summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--perl-install/authentication.pm25
1 files changed, 22 insertions, 3 deletions
diff --git a/perl-install/authentication.pm b/perl-install/authentication.pm
index 8f6086a25..9120f74f5 100644
--- a/perl-install/authentication.pm
+++ b/perl-install/authentication.pm
@@ -44,6 +44,12 @@ sub ask_parameters {
$authentication->{AD_server} ||= 'kerberos.' . $val;
$authentication->{AD_users_db} ||= 'cn=users,' . domain_to_ldap_domain($val);
+ my %sub_kinds = my @sub_kinds = (
+ anonymous => N("anonymous"),
+ simple => N("simple"),
+ tls => N("over SSL/TLS"),
+ kerberos => N("security layout (SASL/Kerberos)"),
+ );
my $AD_user = $authentication->{AD_user} =~ /(.*)\@\Q$val\E$/ ? $1 : $authentication->{AD_user};
$in->ask_from('',
@@ -51,10 +57,13 @@ sub ask_parameters {
[ { label => N("Domain"), val => \$val },
{ label => N("Server"), val => \$authentication->{AD_server} },
{ label => N("LDAP users database"), val => \$authentication->{AD_users_db} },
- { label => N("LDAP user allowed to browse the Active Directory"), val => \$AD_user },
- { label => N("Password for user"), val => \$authentication->{AD_password}, disabled => sub { !$AD_user } },
+ { label => N("LDAP Authentication"), val => \$authentication->{sub_kind}, list => [ map { $_->[0] } group_by2(@sub_kinds) ], format => sub { $sub_kinds{$_[0]} } },
+ { label => N("LDAP user allowed to browse the Active Directory"), val => \$AD_user, disabled => sub { $authentication->{sub_kind} eq 'anonymous' } },
+ { label => N("Password for user"), val => \$authentication->{AD_password}, disabled => sub { !$AD_user || $authentication->{sub_kind} eq 'anonymous' } },
]) or return;
- $authentication->{AD_user} = !$AD_user ? '' : $AD_user =~ /@/ ? $AD_user : "$AD_user\@$val";
+ $authentication->{AD_user} = !$AD_user || $authentication->{sub_kind} eq 'anonymous' ? '' :
+ $AD_user =~ /@/ ? $AD_user : "$AD_user\@$val";
+ $authentication->{AD_password} = '' if !$authentication->{AD_user};
} elsif ($kind eq 'NIS') {
$val ||= 'broadcast';
$in->ask_from('',
@@ -113,6 +122,13 @@ sub set {
set_nsswitch_priority('ldap');
set_pam_authentication('krb5');
+ my $ssl = {
+ anonymous => 'off',
+ simple => 'off',
+ ssl => 'start_tls' . "\n" . 'ssl on',
+ kerberos => 'on',
+ }->{$authentication->{sub_kind}};
+
update_ldap_conf(
host => $authentication->{AD_server},
base => domain_to_ldap_domain($val),
@@ -120,6 +136,9 @@ sub set {
nss_base_passwd => "$authentication->{AD_users_db}?one",
nss_base_group => "$authentication->{AD_users_db}?one",
+ ssl => $ssl,
+ sasl_mech => $authentication->{sub_kind} eq 'kerberos' ? 'GSSAPI' : '',
+
binddn => $authentication->{AD_user},
bindpw => $authentication->{AD_password},