Added STARTTLS option for LDAP auth. (#1269)

* Added STARTTLS option for LDAP auth.

see #1259

* Fixed unit test.

modoboa/core/app_settings.py

@@ -112,11 +112,12 @@ class GeneralParametersForm(param_forms.AdminParametersForm):
         widget=forms.TextInput(attrs={"class": "form-control"})
     )
 
-    ldap_secured = YesNoField(
+    ldap_secured = forms.ChoiceField(
         label=ugettext_lazy("Use a secured connection"),
-        initial=False,
+        choices=constants.LDAP_SECURE_MODES,
+        initial="none",
         help_text=ugettext_lazy(
-            "Use an SSL/TLS connection to access the LDAP server")
+            "Use an SSL/STARTTLS connection to access the LDAP server")
     )
 
     ldap_auth_method = forms.ChoiceField(
@@ -418,10 +419,12 @@ class GeneralParametersForm(param_forms.AdminParametersForm):
                 "email": "mail",
                 "last_name": "sn"
             })
-        ldap_uri = "ldaps://" if values["ldap_secured"] else "ldap://"
+        ldap_uri = "ldaps://" if values["ldap_secured"] == "ssl" else "ldap://"
         ldap_uri += "%s:%s" % (
             values["ldap_server_address"], values["ldap_server_port"])
         setattr(settings, "AUTH_LDAP_SERVER_URI", ldap_uri)
+        if values["ldap_secured"] == "starttls":
+            setattr(settings, "AUTH_LDAP_START_TLS", True)
 
         if values["ldap_group_type"] == "groupofnames":
             setattr(settings, "AUTH_LDAP_GROUP_TYPE", GroupOfNamesType())

modoboa/core/constants.py

@@ -45,6 +45,12 @@ LDAP_GROUP_TYPES = (
     ("groupofnames", "GroupOfNames"),
 )
 
+LDAP_SECURE_MODES = [
+    ("none", ugettext_lazy("No")),
+    ("starttls", "STARTTLS"),
+    ("ssl", "SSL/TLS")
+]
+
 PERMISSIONS = {
     "SimpleUsers": [],
     "DomainAdmins": [

modoboa/core/migrations/0014_auto_20171010_1746.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.7 on 2017-10-10 15:46
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+def update_ldap_secured(apps, schema_editor):
+    """Update ldap_secured settings."""
+    LocalConfig = apps.get_model("core", "LocalConfig")
+    lc = LocalConfig.objects.first()
+    if lc is None or "ldap_secured" not in lc._parameters:
+        return
+    if lc._parameters["ldap_secured"]:
+        lc._parameters["ldap_secured"] = "ssl"
+    else:
+        lc._parameters["ldap_secured"] = "none"
+    lc.save(update_fields=["_parameters"])
+
+
+def forward(apps, schema_editor):
+    """Empty forward method."""
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0013_auto_20170707_1058'),
+    ]
+
+    operations = [
+        migrations.RunPython(update_ldap_secured, forward),
+    ]

modoboa/core/tests/test_views.py

@@ -151,7 +151,7 @@ class SettingsTestCase(ModoTestCase):
         "admin-valid_mxs": "",
         "limits-deflt_user_domains_limit": "0",
         "core-ldap_search_filter": "(mail=%(user)s)",
-        "core-ldap_secured": "False",
+        "core-ldap_secured": "none",
         "core-ldap_user_dn_template": "",
         "core-default_password": "Toto1000",
         "limits-deflt_user_quota_limit": "0",