2015-08-16 14:31:54 +08:00
// Copyright 2014 The Gogs Authors. All rights reserved.
2020-09-10 23:30:07 +08:00
// Copyright 2020 The Gitea Authors. All rights reserved.
2014-04-23 00:55:27 +08:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
package ldap
import (
2015-09-15 03:48:51 +08:00
"crypto/tls"
2014-04-23 00:55:27 +08:00
"fmt"
2021-08-12 04:42:58 +08:00
"net"
"strconv"
2015-10-27 09:08:59 +08:00
"strings"
2014-05-03 10:48:14 +08:00
2022-02-11 22:24:58 +08:00
"code.gitea.io/gitea/modules/json"
2016-11-11 00:24:48 +08:00
"code.gitea.io/gitea/modules/log"
2022-02-11 22:24:58 +08:00
"code.gitea.io/gitea/modules/util"
2019-02-18 20:34:37 +08:00
2020-10-16 03:27:33 +08:00
"github.com/go-ldap/ldap/v3"
2014-04-23 00:55:27 +08:00
)
2017-05-10 21:10:18 +08:00
// SearchResult : user data
type SearchResult struct {
2022-02-11 22:24:58 +08:00
Username string // Username
Name string // Name
Surname string // Surname
Mail string // E-mail address
SSHPublicKey [ ] string // SSH Public Key
IsAdmin bool // if user is administrator
IsRestricted bool // if user is restricted
LowerName string // LowerName
Avatar [ ] byte
LdapTeamAdd map [ string ] [ ] string // organizations teams to add
LdapTeamRemove map [ string ] [ ] string // organizations teams to remove
2017-05-10 21:10:18 +08:00
}
2022-06-20 18:02:49 +08:00
func ( source * Source ) sanitizedUserQuery ( username string ) ( string , bool ) {
2015-10-27 09:08:59 +08:00
// See http://tools.ietf.org/search/rfc4515
badCharacters := "\x00()*\\"
if strings . ContainsAny ( username , badCharacters ) {
log . Debug ( "'%s' contains invalid query characters. Aborting." , username )
return "" , false
}
2022-06-20 18:02:49 +08:00
return fmt . Sprintf ( source . Filter , username ) , true
2015-10-27 09:08:59 +08:00
}
2022-06-20 18:02:49 +08:00
func ( source * Source ) sanitizedUserDN ( username string ) ( string , bool ) {
2015-10-27 09:08:59 +08:00
// See http://tools.ietf.org/search/rfc4514: "special characters"
2017-11-13 17:32:16 +08:00
badCharacters := "\x00()*\\,='\"#+;<>"
2015-10-27 09:08:59 +08:00
if strings . ContainsAny ( username , badCharacters ) {
log . Debug ( "'%s' contains invalid DN characters. Aborting." , username )
return "" , false
}
2022-06-20 18:02:49 +08:00
return fmt . Sprintf ( source . UserDN , username ) , true
2015-10-27 09:08:59 +08:00
}
2022-06-20 18:02:49 +08:00
func ( source * Source ) sanitizedGroupFilter ( group string ) ( string , bool ) {
2020-09-10 23:30:07 +08:00
// See http://tools.ietf.org/search/rfc4515
badCharacters := "\x00*\\"
if strings . ContainsAny ( group , badCharacters ) {
log . Trace ( "Group filter invalid query characters: %s" , group )
return "" , false
}
return group , true
}
2022-06-20 18:02:49 +08:00
func ( source * Source ) sanitizedGroupDN ( groupDn string ) ( string , bool ) {
2020-09-10 23:30:07 +08:00
// See http://tools.ietf.org/search/rfc4514: "special characters"
badCharacters := "\x00()*\\'\"#+;<>"
if strings . ContainsAny ( groupDn , badCharacters ) || strings . HasPrefix ( groupDn , " " ) || strings . HasSuffix ( groupDn , " " ) {
log . Trace ( "Group DN contains invalid query characters: %s" , groupDn )
return "" , false
}
return groupDn , true
}
2022-06-20 18:02:49 +08:00
func ( source * Source ) findUserDN ( l * ldap . Conn , name string ) ( string , bool ) {
2015-08-13 07:58:27 +08:00
log . Trace ( "Search for LDAP user: %s" , name )
// A search for the user.
