|
|
|
@ -18,6 +18,7 @@ package cmd |
|
|
|
|
|
|
|
|
|
|
|
import ( |
|
|
|
import ( |
|
|
|
"crypto/tls" |
|
|
|
"crypto/tls" |
|
|
|
|
|
|
|
"crypto/x509" |
|
|
|
"errors" |
|
|
|
"errors" |
|
|
|
"fmt" |
|
|
|
"fmt" |
|
|
|
"log" |
|
|
|
"log" |
|
|
|
@ -42,6 +43,7 @@ type ldapServerConfig struct { |
|
|
|
// STS credentials expiry duration
|
|
|
|
// STS credentials expiry duration
|
|
|
|
STSExpiryDuration string `json:"stsExpiryDuration"` |
|
|
|
STSExpiryDuration string `json:"stsExpiryDuration"` |
|
|
|
stsExpiryDuration time.Duration // contains converted value
|
|
|
|
stsExpiryDuration time.Duration // contains converted value
|
|
|
|
|
|
|
|
rootCAs *x509.CertPool // contains custom CAs for ldaps server.
|
|
|
|
|
|
|
|
|
|
|
|
// Skips TLS verification (for testing, not
|
|
|
|
// Skips TLS verification (for testing, not
|
|
|
|
// recommended in production).
|
|
|
|
// recommended in production).
|
|
|
|
@ -61,22 +63,22 @@ func (l *ldapServerConfig) Connect() (ldapConn *ldap.Conn, err error) { |
|
|
|
return |
|
|
|
return |
|
|
|
} |
|
|
|
} |
|
|
|
if l.SkipTLSVerify { |
|
|
|
if l.SkipTLSVerify { |
|
|
|
ldapConn, err = ldap.DialTLS("tcp", l.ServerAddr, &tls.Config{InsecureSkipVerify: true}) |
|
|
|
ldapConn, err = ldap.DialTLS("tcp", l.ServerAddr, &tls.Config{RootCAs: l.rootCAs, InsecureSkipVerify: true}) |
|
|
|
} else { |
|
|
|
} else { |
|
|
|
ldapConn, err = ldap.DialTLS("tcp", l.ServerAddr, &tls.Config{}) |
|
|
|
ldapConn, err = ldap.DialTLS("tcp", l.ServerAddr, &tls.Config{RootCAs: l.rootCAs}) |
|
|
|
} |
|
|
|
} |
|
|
|
return |
|
|
|
return |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
// newLDAPConfigFromEnv loads configuration from the environment
|
|
|
|
// newLDAPConfigFromEnv loads configuration from the environment
|
|
|
|
func newLDAPConfigFromEnv() (l ldapServerConfig, err error) { |
|
|
|
func newLDAPConfigFromEnv(rootCAs *x509.CertPool) (l ldapServerConfig, err error) { |
|
|
|
if ldapServer, ok := os.LookupEnv("MINIO_IDENTITY_LDAP_SERVER_ADDR"); ok { |
|
|
|
if ldapServer, ok := os.LookupEnv("MINIO_IDENTITY_LDAP_SERVER_ADDR"); ok { |
|
|
|
l.IsEnabled = true |
|
|
|
l.IsEnabled = ok |
|
|
|
l.ServerAddr = ldapServer |
|
|
|
l.ServerAddr = ldapServer |
|
|
|
|
|
|
|
|
|
|
|
if v := os.Getenv("MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY"); v == "true" { |
|
|
|
// Save root CAs
|
|
|
|
l.SkipTLSVerify = true |
|
|
|
l.rootCAs = rootCAs |
|
|
|
} |
|
|
|
l.SkipTLSVerify = os.Getenv("MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY") == "true" |
|
|
|
|
|
|
|
|
|
|
|
if v := os.Getenv("MINIO_IDENTITY_LDAP_STS_EXPIRY"); v != "" { |
|
|
|
if v := os.Getenv("MINIO_IDENTITY_LDAP_STS_EXPIRY"); v != "" { |
|
|
|
expDur, err := time.ParseDuration(v) |
|
|
|
expDur, err := time.ParseDuration(v) |
|
|
|
|
Harshavardhana
5 years ago
committed by