2015-08-16 14:31:54 +08:00
// Copyright 2014 The Gogs Authors. All rights reserved.
2014-04-23 00:55:27 +08:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
2015-08-16 14:31:54 +08:00
// Package ldap provide functions & structure to query a LDAP ldap directory
2014-04-23 00:55:27 +08:00
// For now, it's mainly tested again an MS Active Directory service, see README.md for more information
package ldap
import (
2015-09-15 03:48:51 +08:00
"crypto/tls"
2014-04-23 00:55:27 +08:00
"fmt"
2015-10-27 09:08:59 +08:00
"strings"
2014-05-03 10:48:14 +08:00
2015-11-27 03:04:58 +08:00
"gopkg.in/ldap.v2"
2016-11-11 00:24:48 +08:00
"code.gitea.io/gitea/modules/log"
2014-04-23 00:55:27 +08:00
)
2016-11-27 14:03:59 +08:00
// SecurityProtocol protocol type
2016-07-08 07:25:09 +08:00
type SecurityProtocol int
// Note: new type must be added at the end of list to maintain compatibility.
const (
2016-11-08 00:38:43 +08:00
SecurityProtocolUnencrypted SecurityProtocol = iota
2016-11-08 04:58:22 +08:00
SecurityProtocolLDAPS
SecurityProtocolStartTLS
2016-07-08 07:25:09 +08:00
)
2016-11-27 14:03:59 +08:00
// Source Basic LDAP authentication service
2015-09-15 03:48:51 +08:00
type Source struct {
2015-12-01 21:49:49 +08:00
Name string // canonical name (ie. corporate.ad)
Host string // LDAP host
Port int / / port number
2016-07-08 07:25:09 +08:00
SecurityProtocol SecurityProtocol
2015-12-01 21:49:49 +08:00
SkipVerify bool
BindDN string // DN to bind with
BindPassword string // Bind DN password
UserBase string // Base search path for users
UserDN string // Template for the DN of the user for simple auth
AttributeUsername string // Username attribute
AttributeName string // First name attribute
AttributeSurname string // Surname attribute
AttributeMail string // E-mail attribute
2016-02-16 19:33:16 +08:00
AttributesInBind bool // fetch attributes in bind context (not user)
2015-12-01 21:49:49 +08:00
Filter string // Query filter to validate entry
AdminFilter string // Query filter to check if user is admin
Enabled bool // if this source is disabled
2014-04-23 00:55:27 +08:00
}
2017-05-10 21:10:18 +08:00
// SearchResult : user data
type SearchResult struct {
Username string // Username
Name string // Name
Surname string // Surname
Mail string // E-mail address
IsAdmin bool // if user is administrator
}
2015-10-27 09:08:59 +08:00
func ( ls * Source ) sanitizedUserQuery ( username string ) ( string , bool ) {
// See http://tools.ietf.org/search/rfc4515
badCharacters := "\x00()*\\"
if strings . ContainsAny ( username , badCharacters ) {
log . Debug ( "'%s' contains invalid query characters. Aborting." , username )
return "" , false
}
return fmt . Sprintf ( ls . Filter , username ) , true
}
func ( ls * Source ) sanitizedUserDN ( username string ) ( string , bool ) {
// See http://tools.ietf.org/search/rfc4514: "special characters"
2017-11-13 17:32:16 +08:00
badCharacters := "\x00()*\\,='\"#+;<>"
2015-10-27 09:08:59 +08:00
if strings . ContainsAny ( username , badCharacters ) {
log . Debug ( "'%s' contains invalid DN characters. Aborting." , username )
return "" , false
}
return fmt . Sprintf ( ls . UserDN , username ) , true
}
2016-02-16 18:58:00 +08:00
func ( ls * Source ) findUserDN ( l * ldap . Conn , name string ) ( string , bool ) {
2015-08-13 07:58:27 +08:00
log . Trace ( "Search for LDAP user: %s" , name )
if ls . BindDN != "" && ls . BindPassword != "" {
2016-02-16 18:58:00 +08:00
err := l . Bind ( ls . BindDN , ls . BindPassword )
2015-08-13 07:58:27 +08:00
if err != nil {
2015-08-18 04:03:11 +08:00
log . Debug ( "Failed to bind as BindDN[%s]: %v" , ls . BindDN , err )
2015-08-16 14:31:54 +08:00
return "" , false
2014-04-23 00:55:27 +08:00
}
2015-08-13 07:58:27 +08:00
log . Trace ( "Bound as BindDN %s" , ls . BindDN )
} else {
log . Trace ( "Proceeding with anonymous LDAP search." )
}
// A search for the user.
