend_ldap.ssl_options.depth",
265+
[{datatype, integer}, {validators, ["byte"]}]}.
266+
267+
{mapping, "auth_ldap.ssl_options.dh", "rabbitmq_auth_backend_ldap.ssl_options.dh",
268+
[{datatype, string}]}.
269+
270+
{translation, "rabbitmq_auth_backend_ldap.ssl_options.dh",
271+
fun(Conf) ->
272+
list_to_binary(cuttlefish:conf_get("auth_ldap.ssl_options.dh", Conf))
273+
end}.
274+
275+
{mapping, "auth_ldap.ssl_options.dhfile", "rabbitmq_auth_backend_ldap.ssl_options.dhfile",
276+
[{datatype, string}, {validators, ["file_accessible"]}]}.
277+
278+
{mapping, "auth_ldap.ssl_options.honor_cipher_order", "rabbitmq_auth_backend_ldap.ssl_options.honor_cipher_order",
279+
[{datatype, {enum, [true, false]}}]}.
280+
281+
{mapping, "auth_ldap.ssl_options.honor_ecc_order", "rabbitmq_auth_backend_ldap.ssl_options.honor_ecc_order",
282+
[{datatype, {enum, [true, false]}}]}.
283+
284+
{mapping, "auth_ldap.ssl_options.key.RSAPrivateKey", "rabbitmq_auth_backend_ldap.ssl_options.key",
285+
[{datatype, string}]}.
286+
287+
{mapping, "auth_ldap.ssl_options.key.DSAPrivateKey", "rabbitmq_auth_backend_ldap.ssl_options.key",
288+
[{datatype, string}]}.
289+
290+
{mapping, "auth_ldap.ssl_options.key.PrivateKeyInfo", "rabbitmq_auth_backend_ldap.ssl_options.key",
291+
[{datatype, string}]}.
292+
293+
{translation, "rabbitmq_auth_backend_ldap.ssl_options.key",
294+
fun(Conf) ->
295+
case cuttlefish_variable:filter_by_prefix("auth_ldap.ssl_options.key", Conf) of
296+
[{[_,_,Key], Val}|_] -> {list_to_atom(Key), list_to_binary(Val)};
297+
_ -> undefined
298+
end
299+
end}.
300+
301+
{mapping, "auth_ldap.ssl_options.keyfile", "rabbitmq_auth_backend_ldap.ssl_options.keyfile",
302+
[{datatype, string}, {validators, ["file_accessible"]}]}.
303+
304+
{mapping, "auth_ldap.ssl_options.log_alert", "rabbitmq_auth_backend_ldap.ssl_options.log_alert",
305+
[{datatype, {enum, [true, false]}}]}.
306+
307+
{mapping, "auth_ldap.ssl_options.password", "rabbitmq_auth_backend_ldap.ssl_options.password",
308+
[{datatype, string}]}.
309+
310+
{mapping, "auth_ldap.ssl_options.psk_identity", "rabbitmq_auth_backend_ldap.ssl_options.psk_identity",
311+
[{datatype, string}]}.
312+
313+
{mapping, "auth_ldap.ssl_options.reuse_sessions", "rabbitmq_auth_backend_ldap.ssl_options.reuse_sessions",
314+
[{datatype, {enum, [true, false]}}]}.
315+
316+
{mapping, "auth_ldap.ssl_options.secure_renegotiate", "rabbitmq_auth_backend_ldap.ssl_options.secure_renegotiate",
317+
[{datatype, {enum, [true, false]}}]}.
318+
319+
{mapping, "auth_ldap.ssl_options.versions.$version", "rabbitmq_auth_backend_ldap.ssl_options.versions",
320+
[{datatype, atom}]}.
321+
322+
{translation, "rabbitmq_auth_backend_ldap.ssl_options.versions",
323+
fun(Conf) ->
324+
Settings = cuttlefish_variable:filter_by_prefix("auth_ldap.ssl_options.versions", Conf),
325+
[ V || {_, V} <- Settings ]
326+
end}.

‎test/config_schema_SUITE_data/certs/cacert.pem‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
I'm not a certificate

‎test/config_schema_SUITE_data/certs/cert.pem‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
I'm not a certificate

‎test/config_schema_SUITE_data/certs/key.pem‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
I'm not a certificate

