19896: Configurable minimum TLS version for LDAP connection.

[arvados.git] / lib / controller / localdb / login_ldap.go

diff --git a/lib/controller/localdb/login_ldap.go b/lib/controller/localdb/login_ldap.go
index 3f13c7b27aafed09f1c6b201270e034ca9c011d9..f8fe9084d7d4701bda55d3f410ca8d1c49ee040d 100644 (file)
--- a/lib/controller/localdb/login_ldap.go
+++ b/lib/controller/localdb/login_ldap.go
@@ -47,7 +47,25 @@ func (ctrl *ldapLoginController) UserAuthenticate(ctx context.Context, opts arva
        }
 
        log = log.WithField("URL", conf.URL.String())
-       l, err := ldap.DialURL(conf.URL.String())
+       var l *ldap.Conn
+       var err error
+       if conf.URL.Scheme == "ldaps" {
+               // ldap.DialURL does not currently allow us to control
+               // tls.Config, so we need to figure out the port
+               // ourselves and call DialTLS.
+               host, port, err := net.SplitHostPort(conf.URL.Host)
+               if err != nil {
+                       // Assume error means no port given
+                       host = conf.URL.Host
+                       port = ldap.DefaultLdapsPort
+               }
+               l, err = ldap.DialTLS("tcp", net.JoinHostPort(host, port), &tls.Config{
+                       ServerName: host,
+                       MinVersion: uint16(conf.MinTLSVersion),
+               })
+       } else {
+               l, err = ldap.DialURL(conf.URL.String())
+       }
        if err != nil {
                log.WithError(err).Error("ldap connection failed")
                return arvados.APIClientAuthorization{}, err
@@ -58,6 +76,7 @@ func (ctrl *ldapLoginController) UserAuthenticate(ctx context.Context, opts arva
                var tlsconfig tls.Config
                if conf.InsecureTLS {
                        tlsconfig.InsecureSkipVerify = true
+                       tlsconfig.MinVersion = uint16(conf.MinTLSVersion)
                } else {
                        if host, _, err := net.SplitHostPort(conf.URL.Host); err != nil {
                                // Assume SplitHostPort error means