add support for ldap bind password using secrets

[sealouse]

SUMMARY

Currently the LDAP configuration can not be configured without specifying the pulp setting PULP_AUTH_LDAP_BIND_PASSWORD in plain text. This is a small update to allow support for secrets when configuring PULP_AUTH_LDAP_BIND_PASSWORD

ADDITIONAL INFORMATION

After configuring the following

apiVersion: v1
kind: Secret
metadata:
  name: somesecret
  namespace: galaxy
type: Opaque
stringData:
  password: yourpassword

and specifying ldap_bind_password_secret in the spec:

---
spec:
  ...
  ldap_bind_password_secret: somesecret

The output of /etc/pulp/settings.py is:

bash-4.4$ cat /etc/pulp/settings.py
GALAXY_API_PATH_PREFIX = "api/galaxy"
CACHE_ENABLED = True
DB_ENCRYPTION_KEY = "/etc/pulp/keys/database_fields.symmetric.key"
.....
PUBLIC_KEY_PATH = "/etc/pulp/keys/container_auth_public_key.pem"
PRIVATE_KEY_PATH = "/etc/pulp/keys/container_auth_private_key.pem"
CSRF_TRUSTED_ORIGINS = ["http://localhost", "https://localhost"]
PULP_AUTH_LDAP_BIND_PASSWORD = "yourpassword"

regression test: without specifying "ldap_bind_password_secret", the property PULP_AUTH_LDAP_BIND_PASSWORD is absent in the pulp settings

[JoelKle]

This PR solves #96

[JoelKle]

@sealouse
I've tested your PR in my environment. The config param PULP_AUTH_LDAP_BIND_PASSWORD has not worked for me with the latest galaxy version.

  image: quay.io/ansible/galaxy-ng
  image_version: fcde54d5
  image_web: quay.io/ansible/galaxy-ui
  image_web_version: 58aba34e

If I set the config params without the PULP_ prefix, LDAP login at galaxy works fine.
E.g.

AUTH_LDAP_BIND_DN: "cn=proxy,ou=services,o=global"
AUTH_LDAP_BIND_PASSWORD: "xxx"
AUTH_LDAP_GROUP_SEARCH_BASE_DN: ",O=global"
AUTH_LDAP_GROUP_SEARCH_FILTER :  "(objectClass=Group)"
AUTH_LDAP_GROUP_SEARCH_SCOPE: "SUBTREE"
AUTH_LDAP_GROUP_TYPE_CLASS: "django_auth_ldap.config:GroupOfNamesType"
AUTH_LDAP_REQUIRE_GROUP: "CN=ansible,O=global"
AUTH_LDAP_SERVER_URI: "ldaps://xxx:636"
AUTH_LDAP_USER_ATTR_MAP: '{"first_name": "givenName", "last_name": "sn", "email": "mail"}'
AUTH_LDAP_USER_SEARCH_BASE_DN: "o=employee"
AUTH_LDAP_USER_SEARCH_FILTER: "(uid=%(user)s)"
AUTH_LDAP_USER_SEARCH_SCOPE: "SUBTREE"
AUTHENTICATION_BACKEND_PRESET: ldap

Is this the same for you?

The rest of the PR works like a charm, thank you :)

[sealouse]

@sealouse I've tested your PR in my environment. The config param PULP_AUTH_LDAP_BIND_PASSWORD has not worked for me with the latest galaxy version.

  image: quay.io/ansible/galaxy-ng
  image_version: fcde54d5
  image_web: quay.io/ansible/galaxy-ui
  image_web_version: 58aba34e

If I set the config params without the PULP_ prefix, LDAP login at galaxy works fine. E.g.

AUTH_LDAP_BIND_DN: "cn=proxy,ou=services,o=global"
AUTH_LDAP_BIND_PASSWORD: "xxx"
AUTH_LDAP_GROUP_SEARCH_BASE_DN: ",O=global"
AUTH_LDAP_GROUP_SEARCH_FILTER :  "(objectClass=Group)"
AUTH_LDAP_GROUP_SEARCH_SCOPE: "SUBTREE"
AUTH_LDAP_GROUP_TYPE_CLASS: "django_auth_ldap.config:GroupOfNamesType"
AUTH_LDAP_REQUIRE_GROUP: "CN=ansible,O=global"
AUTH_LDAP_SERVER_URI: "ldaps://xxx:636"
AUTH_LDAP_USER_ATTR_MAP: '{"first_name": "givenName", "last_name": "sn", "email": "mail"}'
AUTH_LDAP_USER_SEARCH_BASE_DN: "o=employee"
AUTH_LDAP_USER_SEARCH_FILTER: "(uid=%(user)s)"
AUTH_LDAP_USER_SEARCH_SCOPE: "SUBTREE"
AUTHENTICATION_BACKEND_PRESET: ldap

Is this the same for you?

The rest of the PR works like a charm, thank you :)

You are right, AUTH_LDAP_BIND_PASSWORD is the correct key, I made the corresponding modifications to apply "AUTH_LDAP_BIND_PASSWORD" instead of the one with the PULP prefix

[JoelKle]

@fao89 @rooftopcellist
Can we merge this PR? It would improve the security of the galaxy-operator.
My tests were also successful. Thanks

[dustinmhorvath]

I can haz?

[bradsorph]

Any news about this PR? Is there a schedule for the approval?