Use ldap client cert if defined

diff --git a/ldap-client/CHANGELOG b/ldap-client/CHANGELOG
index d3ada7d..ac1b4f4 100644 (file)
--- a/ldap-client/CHANGELOG
+++ b/ldap-client/CHANGELOG
@@ -11,3 +11,5 @@ Handle new LDAP config config file path seen on Ubuntu 8.04.
 Changed the LDAP client connection code to handle both pure-SSL and TLS modes, thanks to a patch from Paul R. Ganci.
 ---- Changes since 1.450 ----
 Improved support for older versions of Net::LDAP without the hosts() function.
+---- Changes since 1.500 ----
+If a TLS certificate and key are defined in the LDAP client configuration file, they will be used by Webmin when connecting to the LDAP database.

diff --git a/ldap-client/ldap-client-lib.pl b/ldap-client/ldap-client-lib.pl
index 218f91a..dcdf1fd 100755 (executable)
--- a/ldap-client/ldap-client-lib.pl
+++ b/ldap-client/ldap-client-lib.pl
@@ -186,6 +186,10 @@ local $conf = &get_config();
 local $uri = &find_svalue("uri", $conf);
 local ($ldap, $use_ssl, $err);
 local $ssl = &find_svalue("ssl", $conf);
+local $cafile = &find_svalue("tls_cacertfile", $conf);
+local $certfile = &find_svalue("tls_cert", $conf);
+local $keyfile = &find_svalue("tls_key", $conf);
+local $ciphers = &find_svalue("tls_ciphers", $conf);
 if ($ldap_hosts) {
        # Using hosts from parameter
        local @hosts = split(/[ \t,]+/, $ldap_hosts);
@@ -274,7 +278,19 @@ else {
 # Start TLS if configured
 if ($use_ssl == 2 && !$err) {
        local $mesg;
-       eval { $mesg = $ldap->start_tls; };
+       if ($certfile) {
+               # Use cert to connect
+               eval { $mesg = $ldap->start_tls(
+                                       cafile     => $cafile,
+                                        clientcert => $certfile,
+                                        clientkey  => $keyfile,
+                                        ciphers    => $ciphers
+                                       ); };
+
+               }
+       else {
+               eval { $mesg = $ldap->start_tls(); };
+               }
        if ($@ || !$mesg || $mesg->code) {
                $err = &text('ldap_etls', $@ ? $@ : $mesg ? $mesg->error :
                                          "Unknown error");