TLS

membership/members/directory.py

@@ -1,4 +1,4 @@
-"""TLS-only LDAP; paid groups are never granted during registration or login."""
+"""TLS by default; paid groups are never granted during registration or login."""
 
 import re
 import ssl
@@ -22,7 +22,8 @@ def connection():
     conn = Connection(server, user=settings.LDAP_BIND_DN, password=settings.LDAP_BIND_PASSWORD, raise_exceptions=True, receive_timeout=8, auto_referrals=False)
     try:
         conn.open()
-        if url.scheme == "ldap" and not conn.start_tls():
+        # Plaintext requires explicit operator consent; LDAPS is never downgraded.
+        if url.scheme == "ldap" and not settings.LDAP_ALLOW_INSECURE and not conn.start_tls():
             raise LDAPException("StartTLS failed; refusing to bind.")
         if not conn.bind():
             raise LDAPException("LDAP bind failed.")