starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Support Internal Certificate Authority Validation for LDAPS #3235

New Issue
Closed
opened 2025-12-29 18:26:58 +01:00 by adam · 5 comments
adam commented 2025-12-29 18:26:58 +01:00
Owner
Copy Link

Originally created by @newlandk on GitHub (Jan 29, 2020).

Environment

  • Python version: 3
  • NetBox version: 2.7.2

Proposed Functionality

Support providing the path to a custom certificate authority certificate bundle for validating LDAPS server certificate.

Add a getatter similar to https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/settings.py#L381-L382 for setting the OPT_X_TLS_CACERTFILE to allow validation of internal certificate authorities. This support appears to be missing from the django-ldap-auth backend natively.

Use Case

Enhance security throughout the LDAP bind process.

External Dependencies

python-ldap
django-ldap-auth

Originally created by @newlandk on GitHub (Jan 29, 2020). ### Environment * Python version: 3 * NetBox version: 2.7.2 ### Proposed Functionality Support providing the path to a custom certificate authority certificate bundle for validating LDAPS server certificate. Add a `getatter` similar to https://github.com/netbox-community/netbox/blob/develop/netbox/netbox/settings.py#L381-L382 for setting the OPT_X_TLS_CACERTFILE to allow validation of internal certificate authorities. This support appears to be missing from the django-ldap-auth backend natively. ### Use Case Enhance security throughout the LDAP bind process. ### External Dependencies python-ldap django-ldap-auth
adam closed this issue 2025-12-29 18:26:58 +01:00
adam commented 2025-12-29 18:26:59 +01:00
Author
Owner
Copy Link

@newlandk commented on GitHub (Jan 29, 2020):

If this is a feature the maintainers deem appropriate for addition in the netbox project, I can make a PR for this functionality. Thank you!

@newlandk commented on GitHub (Jan 29, 2020): If this is a feature the maintainers deem appropriate for addition in the netbox project, I can make a PR for this functionality. Thank you!
adam commented 2025-12-29 18:26:59 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Jan 29, 2020):

External authentication is going to be abstracted away as per #2328.

I am going to close this out due to that reason.

@DanSheps commented on GitHub (Jan 29, 2020): External authentication is going to be abstracted away as per #2328. I am going to close this out due to that reason.
adam commented 2025-12-29 18:26:59 +01:00
Author
Owner
Copy Link

@hSaria commented on GitHub (Jan 29, 2020):

This is already possible. In ldap_config.py, put:

import ldap

ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, '/path/to/ca_cert.pem')
@hSaria commented on GitHub (Jan 29, 2020): This is already possible. In `ldap_config.py`, put: ``` import ldap ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, '/path/to/ca_cert.pem') ```
adam commented 2025-12-29 18:27:00 +01:00
Author
Owner
Copy Link

@newlandk commented on GitHub (Jan 29, 2020):

Thank you @hSaria that is what I had working, I wasn't sure if there was interest in having it be a more explicit option since there is the getattr to disable validation.

@newlandk commented on GitHub (Jan 29, 2020): Thank you @hSaria that is what I had working, I wasn't sure if there was interest in having it be a more explicit option since there is the getattr to disable validation.
adam commented 2025-12-29 18:27:00 +01:00
Author
Owner
Copy Link

@hSaria commented on GitHub (Jan 29, 2020):

If it were up to me, I'd take LDAP_IGNORE_CERT_ERRORS entirely out and just tell people about the ability to modify ldap options as this isn't something limited to NetBox, but as DanSheps mentioned, this whole thing is gonna get reworked eventually.

@hSaria commented on GitHub (Jan 29, 2020): If it were up to me, I'd take `LDAP_IGNORE_CERT_ERRORS` entirely out and just tell people about the ability to modify ldap options as this isn't something limited to NetBox, but as DanSheps mentioned, this whole thing is gonna get reworked eventually.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#3235
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?