Merge pull request #1278 from s-urbaniak/ldap-config

Bug 2037274: pkg/security/ldapclient: add configuration for connection verification
openshift · Jan 10, 2022 · 1ad5cdd · 1ad5cdd
2 parents 1f38a6c + d41fdca
commit 1ad5cdd
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/pkg/security/OWNERS b/pkg/security/OWNERS
@@ -0,0 +1,7 @@
+reviewers:
+  - ibihim
+  - s-urbaniak
+  - slaskawi
+  - stlaz
+approvers:
+  - stlaz
diff --git a/pkg/security/ldapclient/client.go b/pkg/security/ldapclient/client.go
@@ -13,6 +13,11 @@ import (
 
 // NewLDAPClientConfig returns a new LDAP client config
 func NewLDAPClientConfig(URL, bindDN, bindPassword, CA string, insecure bool) (Config, error) {
+	return NewLDAPClientConfigWithTLSConnectionVerification(URL, bindDN, bindPassword, CA, insecure, nil)
+}
+
+// NewLDAPClientConfig returns a new LDAP client config
+func NewLDAPClientConfigWithTLSConnectionVerification(URL, bindDN, bindPassword, CA string, insecure bool, verifyFn func(tls.ConnectionState) error) (Config, error) {
 	url, err := ldaputil.ParseURL(URL)
 	if err != nil {
 		return nil, fmt.Errorf("Error parsing URL: %v", err)
@@ -27,6 +32,8 @@ func NewLDAPClientConfig(URL, bindDN, bindPassword, CA string, insecure bool) (C
 		tlsConfig.RootCAs = roots
 	}
 
+	tlsConfig.VerifyConnection = verifyFn
+
 	return &ldapClientConfig{
 		scheme:       url.Scheme,
 		host:         url.Host,