diff --git a/auth_ldaps/README.rst b/auth_ldaps/README.rst new file mode 100644 index 0000000000..c4b407ed82 --- /dev/null +++ b/auth_ldaps/README.rst @@ -0,0 +1,68 @@ +.. image:: https://img.shields.io/badge/license-AGPL--3-blue.png + :target: https://www.gnu.org/licenses/agpl + :alt: License: AGPL-3 + +==================== +LDAPS Authentication +==================== + +This module allows to authenticate using a LDAP over SSL system. + +Installation +============ + +To verify LDAPS server certificate, you need to: + +#. Add the CA certificate of the LDAPS on your server as a trusted certificate +#. Check the Verify certificate´ flag in configuration + +Configuration +============= + +To configure this module, you need to: + +#. Access Settings / General Settings / LDAP Authentication / LDAP Server +#. Check the ´Use LDAPS´ flag + +.. image:: https://odoo-community.org/website/image/ir.attachment/5784_f2813bd/datas + :alt: Try me on Runbot + :target: https://runbot.odoo-community.org/runbot/251/12.0 + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues +`_. In case of trouble, please +check there if your issue has already been reported. If you spotted it first, +help us smash it by providing detailed and welcomed feedback. + +Credits +======= + +Images +------ + +* Odoo Community Association: `Icon `_. + +Contributors +------------ + +* Enric Tobella +* Alexey Pelykh + +Do not contact contributors directly about support or help with technical issues. + +Maintainer +---------- + +.. image:: https://odoo-community.org/logo.png + :alt: Odoo Community Association + :target: https://odoo-community.org + +This module is maintained by the OCA. + +OCA, or the Odoo Community Association, is a nonprofit organization whose +mission is to support the collaborative development of Odoo features and +promote its widespread use. + +To contribute to this module, please visit https://odoo-community.org. diff --git a/auth_ldaps/__init__.py b/auth_ldaps/__init__.py new file mode 100644 index 0000000000..4b76c7b2d5 --- /dev/null +++ b/auth_ldaps/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl.html). + +from . import models diff --git a/auth_ldaps/__manifest__.py b/auth_ldaps/__manifest__.py new file mode 100644 index 0000000000..8a3bcee162 --- /dev/null +++ b/auth_ldaps/__manifest__.py @@ -0,0 +1,29 @@ +# Copyright (C) 2017 Creu Blanca +# Copyright (C) 2018 Brainbean Apps +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl.html). + +{ + 'name': 'LDAPS authentication', + 'version': '12.0.1.0.0', + 'category': 'Tools', + 'website': 'https://github.com/OCA/server-auth', + 'author': + 'Braibean Apps (https://brainbeanapps.com), ' + 'Creu Blanca, ' + 'Odoo Community Association (OCA)', + 'license': 'AGPL-3', + 'installable': True, + 'application': False, + 'summary': 'Allows to use LDAP over SSL authentication', + 'depends': [ + 'auth_ldap', + ], + 'external_dependencies': { + 'python': [ + 'ldap', + ], + }, + 'data': [ + 'views/res_company_ldap_views.xml', + ], +} diff --git a/auth_ldaps/models/__init__.py b/auth_ldaps/models/__init__.py new file mode 100644 index 0000000000..499b15f328 --- /dev/null +++ b/auth_ldaps/models/__init__.py @@ -0,0 +1,3 @@ +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl.html). + +from . import res_company_ldap diff --git a/auth_ldaps/models/res_company_ldap.py b/auth_ldaps/models/res_company_ldap.py new file mode 100644 index 0000000000..c06dcb456d --- /dev/null +++ b/auth_ldaps/models/res_company_ldap.py @@ -0,0 +1,48 @@ +# Copyright (C) Creu Blanca +# Copyright (C) 2018 Brainbean Apps +# License AGPL-3.0 or later (https://www.gnu.org/licenses/agpl.html). + +import logging +from odoo import fields, models + +_logger = logging.getLogger(__name__) + +try: + import ldap +except (ImportError) as err: + _logger.debug(err) + + +class CompanyLDAP(models.Model): + _inherit = 'res.company.ldap' + _description = 'Company LDAP configuration' + + is_ssl = fields.Boolean(string='Use LDAPS', default=False) + skip_cert_validation = fields.Boolean( + string='Skip certificate validation', + default=False + ) + + def _get_ldap_dicts(self): + res = super()._get_ldap_dicts() + for rec in res: + ldap = self.sudo().browse(rec['id']) + rec['is_ssl'] = ldap.is_ssl or False + rec['skip_cert_validation'] = ldap.skip_cert_validation or False + return res + + def _connect(self, conf): + if conf['is_ssl']: + uri = 'ldaps://%s:%d' % ( + conf['ldap_server'], conf['ldap_server_port']) + connection = ldap.initialize(uri) + if conf['skip_cert_validation']: + connection.set_option( + ldap.OPT_X_TLS_REQUIRE_CERT, + ldap.OPT_X_TLS_ALLOW + ) + connection.set_option(ldap.OPT_X_TLS_NEWCTX, 0) + if conf['ldap_tls']: + connection.start_tls_s() + return connection + return super()._connect(conf) diff --git a/auth_ldaps/static/description/icon.png b/auth_ldaps/static/description/icon.png new file mode 100644 index 0000000000..3a0328b516 Binary files /dev/null and b/auth_ldaps/static/description/icon.png differ diff --git a/auth_ldaps/views/res_company_ldap_views.xml b/auth_ldaps/views/res_company_ldap_views.xml new file mode 100644 index 0000000000..dbde2dc4af --- /dev/null +++ b/auth_ldaps/views/res_company_ldap_views.xml @@ -0,0 +1,21 @@ + + + + + + res.company.ldap.form + res.company.ldap + + + + + + + + + +