ldap auth: add sslversion option

default to tls1.2

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>

diff --git a/PVE/Auth/AD.pm b/PVE/Auth/AD.pm
index b924b02b2c550f24c86a2a8fcf0abfdab9d2c454..a877a7657d7b2ba2a344f77956a344d83bd3a2e1 100755 (executable)
--- a/PVE/Auth/AD.pm
+++ b/PVE/Auth/AD.pm
@@ -33,6 +33,12 @@ sub properties {
            optional => 1,
 
        },
+       sslversion => {
+           description => "LDAPS ssl version.",
+           type => 'string',
+           enum => [qw(tlsv1 tlsv1_1 tlsv1_2)],
+           optional => 1,
+       },
        default => {
            description => "Use this as default realm",
            type => 'boolean',
@@ -69,6 +75,7 @@ sub options {
        domain => {},
        port => { optional => 1 },
        secure => { optional => 1 },
+       sslversion => { optional => 1 },
        default => { optional => 1 },,
        comment => { optional => 1 },
        tfa => { optional => 1 },
@@ -108,6 +115,10 @@ my $authenticate_user_ad = sub {
        $ad_args{verify} = 'none';
     }
 
+    if ($config->{secure}) {
+       $ad_args{sslversion} = $config->{sslversion} ? $config->{sslversion} : 'tlsv1_2';
+    }
+
     my $ldap = Net::LDAP->new($conn_string, %ad_args) || die "$@\n";
 
     $username = "$username\@$config->{domain}"

diff --git a/PVE/Auth/LDAP.pm b/PVE/Auth/LDAP.pm
index 9f08504a0997a9839670c3f5840d019d48585910..d6c26eb0f0bf9d5da58dc195e9bbef453ccc6320 100755 (executable)
--- a/PVE/Auth/LDAP.pm
+++ b/PVE/Auth/LDAP.pm
@@ -70,6 +70,7 @@ sub options {
        user_attr => {},
        port => { optional => 1 },
        secure => { optional => 1 },
+       sslversion => { optional => 1 },
        default => { optional => 1 },
        comment => { optional => 1 },
        tfa => { optional => 1 },
@@ -109,6 +110,10 @@ my $authenticate_user_ldap = sub {
        $ldap_args{verify} = 'none';
     }
 
+    if ($config->{secure}) {
+       $ldap_args{sslversion} = $config->{sslversion} ? $config->{sslversion} : 'tlsv1_2';
+    }
+
     my $ldap = Net::LDAP->new($conn_string, %ldap_args) || die "$@\n";
 
     if (my $bind_dn = $config->{bind_dn}) {