7f39399c32
* Added auto-generated uidNumber and guidNumber generated attributes for use with SSSD and similar software. The starting number for uid/gid can be configured iva environtment variables and is by default 2000 which should work fine for most instances unless there are more than 999 local accounts on the server/computer. The uidNumber is just the users Pk + the starting number. The guidNumber is calculated by the last couple of bytes in the uuid of the group + the starting number, this should have a low enough chance for collisions that it's going to be fine for most use cases. I have not added any interface stuff for configuring the environment variables as I couldn't really find my way around all the places I'd have to edit to add it and the default values should in my opinion be fine for 99% use cases. * Add a 'fake' primary group for each user * First attempt att adding config to interface * Updated API to support new fields * Refactor code, update documentation and remove obsolete comment Simplify `GetRIDForGroup`, was a bit overcomplicated before. Add an additional class/struct `LDAPGroup` which is the new argument for `pi.GroupEntry` and util functions to create `LDAPGroup` from api.Group and api.User Add proper support in the interface for changing gidNumber and uidNumber starting points * make lint-fix for the migration files
82 lines
1.4 KiB
Go
82 lines
1.4 KiB
Go
package ldap
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"sync"
|
|
|
|
"github.com/go-openapi/strfmt"
|
|
log "github.com/sirupsen/logrus"
|
|
"goauthentik.io/outpost/api"
|
|
"goauthentik.io/outpost/pkg/ak"
|
|
|
|
"github.com/nmcclain/ldap"
|
|
)
|
|
|
|
const GroupObjectClass = "group"
|
|
const UserObjectClass = "user"
|
|
|
|
type ProviderInstance struct {
|
|
BaseDN string
|
|
|
|
UserDN string
|
|
GroupDN string
|
|
|
|
appSlug string
|
|
flowSlug string
|
|
s *LDAPServer
|
|
log *log.Entry
|
|
|
|
tlsServerName *string
|
|
cert *tls.Certificate
|
|
|
|
searchAllowedGroups []*strfmt.UUID
|
|
boundUsersMutex sync.RWMutex
|
|
boundUsers map[string]UserFlags
|
|
|
|
uidStartNumber int32
|
|
gidStartNumber int32
|
|
}
|
|
|
|
type UserFlags struct {
|
|
UserInfo api.User
|
|
CanSearch bool
|
|
}
|
|
|
|
type LDAPServer struct {
|
|
s *ldap.Server
|
|
log *log.Entry
|
|
ac *ak.APIController
|
|
defaultCert *tls.Certificate
|
|
providers []*ProviderInstance
|
|
}
|
|
|
|
type LDAPGroup struct {
|
|
dn string
|
|
cn string
|
|
uid string
|
|
gidNumber string
|
|
member []string
|
|
isSuperuser bool
|
|
isVirtualGroup bool
|
|
akAttributes interface{}
|
|
}
|
|
|
|
func NewServer(ac *ak.APIController) *LDAPServer {
|
|
s := ldap.NewServer()
|
|
s.EnforceLDAP = true
|
|
ls := &LDAPServer{
|
|
s: s,
|
|
log: log.WithField("logger", "authentik.outpost.ldap"),
|
|
ac: ac,
|
|
providers: []*ProviderInstance{},
|
|
}
|
|
defaultCert, err := ak.GenerateSelfSignedCert()
|
|
if err != nil {
|
|
log.Warning(err)
|
|
}
|
|
ls.defaultCert = &defaultCert
|
|
s.BindFunc("", ls)
|
|
s.SearchFunc("", ls)
|
|
return ls
|
|
}
|