From 32b2d1755335798bf137ee2fe0b5031251c49af2 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Tue, 10 Oct 2017 18:27:37 +0200
Subject: [PATCH] Added STARTTLS option for LDAP auth. (#1269)

* Added STARTTLS option for LDAP auth.

see #1259

* Fixed unit test.
---
 modoboa/core/app_settings.py                  | 11 +++---
 modoboa/core/constants.py                     |  6 ++++
 .../migrations/0014_auto_20171010_1746.py     | 34 +++++++++++++++++++
 modoboa/core/tests/test_views.py              |  2 +-
 4 files changed, 48 insertions(+), 5 deletions(-)
 create mode 100644 modoboa/core/migrations/0014_auto_20171010_1746.py

diff --git a/modoboa/core/app_settings.py b/modoboa/core/app_settings.py
index 398874d3a..ee7e699f6 100644
--- a/modoboa/core/app_settings.py
+++ b/modoboa/core/app_settings.py
@@ -112,11 +112,12 @@ class GeneralParametersForm(param_forms.AdminParametersForm):
         widget=forms.TextInput(attrs={"class": "form-control"})
     )
 
-    ldap_secured = YesNoField(
+    ldap_secured = forms.ChoiceField(
         label=ugettext_lazy("Use a secured connection"),
-        initial=False,
+        choices=constants.LDAP_SECURE_MODES,
+        initial="none",
         help_text=ugettext_lazy(
-            "Use an SSL/TLS connection to access the LDAP server")
+            "Use an SSL/STARTTLS connection to access the LDAP server")
     )
 
     ldap_auth_method = forms.ChoiceField(
@@ -418,10 +419,12 @@ class GeneralParametersForm(param_forms.AdminParametersForm):
                 "email": "mail",
                 "last_name": "sn"
             })
-        ldap_uri = "ldaps://" if values["ldap_secured"] else "ldap://"
+        ldap_uri = "ldaps://" if values["ldap_secured"] == "ssl" else "ldap://"
         ldap_uri += "%s:%s" % (
             values["ldap_server_address"], values["ldap_server_port"])
         setattr(settings, "AUTH_LDAP_SERVER_URI", ldap_uri)
+        if values["ldap_secured"] == "starttls":
+            setattr(settings, "AUTH_LDAP_START_TLS", True)
 
         if values["ldap_group_type"] == "groupofnames":
             setattr(settings, "AUTH_LDAP_GROUP_TYPE", GroupOfNamesType())
diff --git a/modoboa/core/constants.py b/modoboa/core/constants.py
index a024e5fa3..75f017946 100644
--- a/modoboa/core/constants.py
+++ b/modoboa/core/constants.py
@@ -45,6 +45,12 @@ LDAP_GROUP_TYPES = (
     ("groupofnames", "GroupOfNames"),
 )
 
+LDAP_SECURE_MODES = [
+    ("none", ugettext_lazy("No")),
+    ("starttls", "STARTTLS"),
+    ("ssl", "SSL/TLS")
+]
+
 PERMISSIONS = {
     "SimpleUsers": [],
     "DomainAdmins": [
diff --git a/modoboa/core/migrations/0014_auto_20171010_1746.py b/modoboa/core/migrations/0014_auto_20171010_1746.py
new file mode 100644
index 000000000..698772236
--- /dev/null
+++ b/modoboa/core/migrations/0014_auto_20171010_1746.py
@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.10.7 on 2017-10-10 15:46
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+def update_ldap_secured(apps, schema_editor):
+    """Update ldap_secured settings."""
+    LocalConfig = apps.get_model("core", "LocalConfig")
+    lc = LocalConfig.objects.first()
+    if lc is None or "ldap_secured" not in lc._parameters:
+        return
+    if lc._parameters["ldap_secured"]:
+        lc._parameters["ldap_secured"] = "ssl"
+    else:
+        lc._parameters["ldap_secured"] = "none"
+    lc.save(update_fields=["_parameters"])
+
+
+def forward(apps, schema_editor):
+    """Empty forward method."""
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0013_auto_20170707_1058'),
+    ]
+
+    operations = [
+        migrations.RunPython(update_ldap_secured, forward),
+    ]
diff --git a/modoboa/core/tests/test_views.py b/modoboa/core/tests/test_views.py
index 6a843208b..d75dae290 100644
--- a/modoboa/core/tests/test_views.py
+++ b/modoboa/core/tests/test_views.py
@@ -151,7 +151,7 @@ class SettingsTestCase(ModoTestCase):
         "admin-valid_mxs": "",
         "limits-deflt_user_domains_limit": "0",
         "core-ldap_search_filter": "(mail=%(user)s)",
-        "core-ldap_secured": "False",
+        "core-ldap_secured": "none",
         "core-ldap_user_dn_template": "",
         "core-default_password": "Toto1000",
         "limits-deflt_user_quota_limit": "0",