From 0f31566b27084ca6e224954128b7db96d7f89bd2 Mon Sep 17 00:00:00 2001
From: Eric Chiang <eric.chiang@coreos.com>
Date: Thu, 3 Nov 2016 16:28:23 -0700
Subject: [PATCH] connector: accept base64 encoded CA and add convience open
 method

---
 connector/ldap/ldap.go | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/connector/ldap/ldap.go b/connector/ldap/ldap.go
index dd45dd10..d2bce31b 100644
--- a/connector/ldap/ldap.go
+++ b/connector/ldap/ldap.go
@@ -61,6 +61,9 @@ type Config struct {
 	// Path to a trusted root certificate file.
 	RootCA string `json:"rootCA"`
 
+	// Base64 encoded PEM data containing root CAs.
+	RootCAData []byte `json:"rootCAData"`
+
 	// BindDN and BindPW for an application service account. The connector uses these
 	// credentials to search for users and groups.
 	BindDN string `json:"bindDN"`
@@ -167,6 +170,20 @@ func escapeFilter(s string) string {
 
 // Open returns an authentication strategy using LDAP.
 func (c *Config) Open() (connector.Connector, error) {
+	conn, err := c.OpenConnector()
+	if err != nil {
+		return nil, err
+	}
+	return connector.Connector(conn), nil
+}
+
+// OpenConnector is the same as Open but returns a type with all implemented connector interfaces.
+func (c *Config) OpenConnector() (interface {
+	connector.Connector
+	connector.PasswordConnector
+	connector.GroupsConnector
+}, error) {
+
 	requiredFields := []struct {
 		name string
 		val  string
@@ -196,10 +213,13 @@ func (c *Config) Open() (connector.Connector, error) {
 	}
 
 	tlsConfig := new(tls.Config)
-	if c.RootCA != "" {
-		data, err := ioutil.ReadFile(c.RootCA)
-		if err != nil {
-			return nil, fmt.Errorf("ldap: read ca file: %v", err)
+	if c.RootCA != "" || len(c.RootCAData) != 0 {
+		data := c.RootCAData
+		if len(data) == 0 {
+			var err error
+			if data, err = ioutil.ReadFile(c.RootCA); err != nil {
+				return nil, fmt.Errorf("ldap: read ca file: %v", err)
+			}
 		}
 		rootCAs := x509.NewCertPool()
 		if !rootCAs.AppendCertsFromPEM(data) {