‎test/config_schema_SUITE_data/rabbitmq_auth_backend_ldap.snippets‎

Lines changed: 126 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,4 +121,129 @@
121121
"auth_ldap.other_bind.user_dn = username
122122
auth_ldap.other_bind.password = password",
123123
[{rabbitmq_auth_backend_ldap,[{other_bind,{"username","password"}}]}],
124-
[rabbitmq_auth_backend_ldap]}].
124+
[rabbitmq_auth_backend_ldap]},
125+
126+
{ssl_options,
127+
"auth_ldap.use_ssl = true
128+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
129+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
130+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
131+
auth_ldap.ssl_options.verify = verify_peer
132+
auth_ldap.ssl_options.fail_if_no_peer_cert = true",
133+
[{rabbitmq_auth_backend_ldap, [
134+
{use_ssl, true},
135+
{ssl_options,
136+
[{cacertfile, "test/config_schema_SUITE_data/certs/cacert.pem"},
137+
{certfile, "test/config_schema_SUITE_data/certs/cert.pem"},
138+
{keyfile, "test/config_schema_SUITE_data/certs/key.pem"},
139+
{verify, verify_peer},
140+
{fail_if_no_peer_cert, true}]}
141+
]}],
142+
[rabbitmq_auth_backend_ldap]},
143+
144+
{ssl_options_verify_peer,
145+
"auth_ldap.use_ssl = true
146+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
147+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
148+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
149+
auth_ldap.ssl_options.verify = verify_peer
150+
auth_ldap.ssl_options.fail_if_no_peer_cert = false",
151+
[{rabbitmq_auth_backend_ldap,
152+
[{use_ssl, true},
153+
{ssl_options,
154+
[{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
155+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
156+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
157+
{verify,verify_peer},
158+
{fail_if_no_peer_cert,false}]}]}],
159+
[]},
160+
{ssl_options_password,
161+
"auth_ldap.use_ssl = true
162+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
163+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
164+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
165+
auth_ldap.ssl_options.password = t0p$3kRe7",
166+
[{rabbitmq_auth_backend_ldap,
167+
[{use_ssl, true},
168+
{ssl_options,
169+
[{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
170+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
171+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
172+
{password,"t0p$3kRe7"}]}]}],
173+
[]},
174+
{ssl_options_tls_versions,
175+
"auth_ldap.use_ssl = true
176+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
177+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
178+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
179+
auth_ldap.ssl_options.versions.tls1_2 = tlsv1.2
180+
auth_ldap.ssl_options.versions.tls1_1 = tlsv1.1",
181+
[],
182+
[{rabbitmq_auth_backend_ldap,
183+
[{ssl_options,
184+
[{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
185+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
186+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
187+
{versions,['tlsv1.2','tlsv1.1']}]},
188+
{use_ssl, true}]}],
189+
[]},
190+
{ssl_options_depth,
191+
"auth_ldap.use_ssl = true
192+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
193+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
194+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
195+
auth_ldap.ssl_options.depth = 2
196+
auth_ldap.ssl_options.verify = verify_peer
197+
auth_ldap.ssl_options.fail_if_no_peer_cert = false",
198+
[{rabbitmq_auth_backend_ldap,
199+
[{use_ssl, true},
200+
{ssl_options,
201+
[{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
202+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
203+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
204+
{depth,2},
205+
{verify,verify_peer},
206+
{fail_if_no_peer_cert,false}]}]}],
207+
[]},
208+
{ssl_options_honor_cipher_order,
209+
"auth_ldap.use_ssl = true
210+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
211+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
212+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
213+
auth_ldap.ssl_options.depth = 2
214+
auth_ldap.ssl_options.verify = verify_peer
215+
auth_ldap.ssl_options.fail_if_no_peer_cert = false
216+
auth_ldap.ssl_options.honor_cipher_order = true",
217+
[{rabbitmq_auth_backend_ldap,
218+
[{use_ssl, true},
219+
{ssl_options,
220+
[{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
221+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
222+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
223+
{depth,2},
224+
{verify,verify_peer},
225+
{fail_if_no_peer_cert, false},
226+
{honor_cipher_order, true}]}]}],
227+
[]},
228+
{ssl_options_honor_ecc_order,
229+
"auth_ldap.use_ssl = true
230+
auth_ldap.ssl_options.cacertfile = test/config_schema_SUITE_data/certs/cacert.pem
231+
auth_ldap.ssl_options.certfile = test/config_schema_SUITE_data/certs/cert.pem
232+
auth_ldap.ssl_options.keyfile = test/config_schema_SUITE_data/certs/key.pem
233+
auth_ldap.ssl_options.depth = 2
234+
auth_ldap.ssl_options.verify = verify_peer
235+
auth_ldap.ssl_options.fail_if_no_peer_cert = false
236+
auth_ldap.ssl_options.honor_ecc_order = true",
237+
[{rabbitmq_auth_backend_ldap,
238+
[{use_ssl, true},
239+
{ssl_options,
240+
[{cacertfile,"test/config_schema_SUITE_data/certs/cacert.pem"},
241+
{certfile,"test/config_schema_SUITE_data/certs/cert.pem"},
242+
{keyfile,"test/config_schema_SUITE_data/certs/key.pem"},
243+
{depth,2},
244+
{verify,verify_peer},
245+
{fail_if_no_peer_cert, false},
246+
{honor_ecc_order, true}]}]}],
247+
[]}
248+
249+
].

0 commit comments

Comments
 (0)