[freeipa PR#2697][opened] LDAPClient: Prefer LDAPI connections in installer and simplify API
by tiran
URL: https://github.com/freeipa/freeipa/pull/2697
Author: tiran
Title: #2697: LDAPClient: Prefer LDAPI connections in installer and simplify API
Action: opened
PR body:
"""
On several occasions the installer uses LDAP + simple_bind rather than LDAPI with EXTERNAL bind. LDAPI (LDAP over Unix socket) is more secure, a tiny bit faster, and is immune to some network/DNS related issues.
The changeset simplifies the LDAPClient API by introducing additional constructors. The new constructors are not only easier to use but also prevent some common pitfalls like LDAP connection without StartTSL. Several code paths now use ``LDAPClient.from_realm(realm_name)`` with external bind as root instead of LDAP with DM password.
### Add constructors to ldap client
Add LDAPClient.from_realm(), LDAPClient.from_hostname_secure(), and
LDAPClient.from_hostname_plain() constructors.
The simple_bind() method now also refuses to transmit a password over a
plain, unencrypted line.
LDAPClient.from_hostname_secure() uses start_tls and FreeIPA's CA cert
by default. The constructor also automatically disables start_tls for
ldaps and ldapi connections.
### Use new LDAPClient constructors
Replace get_ldap_uri() + LDAPClient() with new LDAPClient constructors
like LDAPClient.from_realm().
Some places now use LDAPI with external bind instead of LDAP with simple
bind. Although the FQDN *should* resolve to 127.0.0.1 / [::1], there is
no hard guarantee. The draft
tools.ietf.org/html/draft-west-let-localhost-be-localhost-04#section-5.1
specifies that applications must verify that the resulting IP is a
loopback API. LDAPI is always local and a bit more efficient, too.
The simple_bind() method also prevents the caller from sending a
password over an insecure line.
### Use LDAPS when installing CA on replica
On a replica, 389-DS is already configured for secure connections when
the CA is installed.
### Move realm_to_serverid/ldap_uri to ipaldap
The helper function realm_to_serverid() and realm_to_ldap_uri() are
useful outside the server installation framework. They are now in
ipapython.ipaldap along other helpers for LDAP handling in FreeIPA.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2697/head:pr2697
git checkout pr2697
5 years, 1 month