saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge pull request #37219 from alex-zel/fix-freeipa-ldap-groups

Browse source 
Fix freeipa ldap groups
This commit is contained in:
Mike Place 2016-10-28 13:33:37 +09:00 • committed by GitHub
commit e0baf4b193
1 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
salt/auth/ldap.py
View file

@ -341,6 +341,26 @@ def groups(username, **kwargs):
if 'cn' in entry:
group_list.append(entry['cn'][0])
log.debug('User {0} is a member of groups: {1}'.format(username, group_list))
elif _config('freeipa'):
escaped_username = ldap.filter.escape_filter_chars(username)
search_base = _config('group_basedn')
search_string = _render_template(_config('group_filter'), escaped_username)
search_results = bind.search_s(search_base,
ldap.SCOPE_SUBTREE,
search_string,
[_config('accountattributename'), 'cn'])
for entry, result in search_results:
for user in result[_config('accountattributename')]:
if username == user.split(',')[0].split('=')[-1]:
group_list.append(entry.split(',')[0].split('=')[-1])
log.debug('User {0} is a member of groups: {1}'.format(username, group_list))
if not auth(username, kwargs['password']):
log.error('LDAP username and password do not match')
return []
else:
if _config('groupou'):
search_base = 'ou={0},{1}'.format(_config('groupou'), _config('basedn'))