Merge pull request #444 from Addy90/ldap-ssl

LDAP SSL Support

config/default.toml

@@ -114,8 +114,7 @@ host="0.0.0.0"
 [ldap]
 # enable to use ldap user backend
 enabled=false
-host="localhost"
-port=3002
+url="ldap://localhost:3002"
 baseDN="ou=users,dc=company"
 filter="(|(username={{username}})(mail={{username}}))"
 #Username field in LDAP (uid/cn/username)
@@ -124,12 +123,12 @@ passwordresetlink=""
 # Use a different user to bind LDAP (final bind DN will be: {{uidTag}}={{bindUser}},{{baseDN}})
 bindUser=""
 bindPassword=""
+#ca="self-signed-ca.pem"
 
 [ldapauth]
 # Alternative LDAP implementation using the more popular passport-ldapauth library.
 enabled=false
-host="localhost"
-port=389
+url="ldap://localhost:389"
 # Subtree in which the searchrequest for the user is done
 baseDN="ou=users,dc=company"
 # What whe are searching for. This should return a single user.
@@ -140,6 +139,7 @@ passwordresetlink=""
 # Credentials for the initial search operation (final bind DN will be exactly as specified)
 bindUser="name@company.net"
 bindPassword="mySecretPassword"
+#ca="self-signed-ca.pem"
 
 [postfixbounce]
 # Enable to allow writing Postfix bounce log to Mailtrain listener

lib/passport.js

@@ -6,6 +6,7 @@ let _ = require('./translate')._;
 let util = require('util');
 
 let passport = require('passport');
+let fs = require('fs');
 let LocalStrategy = require('passport-local').Strategy;
 
 let csrf = require('csurf');
@@ -87,7 +88,12 @@ if (config.ldap.enabled && LdapStrategy) {
 
     let opts = {
         server: {
-            url: 'ldap://' + config.ldap.host + ':' + config.ldap.port
+            url: config.ldap.url,
+            tlsOptions: {
+                ca: config.ldap.ca ? [
+                    fs.readFileSync(config.ldap.ca)
+                ] : undefined
+            }
         },
         base: config.ldap.baseDN,
         search: {
@@ -130,12 +136,17 @@ if (config.ldap.enabled && LdapStrategy) {
     log.info('Using LDAP auth (passport-ldapauth)');
     let opts = {
         server: {
-            url: 'ldap://' + config.ldap.host + ':' + config.ldap.port,
+            url: config.ldapauth.url,
             searchBase: config.ldapauth.baseDN,
             searchFilter: config.ldapauth.filter,
             searchAttributes: [config.ldapauth.uidTag, 'mail'],
             bindDN: config.ldapauth.bindUser,
-            bindCredentials: config.ldapauth.bindPassword
+            bindCredentials: config.ldapauth.bindPassword,
+            tlsOptions: {
+                ca: config.ldapauth.ca ? [
+                    fs.readFileSync(config.ldapauth.ca)
+                ] : undefined
+            }
         }
     };