2015-10-27 09:08:59 +08:00
userFilter , ok := ls . sanitizedUserQuery ( name )
if ! ok {
return "" , false
}
2016-02-16 19:36:40 +08:00
log . Trace ( "Searching for DN using filter %s and base %s" , userFilter , ls . UserBase )
2015-08-13 07:58:27 +08:00
search := ldap . NewSearchRequest (
ls . UserBase , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 ,
false , userFilter , [ ] string { } , nil )
// Ensure we found a user
sr , err := l . Search ( search )
if err != nil || len ( sr . Entries ) < 1 {
2015-08-18 04:03:11 +08:00
log . Debug ( "Failed search using filter[%s]: %v" , userFilter , err )
2015-08-16 14:31:54 +08:00
return "" , false
2015-08-13 07:58:27 +08:00
} else if len ( sr . Entries ) > 1 {
log . Debug ( "Filter '%s' returned more than one user." , userFilter )
2015-08-16 14:31:54 +08:00
return "" , false
2014-04-23 00:55:27 +08:00
}
2015-08-13 07:58:27 +08:00
2015-08-16 14:31:54 +08:00
userDN := sr . Entries [ 0 ] . DN
2015-08-13 07:58:27 +08:00
if userDN == "" {
2015-12-06 22:42:23 +08:00
log . Error ( 4 , "LDAP search was successful, but found no DN!" )
2015-08-16 14:31:54 +08:00
return "" , false
2015-08-13 07:58:27 +08:00
}
2015-08-16 14:31:54 +08:00
return userDN , true
2014-04-23 00:55:27 +08:00
}
2016-07-08 07:25:09 +08:00
func dial ( ls * Source ) ( * ldap . Conn , error ) {
log . Trace ( "Dialing LDAP with security protocol (%v) without verifying: %v" , ls . SecurityProtocol , ls . SkipVerify )
tlsCfg := & tls . Config {
ServerName : ls . Host ,
InsecureSkipVerify : ls . SkipVerify ,
}
2016-11-08 04:58:22 +08:00
if ls . SecurityProtocol == SecurityProtocolLDAPS {
2016-07-08 07:25:09 +08:00
return ldap . DialTLS ( "tcp" , fmt . Sprintf ( "%s:%d" , ls . Host , ls . Port ) , tlsCfg )
}
conn , err := ldap . Dial ( "tcp" , fmt . Sprintf ( "%s:%d" , ls . Host , ls . Port ) )
if err != nil {
return nil , fmt . Errorf ( "Dial: %v" , err )
}
2016-11-08 04:58:22 +08:00
if ls . SecurityProtocol == SecurityProtocolStartTLS {
2016-07-08 07:25:09 +08:00
if err = conn . StartTLS ( tlsCfg ) ; err != nil {
conn . Close ( )
return nil , fmt . Errorf ( "StartTLS: %v" , err )
}
}
return conn , nil
}
func bindUser ( l * ldap . Conn , userDN , passwd string ) error {
log . Trace ( "Binding with userDN: %s" , userDN )
err := l . Bind ( userDN , passwd )
if err != nil {
log . Debug ( "LDAP auth. failed for %s, reason: %v" , userDN , err )
return err
}
log . Trace ( "Bound successfully with userDN: %s" , userDN )
return err
}
2017-05-10 21:10:18 +08:00
func checkAdmin ( l * ldap . Conn , ls * Source , userDN string ) bool {
if len ( ls . AdminFilter ) > 0 {
log . Trace ( "Checking admin with filter %s and base %s" , ls . AdminFilter , userDN )
search := ldap . NewSearchRequest (
userDN , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , ls . AdminFilter ,
[ ] string { ls . AttributeName } ,
nil )
sr , err := l . Search ( search )
if err != nil {
