Merge pull request cesanta#197 from mrueg/ldap-cert

Set custom CA certificate for ldap cert verification

Author: rojer

auth_server/authn/ldap_auth.go

@@ -19,6 +19,7 @@ package authn
 import (
 	"bytes"
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"io/ioutil"
 	"strings"
@@ -31,6 +32,7 @@ type LDAPAuthConfig struct {
 	Addr                  string `yaml:"addr,omitempty"`
 	TLS                   string `yaml:"tls,omitempty"`
 	InsecureTLSSkipVerify bool   `yaml:"insecure_tls_skip_verify,omitempty"`
+	CACertificate         string `yaml:"ca_certificate,omitempty"`
 	Base                  string `yaml:"base,omitempty"`
 	Filter                string `yaml:"filter,omitempty"`
 	BindDN                string `yaml:"bind_dn,omitempty"`
@@ -140,7 +142,20 @@ func (la *LDAPAuth) ldapConnection() (*ldap.Conn, error) {
 	tlsConfig := &tls.Config{InsecureSkipVerify: true}
 	if !la.config.InsecureTLSSkipVerify {
 		addr := strings.Split(la.config.Addr, ":")
-		tlsConfig = &tls.Config{InsecureSkipVerify: false, ServerName: addr[0]}
+		if la.config.CACertificate != "" {
+			pool := x509.NewCertPool()
+			pem, err := ioutil.ReadFile(la.config.CACertificate)
+			if err != nil {
+				return nil, fmt.Errorf("Error loading CA File: %s", err)
+			}
+			ok := pool.AppendCertsFromPEM(pem)
+			if !ok {
+				return nil, fmt.Errorf("Error loading CA File: Couldn't parse PEM in: %s", la.config.CACertificate)
+			}
+			tlsConfig = &tls.Config{InsecureSkipVerify: false, ServerName: addr[0], RootCAs: pool}
+		} else {
+			tlsConfig = &tls.Config{InsecureSkipVerify: false, ServerName: addr[0]}
+		}
 	}
 
 	if la.config.TLS == "" || la.config.TLS == "none" || la.config.TLS == "starttls" {

examples/ldap_auth.yml

@@ -18,6 +18,8 @@ ldap_auth:
   tls: always
   # set to true to allow insecure tls
   insecure_tls_skip_verify: false
+  # set this to specify the ca certificate path
+  ca_certificate:
   # In case bind DN and password is required for querying user information,
   # specify them here. Plain text password is read from the file.
   bind_dn:

examples/reference.yml

@@ -131,6 +131,8 @@ ldap_auth:
   tls: always
   # set to true to allow insecure tls
   insecure_tls_skip_verify: false
+  # set this to specify the ca certificate path
+  ca_certificate:
   # In case bind DN and password is required for querying user information,
   # specify them here. Plain text password is read from the file.
   bind_dn: