From 52c4621095ec6c67b2566b035879be3a141fb3e0 Mon Sep 17 00:00:00 2001 From: Tony Murray Date: Fri, 13 Nov 2015 11:04:23 -0600 Subject: [PATCH 1/2] I agree to the conditions of the Contributor Agreement contained in doc/General/Contributing.md --- AUTHORS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/AUTHORS.md b/AUTHORS.md index 0fc344279..4c3d6983b 100644 --- a/AUTHORS.md +++ b/AUTHORS.md @@ -68,4 +68,5 @@ Contributors to LibreNMS: - Robert Gornall (rgormley) - Richard Kojedzinszky (rkojedzinszky) +- Tony Murray (murrant) [1]: http://observium.org/ "Observium web site" From 02d54e9c50a85c2d453cb0a66a747c1c57daff2c Mon Sep 17 00:00:00 2001 From: Tony Murray Date: Fri, 13 Nov 2015 11:05:05 -0600 Subject: [PATCH 2/2] Fix AD auth with untrusted certificates. LDAPTLS_REQCERT=never must be set before ldap_connect. --- .../authentication/active_directory.inc.php | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/html/includes/authentication/active_directory.inc.php b/html/includes/authentication/active_directory.inc.php index 03788f90d..88504a665 100644 --- a/html/includes/authentication/active_directory.inc.php +++ b/html/includes/authentication/active_directory.inc.php @@ -2,6 +2,12 @@ // easier to rewrite for Active Directory than to bash it into existing LDAP implementation +// disable certificate checking before connect if required +if (isset($config['auth_ad_dont_check_certificates']) && + $config['auth_ad_dont_check_certificates'] > 0) { + putenv('LDAPTLS_REQCERT=never'); +}; + $ds = @ldap_connect($config['auth_ad_url']); // disable referrals and force ldap version to 3 @@ -9,13 +15,6 @@ $ds = @ldap_connect($config['auth_ad_url']); ldap_set_option($ds, LDAP_OPT_REFERRALS, 0); ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3); -// disable certificate checking if required - -if (isset($config['auth_ad_dont_check_certificates']) && - $config['auth_ad_dont_check_certificates'] > 0) { - putenv('LDAPTLS_REQCERT=never'); -}; - function authenticate($username, $password) { global $config, $ds;