python.d/openldap: fix tls over ldap (#9853)
Guido committed
Sep 1, 2020 at 14:57 UTC
907a3b3e964e36ee34a1347172d9cd4788f76fd5
2 files changed
+20
-12
collectors/python.d.plugin/openldap/openldap.chart.py
+12
-5
@@ -17,6 +17,7 @@ DEFAULT_PORT = '389'
17
DEFAULT_TLS = False
18
DEFAULT_CERT_CHECK = True
19
DEFAULT_TIMEOUT = 1
20
+DEFAULT_START_TLS = False
21
22
ORDER = [
23
'total_connections',
@@ -143,6 +144,7 @@ class Service(SimpleService):
144
self.timeout = configuration.get('timeout', DEFAULT_TIMEOUT)
145
self.use_tls = configuration.get('use_tls', DEFAULT_TLS)
146
self.cert_check = configuration.get('cert_check', DEFAULT_CERT_CHECK)
147
+ self.use_start_tls = configuration.get('use_start_tls', DEFAULT_START_TLS)
148
self.alive = False
149
self.conn = None
150
@@ -159,8 +161,13 @@ class Service(SimpleService):
161
else:
162
self.conn = ldap.initialize('ldap://%s:%s' % (self.server, self.port))
163
self.conn.set_option(ldap.OPT_NETWORK_TIMEOUT, self.timeout)
162
- if self.use_tls and not self.cert_check:
164
+ if (self.use_tls or self.use_start_tls) and not self.cert_check:
165
self.conn.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
166
+ if self.use_start_tls or self.use_tls:
167
+ self.conn.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
168
+ if self.use_start_tls:
169
+ self.conn.protocol_version = ldap.VERSION3
170
+ self.conn.start_tls_s()
171
if self.username and self.password:
172
self.conn.simple_bind(self.username, self.password)
173
except ldap.LDAPError as error:
@@ -197,13 +204,13 @@ class Service(SimpleService):
204
self.alive = False
205
return None
206
207
+ if result_type != 101:
208
+ continue
209
+
210
try:
201
- if result_type == 101:
202
- val = int(list(result_data[0][1].values())[0][0])
211
+ data[key] = int(list(result_data[0][1].values())[0][0])
212
except (ValueError, IndexError) as error:
213
self.debug(error)
214
continue
215
207
- data[key] = val
208
-
216
return data
collectors/python.d.plugin/openldap/openldap.conf
+8
-7
@@ -65,10 +65,11 @@ update_every: 10
65
66
# Set here your LDAP connection settings
67
68
-#username : "cn=admin,dc=example,dc=com" # The bind user with right to access monitor statistics
69
-#password : "yourpass" # The password for the binded user
70
-#server : 'localhost' # The listening address of the LDAP server. In case of TLS, use the hostname which the certificate is published for.
71
-#port : 389 # The listening port of the LDAP server. Change to 636 port in case of TLS connection
72
-#use_tls : False # Make True if a TLS connection is used
73
-#cert_check : True # False if you want to ignore certificate check
74
-#timeout : 1 # Seconds to timeout if no connection exi
68
+#username : "cn=admin,dc=example,dc=com" # The bind user with right to access monitor statistics
69
+#password : "yourpass" # The password for the binded user
70
+#server : 'localhost' # The listening address of the LDAP server. In case of TLS, use the hostname which the certificate is published for.
71
+#port : 389 # The listening port of the LDAP server. Change to 636 port in case of TLS connection
72
+#use_tls : False # Make True if a TLS connection is used over ldaps://
73
+#use_start_tls: False # Make True if a TLS connection is used over ldap://
74
+#cert_check : True # False if you want to ignore certificate check
75
+#timeout : 1 # Seconds to timeout if no connection exi