Support SASL LDAP binds and Start TLS

[btb]

Adapted from https://rt.cpan.org/Public/Bug/Display.html?id=50334

[tsibley]

Hi Bradley,

Thanks for the patch! I've taken a look at it, and have some changes I'd like to see.

Overall, this commit should really be split into two: one for TLS and the other for SASL.

Other changes I'd like to see:

• Config values should be hashes not hashrefs as they're less prone to user config error. You can do this by setting $RT::Config::META{OptionName}->{Type} = 'HASH'; and then accessing via RT->Config->Get("OptionName") in list context (scalar context will still get you a ref).
• $LDAPStartTLSArgs serves the dual purpose of both enabling TLS after connect and providing a place to modify args. It should be a boolean $LDAPStartTLS plus $LDAPStartTLSArgs for any advanced changes. This also means that the parameters to start_tls() should have some sane defaults provided by LDAPImport. In particular, verify => "require".
• The POD for $LDAPStartTLSArgs should link to Net::LDAP's start_tls documentation.
• Ditto for references to Authen::SASL.

Are you up for making those changes and repushing your branch / creating a new pull request?

[btb]

sure, I can do that

[btb]

It looks like META{...}->{Type} = 'HASH' would have to be set before the loading of, or inside of, the user's siteconfig file, is that correct? Should this plugin be providing an etc/LDAPImport_Config.pm file where we could put that as well as the defaults?

[tsibley]

You can set the type in LDAPImport.pm. The type is not necessary when setting values from the config files, but is necessary for calls to RT->Config->Set and ->Get to behave as expected. There doesn't need to be an etc/LDAPImport_Config.pm file.

[btb]

sorry I havent finished this yet. I'm wondering, are there any plans to roll group support into RT::Authen::ExternalAuth? Being able to grab groups from a shibboleth assertion for instance, seems really nice.

[ailin-nemui]

ping, TLS support would be awesome

[btb]

If someone else wants to make those changes that'd be great, I no longer deal very much with RT.