2022-06-20 18:02:49 +08:00
userFilter , ok := source . sanitizedUserQuery ( name )
2015-10-27 09:08:59 +08:00
if ! ok {
return "" , false
}
2022-06-20 18:02:49 +08:00
log . Trace ( "Searching for DN using filter %s and base %s" , userFilter , source . UserBase )
2015-08-13 07:58:27 +08:00
search := ldap . NewSearchRequest (
2022-06-20 18:02:49 +08:00
source . UserBase , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 ,
2015-08-13 07:58:27 +08:00
false , userFilter , [ ] string { } , nil )
// Ensure we found a user
sr , err := l . Search ( search )
if err != nil || len ( sr . Entries ) < 1 {
2015-08-18 04:03:11 +08:00
log . Debug ( "Failed search using filter[%s]: %v" , userFilter , err )
2015-08-16 14:31:54 +08:00
return "" , false
2015-08-13 07:58:27 +08:00
} else if len ( sr . Entries ) > 1 {
log . Debug ( "Filter '%s' returned more than one user." , userFilter )
2015-08-16 14:31:54 +08:00
return "" , false
2014-04-23 00:55:27 +08:00
}
2015-08-13 07:58:27 +08:00
2015-08-16 14:31:54 +08:00
userDN := sr . Entries [ 0 ] . DN
2015-08-13 07:58:27 +08:00
if userDN == "" {
2019-04-02 15:48:31 +08:00
log . Error ( "LDAP search was successful, but found no DN!" )
2015-08-16 14:31:54 +08:00
return "" , false
2015-08-13 07:58:27 +08:00
}
2015-08-16 14:31:54 +08:00
return userDN , true
2014-04-23 00:55:27 +08:00
}
2021-08-12 04:42:58 +08:00
func dial ( source * Source ) ( * ldap . Conn , error ) {
log . Trace ( "Dialing LDAP with security protocol (%v) without verifying: %v" , source . SecurityProtocol , source . SkipVerify )
2016-07-08 07:25:09 +08:00
2021-08-12 04:42:58 +08:00
tlsConfig := & tls . Config {
ServerName : source . Host ,
InsecureSkipVerify : source . SkipVerify ,
2016-07-08 07:25:09 +08:00
}
2021-08-12 04:42:58 +08:00
if source . SecurityProtocol == SecurityProtocolLDAPS {
return ldap . DialTLS ( "tcp" , net . JoinHostPort ( source . Host , strconv . Itoa ( source . Port ) ) , tlsConfig )
2016-07-08 07:25:09 +08:00
}
2021-08-12 04:42:58 +08:00
conn , err := ldap . Dial ( "tcp" , net . JoinHostPort ( source . Host , strconv . Itoa ( source . Port ) ) )
2016-07-08 07:25:09 +08:00
if err != nil {
2021-08-12 04:42:58 +08:00
return nil , fmt . Errorf ( "error during Dial: %v" , err )
2016-07-08 07:25:09 +08:00
}
2021-08-12 04:42:58 +08:00
if source . SecurityProtocol == SecurityProtocolStartTLS {
if err = conn . StartTLS ( tlsConfig ) ; err != nil {
2016-07-08 07:25:09 +08:00
conn . Close ( )
2021-08-12 04:42:58 +08:00
return nil , fmt . Errorf ( "error during StartTLS: %v" , err )
2016-07-08 07:25:09 +08:00
}
}
return conn , nil
}
func bindUser ( l * ldap . Conn , userDN , passwd string ) error {
log . Trace ( "Binding with userDN: %s" , userDN )
err := l . Bind ( userDN , passwd )
if err != nil {
log . Debug ( "LDAP auth. failed for %s, reason: %v" , userDN , err )
return err
}
log . Trace ( "Bound successfully with userDN: %s" , userDN )
return err
}
2017-05-10 21:10:18 +08:00
func checkAdmin ( l * ldap . Conn , ls * Source , userDN string ) bool {
2020-03-05 14:30:33 +08:00
if len ( ls . AdminFilter ) == 0 {
