Redmine

With the introduction of certficate checks to LDAPS connections in trunk #24970 (and maybe 3.4 in #29476), we should enable the user to fall back to the old behavior, where server certificates were not checked.

This is especially important, where local domain controllers and LDAP servers are used as an authentication backend. Because there servers will often use self-signed certificates.

The attached patch adds a configuration option to disable the certificate checks for LDAPS connections.

Implementation¶

The patch adds a new boolean column to auth_sources called verify_peer. The LDAP auth source edit screen is extended so that users may decide if they want to use "LDAP", "LDAPS without certificate check" (this one is new) or "LDAPS with certificate check".

Depending on the selected option, the tls and verify_peer attributes are set on the auth source.

Furthermore the patch extends the LDAP connection setup code, to use the newly introduced setting.

Backwards compatibility¶

To ensure backwards compatibility with the current Redmine trunk, the new column verify_peer defaults to true. This way, connections which use tls will continue checking the certificates.

If you want to stay compatible with the behavior in the latest Redmine release, then the default value should be false, since 3.4 currently doesn't verify certificates, as explained in #29476.

I chose to introduce a new column instead of changing the existing one, so that the db schema remains compatible with other auth sources, which may be used by plugins. Adding a new column, should not break any existing code.

Redmine.pm compatibility¶

Redmine.pm currently does not verify certificates.

A brief check suggests, that the library which is used in Redmine.pm simpy doesn't support checking server certificates. Therefore in order to properly secure LDAP authentication for SVN and/or to support this new configuration, Redmine.pm would need to switch to a different LDAP library. But this would be out of scope for this ticket. This patch neither improves nor worsens the security of Redmine.pm's LDAP authentication.

Related issues¶

• #24970 introduces server certificate checks for LDAPS for Redmine 4.0
• #29476 suggests to backport #24970 to Redmine 3.4
• #27071 seems to be facing the problem, that the certficate cannot be validated
• #3358 was suggesting (among others) a similar feature

---

The attached patch is targeted at r17480.