Re: [PATCH] ldap.el: use auth-source if passwd is not defined in ldap-host-parameters-list

[Ted Zlatanov]

On Sat, 05 Mar 2011 11:16:39 +0200 Leonidas Tsampros <address@hidden> wrote: 

LT> Ted Zlatanov <address@hidden> writes:
>> On Fri, 04 Mar 2011 22:47:20 +0200 Leonidas Tsampros <address@hidden> wrote:
>> 
LT> Attached you can find a small patch to make ldap.el use auth-source if
LT> passwd is not defined in the ldap-host-parameters-list.
>> 
>> Cool!  I made some changes to it, please let me know what you think:
>> 
>> - must pass `auth-source' set to t in the SEARCH-PLIST to activate this
>> functionality (I don't know if you agree)

LT> Agreed. It's nice not to catch users by surprise.

>> - search for 'port "ldap"' entries in the netrc file (should we default
>> to no port?)

LT> This is the only part I disagree a bit. For example, my imap host is the
LT> same with my ldap host, the credentials are the same for both services,
LT> and both imap/ldap use the default ports. (This is a classic case of an
LT> Exchange server I think)

This makes sense, especially since ldap.el hosts can be in the format
"server:port".  I removed the "port ldap" requirement.

>> - take the password and use it
>> 
>> - take "binddn" or "user" tokens for `binddn'
>> 
>> - take "base" tokens for `base'

LT> (Really there is no wrong direction in this. We just don't want to carry
LT> passwords in our configuration files. :)

Agreed, and that's why I've been working on auth-source.el.

Try the attached patch.  If it works for you I'll push it into the
trunk.  Let me know if I need to update any other documentation besides
the docstring.  It looks like only Chong Yidong has made significant
changes to ldap.el since 2005 so I'm not CC-ing the original author.

Thanks
Ted

=== modified file 'lisp/net/ldap.el'
--- lisp/net/ldap.el    2011-01-25 04:08:28 +0000
+++ lisp/net/ldap.el    2011-03-07 10:48:11 +0000
@@ -36,6 +36,8 @@
 (require 'custom)
 (eval-when-compile (require 'cl))
 
+(autoload 'auth-source-search "auth-source")
+
 (defgroup ldap nil
   "Lightweight Directory Access Protocol."
   :version "21.1"
@@ -480,6 +482,22 @@
   "Perform a search on a LDAP server.
 SEARCH-PLIST is a property list describing the search request.
 Valid keys in that list are:
+
+  `auth-source', if non-nil, will use `auth-source-search' and
+will grab the :host, :secret, :base, and (:user or :binddn)
+tokens into the `host', `passwd', `base', and `binddn' parameters
+respectively if they are not provided in SEARCH-PLIST.  So for
+instance *each* of these netrc lines has the same effect if you
+ask for the host \"ldapserver:2400\":
+
+  machine ldapserver:2400 login myDN secret myPassword base myBase
+  machine ldapserver:2400 binddn myDN secret myPassword port ldap
+  login myDN secret myPassword base myBase
+
+but if you have more than one in your netrc file, only the first
+matching one will be used.  Note the \"port ldap\" part is NOT
+required.
+
   `host' is a string naming one or more (blank-separated) LDAP servers to
 to try to connect to.  Each host name may optionally be of the form HOST:PORT.
   `filter' is a filter string for the search as described in RFC 1558.
@@ -500,19 +518,34 @@
 its distinguished name DN.
 The function returns a list of matching entries.  Each entry is itself
 an alist of attribute/value pairs."
-  (let ((buf (get-buffer-create " *ldap-search*"))
+  (let* ((buf (get-buffer-create " *ldap-search*"))
        (bufval (get-buffer-create " *ldap-value*"))
        (host (or (plist-get search-plist 'host)
                  ldap-default-host))
+         ;; find entries with port "ldap" that match the requested host if any
+         (asfound (when (plist-get search-plist 'auth-source)
+                    (nth 0 (auth-source-search :host (or host t)
+                                               :create t))))
+         ;; if no host was requested, get it from the auth-source entry
+         (host (or host (plist-get asfound :host)))
+         ;; get the password from the auth-source
+         (passwd (or (plist-get search-plist 'passwd)
+                     (plist-get asfound :secret)))
+         ;; convert the password from a function call if needed
+         (passwd (if (functionp passwd) (funcall passwd) passwd))
+         ;; get the binddn from the search-list or from the
+         ;; auth-source user or binddn tokens
+         (binddn (or (plist-get search-plist 'binddn)
+                     (plist-get asfound :user)
+                     (plist-get asfound :binddn)))
+         (base (or (plist-get search-plist 'base)
+                   (plist-get asfound :base)
+                   ldap-default-base))
        (filter (plist-get search-plist 'filter))
        (attributes (plist-get search-plist 'attributes))
        (attrsonly (plist-get search-plist 'attrsonly))
-       (base (or (plist-get search-plist 'base)
-                 ldap-default-base))
        (scope (plist-get search-plist 'scope))
-       (binddn (plist-get search-plist 'binddn))
         (auth (plist-get search-plist 'auth))
-       (passwd (plist-get search-plist 'passwd))
        (deref (plist-get search-plist 'deref))
        (timelimit (plist-get search-plist 'timelimit))
        (sizelimit (plist-get search-plist 'sizelimit))