log . Error ( 4 , "LDAP Admin Search failed unexpectedly! (%v)" , err )
} else if len ( sr . Entries ) < 1 {
log . Error ( 4 , "LDAP Admin Search failed" )
} else {
return true
}
}
return false
}
2016-11-27 14:03:59 +08:00
// SearchEntry : search an LDAP source if an entry (name, passwd) is valid and in the specific filter
2017-05-10 21:10:18 +08:00
func ( ls * Source ) SearchEntry ( name , passwd string , directBind bool ) * SearchResult {
2016-12-12 08:46:51 +08:00
// See https://tools.ietf.org/search/rfc4513#section-5.1.2
if len ( passwd ) == 0 {
log . Debug ( "Auth. failed for %s, password cannot be empty" )
2017-05-10 21:10:18 +08:00
return nil
2016-12-12 08:46:51 +08:00
}
2016-07-08 07:25:09 +08:00
l , err := dial ( ls )
2016-02-16 18:58:00 +08:00
if err != nil {
log . Error ( 4 , "LDAP Connect error, %s:%v" , ls . Host , err )
ls . Enabled = false
2017-05-10 21:10:18 +08:00
return nil
2016-02-16 18:58:00 +08:00
}
defer l . Close ( )
2015-09-05 11:39:23 +08:00
var userDN string
if directBind {
2015-09-17 00:15:14 +08:00
log . Trace ( "LDAP will bind directly via UserDN template: %s" , ls . UserDN )
2015-10-27 09:08:59 +08:00
var ok bool
userDN , ok = ls . sanitizedUserDN ( name )
if ! ok {
2017-05-10 21:10:18 +08:00
return nil
2015-10-27 09:08:59 +08:00
}
2015-09-05 11:39:23 +08:00
} else {
log . Trace ( "LDAP will use BindDN." )
var found bool
2016-02-16 18:58:00 +08:00
userDN , found = ls . findUserDN ( l , name )
2015-09-05 11:39:23 +08:00
if ! found {
2017-05-10 21:10:18 +08:00
return nil
2015-09-05 11:39:23 +08:00
}
2015-08-13 07:58:27 +08:00
}
2016-02-16 19:33:16 +08:00
if directBind || ! ls . AttributesInBind {
// binds user (checking password) before looking-up attributes in user context
err = bindUser ( l , userDN , passwd )
if err != nil {
2017-05-10 21:10:18 +08:00
return nil
2016-02-16 19:33:16 +08:00
}
2014-04-23 00:55:27 +08:00
}
2015-10-27 09:08:59 +08:00
userFilter , ok := ls . sanitizedUserQuery ( name )
if ! ok {
2017-05-10 21:10:18 +08:00
return nil
2015-10-27 09:08:59 +08:00
}
2016-02-16 19:36:40 +08:00
log . Trace ( "Fetching attributes '%v', '%v', '%v', '%v' with filter %s and base %s" , ls . AttributeUsername , ls . AttributeName , ls . AttributeSurname , ls . AttributeMail , userFilter , userDN )
2014-09-08 08:04:47 +08:00
search := ldap . NewSearchRequest (
2015-08-13 07:58:27 +08:00
userDN , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , userFilter ,
2016-02-08 01:18:29 +08:00
[ ] string { ls . AttributeUsername , ls . AttributeName , ls . AttributeSurname , ls . AttributeMail } ,
2014-04-23 00:55:27 +08:00
nil )
2015-08-13 07:58:27 +08:00
2014-04-23 00:55:27 +08:00
sr , err := l . Search ( search )
if err != nil {
2015-08-18 04:03:11 +08:00
log . Error ( 4 , "LDAP Search failed unexpectedly! (%v)" , err )
2017-05-10 21:10:18 +08:00
return nil
2015-08-13 07:58:27 +08:00
} else if len ( sr . Entries ) < 1 {
2015-09-05 11:39:23 +08:00
if directBind {
