enforce a sane default OPT_NETWORK_TIMEOUT for LDAP connections

see: #5208

awx/sso/backends.py

@@ -5,6 +5,8 @@
 import logging
 import uuid
 
+import ldap
+
 # Django
 from django.dispatch import receiver
 from django.contrib.auth.models import User
@@ -38,6 +40,16 @@ class LDAPSettings(BaseLDAPSettings):
         'TEAM_MAP': {},
     }.items())
 
+    def __init__(self, prefix='AUTH_LDAP_', defaults={}):
+        super(LDAPSettings, self).__init__(prefix, defaults)
+
+        # If a DB-backed setting is specified that wipes out the
+        # OPT_NETWORK_TIMEOUT, fall back to a sane default
+        if ldap.OPT_NETWORK_TIMEOUT not in getattr(self, 'CONNECTION_OPTIONS', {}):
+            options = getattr(self, 'CONNECTION_OPTIONS', {})
+            options[ldap.OPT_NETWORK_TIMEOUT] = 30
+            self.CONNECTION_OPTIONS = options
+
 
 class LDAPBackend(BaseLDAPBackend):
     '''

awx/sso/conf.py

@@ -228,7 +228,7 @@ register(
 register(
     'AUTH_LDAP_CONNECTION_OPTIONS',
     field_class=fields.LDAPConnectionOptionsField,
-    default={'OPT_REFERRALS': 0},
+    default={'OPT_REFERRALS': 0, 'OPT_NETWORK_TIMEOUT': 30},
     label=_('LDAP Connection Options'),
     help_text=_('Additional options to set for the LDAP connection.  LDAP '
                 'referrals are disabled by default (to prevent certain LDAP '
@@ -240,6 +240,7 @@ register(
     category_slug='ldap',
     placeholder=collections.OrderedDict([
         ('OPT_REFERRALS', 0),
+        ('OPT_NETWORK_TIMEOUT', 30)
     ]),
     feature_required='ldap',
 )

awx/sso/tests/functional/test_ldap.py

@@ -0,0 +1,24 @@
+from django.test.utils import override_settings
+import ldap
+import pytest
+
+from awx.sso.backends import LDAPSettings
+
+
+@override_settings(AUTH_LDAP_CONNECTION_OPTIONS = {ldap.OPT_NETWORK_TIMEOUT: 60})
+@pytest.mark.django_db
+def test_ldap_with_custom_timeout():
+    settings = LDAPSettings()
+    assert settings.CONNECTION_OPTIONS == {
+        ldap.OPT_NETWORK_TIMEOUT: 60
+    }
+
+
+@override_settings(AUTH_LDAP_CONNECTION_OPTIONS = {ldap.OPT_REFERRALS: 0})
+@pytest.mark.django_db
+def test_ldap_with_missing_timeout():
+    settings = LDAPSettings()
+    assert settings.CONNECTION_OPTIONS == {
+        ldap.OPT_REFERRALS: 0,
+        ldap.OPT_NETWORK_TIMEOUT: 30
+    }

awx/sso/tests/unit/test_ldap.py

@@ -0,0 +1,21 @@
+import ldap
+
+from awx.sso.backends import LDAPSettings
+
+
+def test_ldap_default_settings(mocker):
+    from_db = mocker.Mock(**{'order_by.return_value': []})
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=from_db):
+        settings = LDAPSettings()
+        assert settings.ORGANIZATION_MAP == {}
+        assert settings.TEAM_MAP == {}
+
+
+def test_ldap_default_network_timeout(mocker):
+    from_db = mocker.Mock(**{'order_by.return_value': []})
+    with mocker.patch('awx.conf.models.Setting.objects.filter', return_value=from_db):
+        settings = LDAPSettings()
+        assert settings.CONNECTION_OPTIONS == {
+            ldap.OPT_REFERRALS: 0,
+            ldap.OPT_NETWORK_TIMEOUT: 30
+        }