From 6ef8ace0255acd39f595d4c50e42f6c16139944f Mon Sep 17 00:00:00 2001
From: Trinity Pointard <trinity.pointard@gmail.fr>
Date: Sun, 21 Feb 2021 15:34:44 +0100
Subject: [PATCH] attempt to do non anonymous ldap connect

---
 plume-models/src/config.rs | 11 ++++++++++-
 plume-models/src/users.rs  | 21 +++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/plume-models/src/config.rs b/plume-models/src/config.rs
index 3bd3623b..cd137dae 100644
--- a/plume-models/src/config.rs
+++ b/plume-models/src/config.rs
@@ -254,6 +254,7 @@ pub struct LdapConfig {
     pub tls: bool,
     pub user_name_attr: String,
     pub mail_attr: String,
+    pub user: Option<(String, String)>,
 }
 
 fn get_ldap_config() -> Option<LdapConfig> {
@@ -269,16 +270,24 @@ fn get_ldap_config() -> Option<LdapConfig> {
             };
             let user_name_attr = var("LDAP_USER_NAME_ATTR").unwrap_or_else(|_| "cn".to_owned());
             let mail_attr = var("LDAP_USER_MAIL_ATTR").unwrap_or_else(|_| "mail".to_owned());
+            let user = var("LDAP_USER").ok();
+            let password = var("LDAP_PASSWORD").ok();
+            let user = match (user, password) {
+                (Some(user), Some(password)) => Some((user, password)),
+                (None, None) => None,
+                _ => panic!("Invalid LDAP configuration both or neither of LDAP_USER and LDAP_PASSWORD must be set")           
+            };
             Some(LdapConfig {
                 addr,
                 base_dn,
                 tls,
                 user_name_attr,
                 mail_attr,
+                user
             })
         }
         (None, None) => None,
-        (_, _) => {
+        _ => {
             panic!("Invalid LDAP configuration : both LDAP_ADDR and LDAP_BASE_DN must be set")
         }
     }
diff --git a/plume-models/src/users.rs b/plume-models/src/users.rs
index 95b4d758..1eb02fe8 100644
--- a/plume-models/src/users.rs
+++ b/plume-models/src/users.rs
@@ -293,6 +293,21 @@ impl User {
         bcrypt::hash(pass, 10).map_err(Error::from)
     }
 
+    fn ldap_preconn(ldap_conn: &mut LdapConn) -> Result<()> {
+        let ldap = CONFIG.ldap.as_ref().unwrap();
+
+        if let Some((user, password)) = ldap.user.as_ref() {
+            let bind = ldap_conn
+                .simple_bind(user, password)
+                .map_err(|_| Error::NotFound)?;
+
+            if bind.success().is_err() {
+                return Err(Error::NotFound);
+            }
+        }
+        Ok(())
+    }
+
     fn ldap_register(conn: &Connection, name: &str, password: &str) -> Result<User> {
         if CONFIG.ldap.is_none() {
             return Err(Error::NotFound);
@@ -300,6 +315,9 @@ impl User {
         let ldap = CONFIG.ldap.as_ref().unwrap();
 
         let mut ldap_conn = LdapConn::new(&ldap.addr).map_err(|_| Error::NotFound)?;
+
+        User::ldap_preconn(&mut ldap_conn)?;
+
         let ldap_name = format!("{}={},{}", ldap.user_name_attr, name, ldap.base_dn);
         let bind = ldap_conn
             .simple_bind(&ldap_name, password)
@@ -346,6 +364,9 @@ impl User {
             } else {
                 return false;
             };
+            if User::ldap_preconn(&mut conn).is_err() {
+                return false;
+            }
             let name = format!(
                 "{}={},{}",
                 ldap.user_name_attr, &self.username, ldap.base_dn