public inbox for [email protected]  

help / color / mirror / Atom feed
From: Dave Page <[email protected]>
To: Khushboo Vashi <[email protected]>
Cc: pgadmin-hackers <[email protected]>
Subject: Re: [pgAdmin4][Patch] - RM 2186 - Support external authentication sources [LDAP]
Date: Tue, 17 Mar 2020 10:41:15 +0000
Message-ID: <CA+OCxoxeMw9cu8o3qGHPnvQUZYT-LPS5zycyfi0xAwtivErr5w@mail.gmail.com> (raw)
In-Reply-To: <CAFOhELeMo+DhRdbaL462jhrCOcxLE1vnbMfpVADf=x4S9NPSmQ@mail.gmail.com>
References: <CAFOhELeCi7Dyp_T5EeKQXWLc1H580u5o13BKQeFxAZPpjRmhTw@mail.gmail.com>
	<CA+OCxoyZvHAxNTDXYDNVE0irEFwYnJ0z-5KXKuJ_1Bc9aEYTWA@mail.gmail.com>
	<CAFOhELeMo+DhRdbaL462jhrCOcxLE1vnbMfpVADf=x4S9NPSmQ@mail.gmail.com>

Hi

On Tue, Mar 17, 2020 at 10:24 AM Khushboo Vashi <
[email protected]> wrote:

> Hi Dave,
>
> Thanks for the review.
>
> On Tue, Mar 17, 2020 at 3:42 PM Dave Page <[email protected]> wrote:
>
>> Hi
>>
>> 30 second read of the first version of the patch...
>>
>> - Please move the configuration into config.py. Users should never have
>> to modify a distributed file (it messes up packaging). I don't see any
>> reason to use a different file just for auth config.
>>
>> There are many settings for the LDAP, and in the future we will add other
> external sources also, so I thought it would be better if we have different
> file for the authentication.
>

Sure, but our config file is small compared to many. Splitting things out
is more confusing for users. If they want to do that themselves of course,
they can add a config_local.py file which includes other files as needed.


> - I think all config options should be prefixed with LDAP_ as we may have
>> things like CERT_FILE for other purposes too.
>>
>> Sure.
>
>> - I don't see any test cases.
>>
>> I will think about this, as right now no idea how to write test cases for
> this.
>

It should be fairly straightforward to write tests for some of the
functions in the auth classes. For testing the actual LDAP stuff, we
probably need to add LDAP config options to test_config.json, and only if
present, run the tests. That would probably need to support a list of LDAP
servers, so we can test with different configurations (LDAP, LDAPS,
LDAP_STARTTLS, AD etc).


> Thanks.
>>
>> Thanks,
> Khushboo
>
>>
>> On Tue, Mar 17, 2020 at 8:55 AM Khushboo Vashi <
>> [email protected]> wrote:
>>
>>> Hi,
>>>
>>> Please find the attached patch to support LDAP Authentication in Server
>>> mode.
>>> To test the patch, config_auth.py needs to be configured for LDAP
>>> configurations. The config settings are explained in this file in detail.
>>> After configuring the parameters, start the pgadmin server in Server mode
>>> and connect with LDAP server with the valid user via login page.
>>>
>>> I have tested this patch with ldap and ldap + ssl/tls. With the TLS, I
>>> have used the default config of ldap3 without certificates.
>>>
>>> @Dave, can you please review this patch, as you have a better
>>> understanding of LDAP and you can easily pointed out if I have missed
>>> anything.
>>>
>>> Note: For the document update I will create the task and assign to Nidhi
>>> for the same.
>>>
>>> Thanks,
>>> Khushboo
>>>
>>
>>
>> --
>> Dave Page
>> Blog: http://pgsnake.blogspot.com
>> Twitter: @pgsnake
>>
>> EnterpriseDB UK: http://www.enterprisedb.com
>> The Enterprise PostgreSQL Company
>>
>

-- 
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company


view thread (16+ messages)  latest in thread

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: [pgAdmin4][Patch] - RM 2186 - Support external authentication sources [LDAP]
  In-Reply-To: <CA+OCxoxeMw9cu8o3qGHPnvQUZYT-LPS5zycyfi0xAwtivErr5w@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox