Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Set certificates before reconnecting to LDAP #1846

Merged
merged 2 commits into from
May 19, 2022

Conversation

sbernauer
Copy link
Contributor

Description

Hi Flask-AppBuilder team,

we set up Superset - using Flask-AppBuilder - to use an LDAP connection as described in your documentation.
The first time a user tries to log into the Superset instance the login will always fail with the following error shown in the logs:

2022-05-10 13:45:43,341:ERROR:flask_appbuilder.security.manager:{'result': -1, 'desc': "Can't contact LDAP server", 'ctrls': [], 'info': 'error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed (self signed certificate in certificate chain)'}

The second login would than pass (if the credentials are correct).
This patches solves the issue, so that the first login attempt passes.

The docs of python-ldap say

libldap does not materialize all TLS settings immediately. You must use OPT_X_TLS_NEWCTX with value 0 to instruct libldap to apply pending TLS settings and create a new internal TLS context:

We have to set all the certificates before we set OPT_X_TLS_NEWCTX to 0 so that the correct certificates are set.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Is CRUD MVC related.
  • Is Auth, RBAC security related.
  • Changes the security db schema.
  • Introduces new feature
  • Removes existing feature

Copy link
Owner

@dpgaspar dpgaspar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you!

@dpgaspar dpgaspar merged commit d473529 into dpgaspar:master May 19, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants