4teamwork/opengever.core — pull request #119 by shylux (2013-10-21 13:49:49+00:00)
Title: Managing and deploying LDAP credentials

A couple weeks ago we decided not to check in the `ldap_plugin.xml` from `opengever/examplecontent/profiles/4teamwork-ldap` anymore, in order not to have LDAP credentials in public git repos.

However, because during release of `opengever.core-3.0` the `.gitignore` wasn't respected, it got released once again, and we had to change the LDAP password for that tree again.

Besides being a huge pain in the ass (42 local opengever buildouts means copying around `ldap_plugin.xml` 42 times), this approach still bears a considerable security risk.

So I propose the following:

* `ldap_plugin.xml` will always be checked in, including all the necessary settings like groups base, users base, hostname and port. However, the bind UID and bind password will be set to dummy values like `REPLACEME`.
* Somewhere in `opengever.core` we define a Python function to be used in setuphandlers of all the policy packages that contain LDAP configurations.
* This Python code will be run after the LDAP plugin GS XML has been imported, and extracts the LDAP hostname from each configured LDAP plugin.
* If the bind UID and bind PW values are still set to `REPLACEME`, it will look for a file `~/.opengever/ldap/${hostname}.json` that contains just the credentials (bind UID and bind PW), and sets those for each LDAP plugin accordingly.

This will allow us to place credentials on our development boxes exactly ONCE, no matter how many buildouts using the same LDAP server there are on that box. Same for production servers, where the credentials could even be deployed in an automated fashion (puppet).

Also the credentials files live outside of any source trees, so there's a barrier that prevents them from accidentally being checked in, released or copied around.