return false
}
log . Trace ( "Checking admin with filter %s and base %s" , ls . AdminFilter , userDN )
search := ldap . NewSearchRequest (
userDN , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , ls . AdminFilter ,
[ ] string { ls . AttributeName } ,
nil )
2017-05-10 21:10:18 +08:00
2020-03-05 14:30:33 +08:00
sr , err := l . Search ( search )
2017-05-10 21:10:18 +08:00
2020-03-05 14:30:33 +08:00
if err != nil {
2021-09-11 06:46:27 +08:00
log . Error ( "LDAP Admin Search with filter %s for %s failed unexpectedly! (%v)" , ls . AdminFilter , userDN , err )
2020-03-05 14:30:33 +08:00
} else if len ( sr . Entries ) < 1 {
log . Trace ( "LDAP Admin Search found no matching entries." )
} else {
return true
}
return false
}
func checkRestricted ( l * ldap . Conn , ls * Source , userDN string ) bool {
if len ( ls . RestrictedFilter ) == 0 {
return false
}
if ls . RestrictedFilter == "*" {
return true
}
log . Trace ( "Checking restricted with filter %s and base %s" , ls . RestrictedFilter , userDN )
search := ldap . NewSearchRequest (
userDN , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , ls . RestrictedFilter ,
[ ] string { ls . AttributeName } ,
nil )
sr , err := l . Search ( search )
if err != nil {
2021-09-11 06:46:27 +08:00
log . Error ( "LDAP Restrictred Search with filter %s for %s failed unexpectedly! (%v)" , ls . RestrictedFilter , userDN , err )
2020-03-05 14:30:33 +08:00
} else if len ( sr . Entries ) < 1 {
log . Trace ( "LDAP Restricted Search found no matching entries." )
} else {
return true
2017-05-10 21:10:18 +08:00
}
return false
}
2022-02-11 22:24:58 +08:00
// List all group memberships of a user
2022-06-20 18:02:49 +08:00
func ( source * Source ) listLdapGroupMemberships ( l * ldap . Conn , uid string ) [ ] string {
2022-02-11 22:24:58 +08:00
var ldapGroups [ ] string
2022-06-20 18:02:49 +08:00
groupFilter := fmt . Sprintf ( "(%s=%s)" , source . GroupMemberUID , uid )
2022-02-11 22:24:58 +08:00
result , err := l . Search ( ldap . NewSearchRequest (
2022-06-20 18:02:49 +08:00
source . GroupDN ,
2022-02-11 22:24:58 +08:00
ldap . ScopeWholeSubtree ,
ldap . NeverDerefAliases ,
0 ,
0 ,
false ,
groupFilter ,
[ ] string { } ,
nil ,
) )
if err != nil {
log . Error ( "Failed group search using filter[%s]: %v" , groupFilter , err )
return ldapGroups
}
for _ , entry := range result . Entries {
if entry . DN == "" {
log . Error ( "LDAP search was successful, but found no DN!" )
continue
}
ldapGroups = append ( ldapGroups , entry . DN )
}
return ldapGroups
}
// parse LDAP groups and return map of ldap groups to organizations teams
2022-06-20 18:02:49 +08:00
func ( source * Source ) mapLdapGroupsToTeams ( ) map [ string ] map [ string ] [ ] string {
2022-02-11 22:24:58 +08:00
ldapGroupsToTeams := make ( map [ string ] map [ string ] [ ] string )
2022-06-20 18:02:49 +08:00
err := json . Unmarshal ( [ ] byte ( source . GroupTeamMap ) , & ldapGroupsToTeams )
2022-02-11 22:24:58 +08:00
if err != nil {
log . Error ( "Failed to unmarshall LDAP teams map: %v" , err )
return ldapGroupsToTeams
}
return ldapGroupsToTeams
}
