fix(settings): disable LDAP by default (#1191)

Author: Matthew Fisher

rootfs/api/settings/production.py

@@ -109,7 +109,6 @@
 )
 
 AUTHENTICATION_BACKENDS = (
-    "django_auth_ldap.backend.LDAPBackend",
     "django.contrib.auth.backends.ModelBackend",
     "guardian.backends.ObjectPermissionBackend",
 )
@@ -367,31 +366,33 @@
 # verbose logging from auth-ldap plugin:
 # https://pythonhosted.org/django-auth-ldap/logging.html
 
-AUTH_LDAP_SERVER_URI = LDAP_ENDPOINT
-AUTH_LDAP_BIND_DN = LDAP_BIND_DN
-AUTH_LDAP_BIND_PASSWORD = LDAP_BIND_PASSWORD
-AUTH_LDAP_USER_SEARCH = LDAPSearch(
-    base_dn=LDAP_USER_BASEDN,
-    scope=ldap.SCOPE_SUBTREE,
-    filterstr="(%s=%%(user)s)" % LDAP_USER_FILTER
-)
-AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
-    base_dn=LDAP_GROUP_BASEDN,
-    scope=ldap.SCOPE_SUBTREE,
-    filterstr="(%s)" % LDAP_GROUP_FILTER
-)
-AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()
-AUTH_LDAP_USER_ATTR_MAP = {
-    "first_name": "givenName",
-    "last_name": "sn",
-    "email": "mail",
-    "username": LDAP_USER_FILTER,
-}
-AUTH_LDAP_GLOBAL_OPTIONS = {
-    ldap.OPT_X_TLS_REQUIRE_CERT: False,
-    ldap.OPT_REFERRALS: False
-}
-AUTH_LDAP_ALWAYS_UPDATE_USER = True
-AUTH_LDAP_MIRROR_GROUPS = True
-AUTH_LDAP_FIND_GROUP_PERMS = True
-AUTH_LDAP_CACHE_GROUPS = False
+if LDAP_ENDPOINT:
+    AUTHENTICATION_BACKENDS = ("django_auth_ldap.backend.LDAPBackend",) + AUTHENTICATION_BACKENDS
+    AUTH_LDAP_SERVER_URI = LDAP_ENDPOINT
+    AUTH_LDAP_BIND_DN = LDAP_BIND_DN
+    AUTH_LDAP_BIND_PASSWORD = LDAP_BIND_PASSWORD
+    AUTH_LDAP_USER_SEARCH = LDAPSearch(
+        base_dn=LDAP_USER_BASEDN,
+        scope=ldap.SCOPE_SUBTREE,
+        filterstr="(%s=%%(user)s)" % LDAP_USER_FILTER
+    )
+    AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
+        base_dn=LDAP_GROUP_BASEDN,
+        scope=ldap.SCOPE_SUBTREE,
+        filterstr="(%s)" % LDAP_GROUP_FILTER
+    )
+    AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()
+    AUTH_LDAP_USER_ATTR_MAP = {
+        "first_name": "givenName",
+        "last_name": "sn",
+        "email": "mail",
+        "username": LDAP_USER_FILTER,
+    }
+    AUTH_LDAP_GLOBAL_OPTIONS = {
+        ldap.OPT_X_TLS_REQUIRE_CERT: False,
+        ldap.OPT_REFERRALS: False
+    }
+    AUTH_LDAP_ALWAYS_UPDATE_USER = True
+    AUTH_LDAP_MIRROR_GROUPS = True
+    AUTH_LDAP_FIND_GROUP_PERMS = True
+    AUTH_LDAP_CACHE_GROUPS = False

rootfs/api/tests/test_auth.py

@@ -6,6 +6,8 @@
 from django.contrib.auth.models import User
 from django.test.utils import override_settings
 from rest_framework.authtoken.models import Token
+from unittest import mock
+
 from api.tests import TEST_ROOT, DeisTestCase
 from api.models import Certificate
 
@@ -371,3 +373,10 @@ def test_regenerate(self):
 
         response = self.client.post(url, {})
         self.assertEqual(response.status_code, 401, response.data)
+
+    @mock.patch('django_auth_ldap.backend.logger')
+    def test_auth_no_ldap_by_default(self, mock_logger):
+        """Ensure that LDAP authentication is disabled by default."""
+        self.test_auth()
+        # NOTE(bacongobbler): Using https://github.com/deis/controller/issues/1189 as a test case
+        mock_logger.warning.assert_not_called()