nicolabs/ldap-plugin
1
0
Fork 0
mirror of https://github.com/nicolabs/ldap-plugin.git synced 2026-05-21 11:58:41 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Was storing the manager password scrambled; now properly encrypting it.

Browse source
This commit is contained in:
Jesse Glick 2014-05-07 14:16:35 -04:00
parent 0f4e172636
commit a68bf21b79
2 changed files with 33 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
src/main/java/hudson/security/LDAPSecurityRealm.java
View file

@ -37,6 +37,7 @@ import hudson.tasks.Mailer;
import hudson.util.FormValidation;
import hudson.util.ListBoxModel;
import hudson.util.Scrambler;
import hudson.util.Secret;
import hudson.util.spring.BeanBuilder;
import java.io.File;
import java.io.FileInputStream;
@ -301,17 +302,20 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
*/
/**
* If non-null, we use this and {@link #managerPassword}
* If non-null, we use this and {@link #managerPasswordSecret}
* when binding to LDAP.
*
* This is necessary when LDAP doesn't support anonymous access.
*/
public final String managerDN;
@Deprecated
private String managerPassword;
/**
* Scrambled password, used to first bind to LDAP.
* Password used to first bind to LDAP.
*/
private final String managerPassword;
private Secret managerPasswordSecret;
/**
* Created in {@link #createSecurityComponents()}. Can be used to connect to LDAP.
@ -388,11 +392,19 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
this(server, rootDN, userSearchBase, userSearch, groupSearchBase, groupSearchFilter, groupMembershipFilter, managerDN, managerPassword, inhibitInferRootDN, disableMailAddressResolver, cache, environmentProperties, null, null);
}
@DataBoundConstructor
/**
* @deprecated retained for backwards binary compatibility.
*/
@Deprecated
public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, String managerPassword, boolean inhibitInferRootDN, boolean disableMailAddressResolver, CacheConfiguration cache, EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName) {
this(server, rootDN, userSearchBase, userSearch, groupSearchBase, groupSearchFilter, groupMembershipFilter, managerDN, Secret.fromString(managerPassword), inhibitInferRootDN, disableMailAddressResolver, cache, environmentProperties, null, null);
}
@DataBoundConstructor
public LDAPSecurityRealm(String server, String rootDN, String userSearchBase, String userSearch, String groupSearchBase, String groupSearchFilter, String groupMembershipFilter, String managerDN, Secret managerPasswordSecret, boolean inhibitInferRootDN, boolean disableMailAddressResolver, CacheConfiguration cache, EnvironmentProperty[] environmentProperties, String displayNameAttributeName, String mailAddressAttributeName) {
this.server = server.trim();
this.managerDN = fixEmpty(managerDN);
this.managerPassword = Scrambler.scramble(fixEmpty(managerPassword));
this.managerPasswordSecret = managerPasswordSecret;
this.inhibitInferRootDN = inhibitInferRootDN;
if(!inhibitInferRootDN && fixEmptyAndTrim(rootDN)==null) rootDN= fixNull(inferRootDN(server));
this.rootDN = rootDN.trim();
@ -413,6 +425,14 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
DescriptorImpl.DEFAULT_MAILADDRESS_ATTRIBUTE_NAME);
}
private Object readResolve() {
if (managerPassword != null) {
managerPasswordSecret = Secret.fromString(Scrambler.descramble(managerPassword));
managerPassword = null;
}
return this;
}
public String getServerUrl() {
StringBuilder buf = new StringBuilder();
boolean first = true;
@ -510,7 +530,11 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
}
public String getManagerPassword() {
return Scrambler.descramble(managerPassword);
return Secret.toString(managerPasswordSecret);
}
public Secret getManagerPasswordSecret() {
return managerPasswordSecret;
}
public String getLDAPURL() {
@ -857,8 +881,9 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
}
// note that this works better in 1.528+ (JENKINS-19124)
public FormValidation doCheckServer(@QueryParameter String value, @QueryParameter String managerDN, @QueryParameter String managerPassword) {
public FormValidation doCheckServer(@QueryParameter String value, @QueryParameter String managerDN, @QueryParameter Secret managerPasswordSecret) {
String server = value;
String managerPassword = Secret.toString(managerPasswordSecret);
if(!Jenkins.getInstance().hasPermission(Jenkins.ADMINISTER))
return FormValidation.ok();

2
src/main/resources/hudson/security/LDAPSecurityRealm/config.jelly
View file

@ -52,7 +52,7 @@ THE SOFTWARE.
<f:entry field="managerDN" title="${%Manager DN}">
<f:textbox autocomplete="off"/>
</f:entry>
<f:entry field="managerPassword" title="${%Manager Password}">
<f:entry field="managerPasswordSecret" title="${%Manager Password}">
<f:password autocomplete="off"/>
</f:entry>
<f:entry field="displayNameAttributeName" title="${%Display Name LDAP attribute}">