From 253493c3937c67fee8f825dde3c1c24b0e47f154 Mon Sep 17 00:00:00 2001
From: Renato Alves <rjalves@igc.gulbenkian.pt>
Date: Mon, 25 May 2015 21:15:51 +0100
Subject: [PATCH] Allow passing advanced options to the LDAP connection

Useful to configure the connection if ldap.conf and/or ldaprc cannot be used

auth_conf.xml.sample includes an example to connect to LDAPS using
self-signed certificates.
---
 config/auth_conf.xml.sample          |  8 ++++
 lib/galaxy/auth/providers/ldap_ad.py | 57 ++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+)

diff --git a/config/auth_conf.xml.sample b/config/auth_conf.xml.sample
index 37994a6b67b..a2b7dc3906e 100644
--- a/config/auth_conf.xml.sample
+++ b/config/auth_conf.xml.sample
@@ -23,6 +23,14 @@
             <bind-password>{password}</bind-password>
             <auto-register-username>{sAMAccountName}</auto-register-username>
             <auto-register-email>{mail}</auto-register-email>
+-->
+            <!-- If your need to pass additional options to your LDAP connection, set them here
+                 The syntax is: option1=value1,option2=value2,...
+                 Options and values should match those from the python-ldap documentation.
+
+                 The following example allows connecting to ldaps:// (SSL/TLS)
+                 when self-signed certificates are used -->
+<!--        <ldap-options>OPT_X_TLS_REQUIRE_CERT=OPT_X_TLS_ALLOW</ldap-options>
 -->
             <!-- To allow login with username instead of email, default is False -->
 <!--        <login-use-username>True</login-use-username>
diff --git a/lib/galaxy/auth/providers/ldap_ad.py b/lib/galaxy/auth/providers/ldap_ad.py
index 1a631abea2b..5053641d8cb 100644
--- a/lib/galaxy/auth/providers/ldap_ad.py
+++ b/lib/galaxy/auth/providers/ldap_ad.py
@@ -19,6 +19,47 @@ def _get_subs(d, k, params):
     return str(d[k]).format(**params)
 
 
+def _parse_ldap_options(ldap, options_unparsed):
+    # Tag is defined in the XML but is empty
+    if not options_unparsed:
+        return []
+
+    if "=" not in options_unparsed:
+        log.error("LDAP authenticate: Invalid syntax in <ldap-options>. Syntax should be option1=value1,option2=value2")
+        return []
+
+    ldap_options = []
+
+    # Valid options must start with this prefix. See help(ldap)
+    prefix = "OPT_"
+
+    for opt in options_unparsed.split(","):
+        key, value = opt.split("=")
+
+        try:
+            pair = []
+            for n in (key, value):
+                if not n.startswith(prefix):
+                    raise ValueError
+
+                name = getattr(ldap, n)
+                pair.append(name)
+
+        except ValueError:
+            log.warning("LDAP authenticate: Invalid parameter pair %s=%s. '%s' doesn't start with prefix %s", key, value, n, prefix)
+            continue
+
+        except AttributeError:
+            log.warning("LDAP authenticate: Invalid parameter pair %s=%s. '%s' is not available in module ldap", key, value, n)
+            continue
+
+        else:
+            log.debug("LDAP authenticate: Valid LDAP option pair %s=%s -> %s=%s", key, value, *pair)
+            ldap_options.append(pair)
+
+    return ldap_options
+
+
 class LDAP(AuthProvider):
 
     """
@@ -59,10 +100,22 @@ class LDAP(AuthProvider):
 
         # do LDAP search (if required)
         params = {'email': email, 'username': username, 'password': password}
+
+        try:
+            ldap_options_raw = _get_subs(options, 'ldap-options', params)
+        except ConfigurationError:
+            ldap_options = ()
+        else:
+            ldap_options = _parse_ldap_options(ldap, ldap_options_raw)
+
         if 'search-fields' in options:
             try:
                 # setup connection
                 ldap.set_option(ldap.OPT_REFERRALS, 0)
+
+                for opt in ldap_options:
+                    ldap.set_option(*opt)
+
                 l = ldap.initialize(_get_subs(options, 'server', params))
                 l.protocol_version = 3
 
@@ -101,6 +154,10 @@ class LDAP(AuthProvider):
         try:
             # setup connection
             ldap.set_option(ldap.OPT_REFERRALS, 0)
+
+            for opt in ldap_options:
+                ldap.set_option(*opt)
+
             l = ldap.initialize(_get_subs(options, 'server', params))
             l.protocol_version = 3
             l.simple_bind_s(_get_subs(