[cconard96]

Checklist before requesting a review

• I have read the CONTRIBUTING document.
• I have performed a self-review of my code.

Description

TLS 1.0 and 1.1 are very insecure, deprecated, and are strictly prohibited by many compliance frameworks. There does not seem to be a good reason to keep them as options in GLPI.

For reference, TLS 1.2 support was added in:

• Windows Server 2008 R2 (Disabled by default)
• Windows Server 2012 (Enabled by default)
• OpenLDAP 2.4 (Released in 2007, but officially supported alongside OpenSSL 1.0.1 in 2012)

As of this PR therefore, it has been 14 years since TLS 1.2 was available in the most common LDAP servers and IMO has been more than enough time to stop using the older versions.

Any LDAP server configured in GLPI using 1.0 or 1.1 will automatically be changed to 1.2 during the update.

[qodo-free-for-open-source-projects]

Code Review by Qodo

Resolved findings

1. The LDAP migration hardcodes a table name ⊘ Outdated

Description

The new $DB->update() call names glpi_authldaps directly instead of obtaining the table name
through AuthLDAP::getTable(). This breaks the project's database rule for changed PHP lines and
leaves the migration tied to a separately maintained spelling of the LDAP table name.

2. LDAP connections can still use old TLS ✓ Resolved

Description

Removing 1.0 and 1.1 from TLS_VERSIONS also removes their explicit :!VERS-TLS1.0 and
:!VERS-TLS1.1 exclusions from the priority string built by connectToServer(). For a
configuration selecting 1.2 or 1.3, including one converted by the migration, the resulting NORMAL
priority string no longer forbids the older versions when they are available to the LDAP TLS library
and peer.

3. The TLS change has no regression test ✓ Resolved

Description

The PR changes the supported TLS list and adds a data conversion without adding a test that fails if
either behavior is absent. Existing LDAP connection tests do not select a TLS version, and the
update tests do not run this migration against stored LDAP settings, leaving both changes outside
the regression coverage required by CONTRIBUTING.md.