Merge branch 'master' into invite

pkg/login/ldap.go

@@ -1,6 +1,7 @@
 package login
 
 import (
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"strings"
@@ -25,7 +26,11 @@ func (a *ldapAuther) Dial() error {
 	address := fmt.Sprintf("%s:%d", a.server.Host, a.server.Port)
 	var err error
 	if a.server.UseSSL {
-		a.conn, err = ldap.DialTLS("tcp", address, nil)
+		tlsCfg := &tls.Config{
+			InsecureSkipVerify: a.server.SkipVerifySSL,
+			ServerName:         a.server.Host,
+		}
+		a.conn, err = ldap.DialTLS("tcp", address, tlsCfg)
 	} else {
 		a.conn, err = ldap.Dial("tcp", address)
 	}
@@ -125,14 +130,17 @@ func (a *ldapAuther) syncOrgRoles(user *m.User, ldapUser *ldapUserInfo) error {
 		return err
 	}
 
-	// remove or update org roles
+	// update or remove org roles
 	for _, org := range orgsQuery.Result {
+		match := false
+
 		for _, group := range a.server.LdapGroups {
 			if org.OrgId != group.OrgId {
 				continue
 			}
 
 			if ldapUser.isMemberOf(group.GroupDN) {
+				match = true
 				if org.Role != group.OrgRole {
 					// update role
 					cmd := m.UpdateOrgUserCommand{OrgId: org.OrgId, UserId: user.Id, Role: group.OrgRole}
@@ -142,12 +150,14 @@ func (a *ldapAuther) syncOrgRoles(user *m.User, ldapUser *ldapUserInfo) error {
 				}
 				// ignore subsequent ldap group mapping matches
 				break
-			} else {
-				// remove role
-				cmd := m.RemoveOrgUserCommand{OrgId: org.OrgId, UserId: user.Id}
-				if err := bus.Dispatch(&cmd); err != nil {
-					return err
-				}
+			}
+		}
+
+		// remove role if no mappings match
+		if !match {
+			cmd := m.RemoveOrgUserCommand{OrgId: org.OrgId, UserId: user.Id}
+			if err := bus.Dispatch(&cmd); err != nil {
+				return err
 			}
 		}
 	}

pkg/login/ldap_test.go

@@ -139,6 +139,26 @@ func TestLdapAuther(t *testing.T) {
 			})
 		})
 
+		ldapAutherScenario("given org role is updated in config", func(sc *scenarioContext) {
+			ldapAuther := NewLdapAuthenticator(&LdapServerConf{
+				LdapGroups: []*LdapGroupToOrgRole{
+					{GroupDN: "cn=admin", OrgId: 1, OrgRole: "Admin"},
+					{GroupDN: "cn=users", OrgId: 1, OrgRole: "Viewer"},
+				},
+			})
+
+			sc.userOrgsQueryReturns([]*m.UserOrgDTO{{OrgId: 1, Role: m.ROLE_EDITOR}})
+			err := ldapAuther.syncOrgRoles(&m.User{}, &ldapUserInfo{
+				MemberOf: []string{"cn=users"},
+			})
+
+			Convey("Should update org role", func() {
+				So(err, ShouldBeNil)
+				So(sc.removeOrgUserCmd, ShouldBeNil)
+				So(sc.updateOrgUserCmd, ShouldNotBeNil)
+			})
+		})
+
 		ldapAutherScenario("given multiple matching ldap groups", func(sc *scenarioContext) {
 			ldapAuther := NewLdapAuthenticator(&LdapServerConf{
 				LdapGroups: []*LdapGroupToOrgRole{

pkg/login/settings.go

@@ -1,6 +1,8 @@
 package login
 
 import (
+	"fmt"
+
 	"github.com/BurntSushi/toml"
 	"github.com/grafana/grafana/pkg/log"
 	m "github.com/grafana/grafana/pkg/models"
@@ -13,12 +15,13 @@ type LdapConfig struct {
 }
 
 type LdapServerConf struct {
-	Host         string           `toml:"host"`
-	Port         int              `toml:"port"`
-	UseSSL       bool             `toml:"use_ssl"`
-	BindDN       string           `toml:"bind_dn"`
-	BindPassword string           `toml:"bind_password"`
-	Attr         LdapAttributeMap `toml:"attributes"`
+	Host          string           `toml:"host"`
+	Port          int              `toml:"port"`
+	UseSSL        bool             `toml:"use_ssl"`
+	SkipVerifySSL bool             `toml:"ssl_skip_verify"`
+	BindDN        string           `toml:"bind_dn"`
+	BindPassword  string           `toml:"bind_password"`
+	Attr          LdapAttributeMap `toml:"attributes"`
 
 	SearchFilter  string   `toml:"search_filter"`
 	SearchBaseDNs []string `toml:"search_base_dns"`
@@ -54,8 +57,17 @@ func loadLdapConfig() {
 		log.Fatal(3, "Failed to load ldap config file: %s", err)
 	}
 
+	if len(ldapCfg.Servers) == 0 {
+		log.Fatal(3, "ldap enabled but no ldap servers defined in config file: %s", setting.LdapConfigFile)
+	}
+
 	// set default org id
 	for _, server := range ldapCfg.Servers {
+		assertNotEmptyCfg(server.Host, "host")
+		assertNotEmptyCfg(server.BindDN, "bind_dn")
+		assertNotEmptyCfg(server.SearchFilter, "search_filter")
+		assertNotEmptyCfg(server.SearchBaseDNs, "search_base_dns")
+
 		for _, groupMap := range server.LdapGroups {
 			if groupMap.OrgId == 0 {
 				groupMap.OrgId = 1
@@ -63,3 +75,18 @@ func loadLdapConfig() {
 		}
 	}
 }
+
+func assertNotEmptyCfg(val interface{}, propName string) {
+	switch v := val.(type) {
+	case string:
+		if v == "" {
+			log.Fatal(3, "LDAP config file is missing option: %s", propName)
+		}
+	case []string:
+		if len(v) == 0 {
+			log.Fatal(3, "LDAP config file is missing option: %s", propName)
+		}
+	default:
+		fmt.Println("unknown")
+	}
+}