log . Error ( 4 , "User filter inhibited user login." )
} else {
log . Error ( 4 , "LDAP Search failed unexpectedly! (0 entries)" )
}
2017-05-10 21:10:18 +08:00
return nil
2014-04-23 00:55:27 +08:00
}
2015-08-13 07:58:27 +08:00
2016-07-12 07:07:57 +08:00
username := sr . Entries [ 0 ] . GetAttributeValue ( ls . AttributeUsername )
firstname := sr . Entries [ 0 ] . GetAttributeValue ( ls . AttributeName )
surname := sr . Entries [ 0 ] . GetAttributeValue ( ls . AttributeSurname )
mail := sr . Entries [ 0 ] . GetAttributeValue ( ls . AttributeMail )
2017-05-10 21:10:18 +08:00
isAdmin := checkAdmin ( l , ls , userDN )
2015-08-19 12:34:03 +08:00
2017-05-10 21:10:18 +08:00
if ! directBind && ls . AttributesInBind {
// binds user (checking password) after looking-up attributes in BindDN context
err = bindUser ( l , userDN , passwd )
2015-09-01 20:40:11 +08:00
if err != nil {
2017-05-10 21:10:18 +08:00
return nil
2015-09-01 20:40:11 +08:00
}
2015-08-19 12:34:03 +08:00
}
2017-05-10 21:10:18 +08:00
return & SearchResult {
Username : username ,
Name : firstname ,
Surname : surname ,
Mail : mail ,
IsAdmin : isAdmin ,
}
}
// SearchEntries : search an LDAP source for all users matching userFilter
func ( ls * Source ) SearchEntries ( ) [ ] * SearchResult {
l , err := dial ( ls )
if err != nil {
log . Error ( 4 , "LDAP Connect error, %s:%v" , ls . Host , err )
ls . Enabled = false
return nil
}
defer l . Close ( )
if ls . BindDN != "" && ls . BindPassword != "" {
err := l . Bind ( ls . BindDN , ls . BindPassword )
2016-02-16 19:33:16 +08:00
if err != nil {
2017-05-10 21:10:18 +08:00
log . Debug ( "Failed to bind as BindDN[%s]: %v" , ls . BindDN , err )
return nil
}
log . Trace ( "Bound as BindDN %s" , ls . BindDN )
} else {
log . Trace ( "Proceeding with anonymous LDAP search." )
}
userFilter := fmt . Sprintf ( ls . Filter , "*" )
log . Trace ( "Fetching attributes '%v', '%v', '%v', '%v' with filter %s and base %s" , ls . AttributeUsername , ls . AttributeName , ls . AttributeSurname , ls . AttributeMail , userFilter , ls . UserBase )
search := ldap . NewSearchRequest (
ls . UserBase , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , userFilter ,
[ ] string { ls . AttributeUsername , ls . AttributeName , ls . AttributeSurname , ls . AttributeMail } ,
nil )
sr , err := l . Search ( search )
if err != nil {
log . Error ( 4 , "LDAP Search failed unexpectedly! (%v)" , err )
return nil
}
result := make ( [ ] * SearchResult , len ( sr . Entries ) )
for i , v := range sr . Entries {
result [ i ] = & SearchResult {
Username : v . GetAttributeValue ( ls . AttributeUsername ) ,
Name : v . GetAttributeValue ( ls . AttributeName ) ,
Surname : v . GetAttributeValue ( ls . AttributeSurname ) ,
Mail : v . GetAttributeValue ( ls . AttributeMail ) ,
IsAdmin : checkAdmin ( l , ls , v . DN ) ,
2016-02-16 19:33:16 +08:00
}
}
2017-05-10 21:10:18 +08:00
return result
2014-04-23 00:55:27 +08:00
}