From 6b22c17e8a92ccbc4b1828d8caa398392c9fc229 Mon Sep 17 00:00:00 2001 From: Neal Gompa Date: Feb 23 2020 16:02:39 +0000 Subject: login/authldap: ignore strong auth required when testing connection On some OpenLDAP-based identity management systems (such as Æ-DIR), anonymous connections are not permitted for ldapsearch and OpenLDAP is configured to return strongerAuthRequired in this circumstance. This causes failures when trying to set up Ipsilon to connect to Æ-DIR. Thanks to Michael Ströder for reporting this issue and suggesting the fix. Co-authored-by: Michael Ströder Signed-off-by: Neal Gompa --- diff --git a/ipsilon/login/authldap.py b/ipsilon/login/authldap.py index efdca38..1050423 100644 --- a/ipsilon/login/authldap.py +++ b/ipsilon/login/authldap.py @@ -260,7 +260,7 @@ class Installer(LoginManagerInstaller): lh.simple_bind_s('', '') lh.search_s(test_dn, ldap.SCOPE_BASE, attrlist=['objectclasses']) - except ldap.INSUFFICIENT_ACCESS: + except (ldap.INSUFFICIENT_ACCESS, ldap.STRONG_AUTH_REQUIRED): logging.warning('Anonymous access not allowed, continuing') except ldap.UNWILLING_TO_PERFORM: # probably minSSF issue logging.warning('LDAP server unwilling to perform, expect issues')