// getMappedMemberships : returns the organizations and teams to modify the users membership
2022-06-20 18:02:49 +08:00
func ( source * Source ) getMappedMemberships ( l * ldap . Conn , uid string ) ( map [ string ] [ ] string , map [ string ] [ ] string ) {
2022-02-11 22:24:58 +08:00
// get all LDAP group memberships for user
2022-06-20 18:02:49 +08:00
usersLdapGroups := source . listLdapGroupMemberships ( l , uid )
2022-02-11 22:24:58 +08:00
// unmarshall LDAP group team map from configs
2022-06-20 18:02:49 +08:00
ldapGroupsToTeams := source . mapLdapGroupsToTeams ( )
2022-02-11 22:24:58 +08:00
membershipsToAdd := map [ string ] [ ] string { }
membershipsToRemove := map [ string ] [ ] string { }
for group , memberships := range ldapGroupsToTeams {
isUserInGroup := util . IsStringInSlice ( group , usersLdapGroups )
if isUserInGroup {
for org , teams := range memberships {
membershipsToAdd [ org ] = teams
}
} else if ! isUserInGroup {
for org , teams := range memberships {
membershipsToRemove [ org ] = teams
}
}
}
return membershipsToAdd , membershipsToRemove
}
2016-11-27 14:03:59 +08:00
// SearchEntry : search an LDAP source if an entry (name, passwd) is valid and in the specific filter
2022-06-20 18:02:49 +08:00
func ( source * Source ) SearchEntry ( name , passwd string , directBind bool ) * SearchResult {
2016-12-12 08:46:51 +08:00
// See https://tools.ietf.org/search/rfc4513#section-5.1.2
if len ( passwd ) == 0 {
2019-04-02 15:48:31 +08:00
log . Debug ( "Auth. failed for %s, password cannot be empty" , name )
2017-05-10 21:10:18 +08:00
return nil
2016-12-12 08:46:51 +08:00
}
2022-06-20 18:02:49 +08:00
l , err := dial ( source )
2016-02-16 18:58:00 +08:00
if err != nil {
2022-06-20 18:02:49 +08:00
log . Error ( "LDAP Connect error, %s:%v" , source . Host , err )
source . Enabled = false
2017-05-10 21:10:18 +08:00
return nil
2016-02-16 18:58:00 +08:00
}
defer l . Close ( )
2015-09-05 11:39:23 +08:00
var userDN string
if directBind {
2022-06-20 18:02:49 +08:00
log . Trace ( "LDAP will bind directly via UserDN template: %s" , source . UserDN )
2015-10-27 09:08:59 +08:00
var ok bool
2022-06-20 18:02:49 +08:00
userDN , ok = source . sanitizedUserDN ( name )
2018-12-28 00:51:19 +08:00
2015-10-27 09:08:59 +08:00
if ! ok {
2017-05-10 21:10:18 +08:00
return nil
2015-10-27 09:08:59 +08:00
}
2018-12-28 00:51:19 +08:00
err = bindUser ( l , userDN , passwd )
if err != nil {
return nil
}
2022-06-20 18:02:49 +08:00
if source . UserBase != "" {
2018-12-28 00:51:19 +08:00
// not everyone has a CN compatible with input name so we need to find
// the real userDN in that case
2022-06-20 18:02:49 +08:00
userDN , ok = source . findUserDN ( l , name )
2018-12-28 00:51:19 +08:00
if ! ok {
return nil
}
}
2015-09-05 11:39:23 +08:00
} else {
log . Trace ( "LDAP will use BindDN." )
var found bool
2018-12-28 00:51:19 +08:00
2022-06-20 18:02:49 +08:00
if source . BindDN != "" && source . BindPassword != "" {
err := l . Bind ( source . BindDN , source . BindPassword )
2018-12-28 00:51:19 +08:00
if err != nil {
2022-06-20 18:02:49 +08:00
log . Debug ( "Failed to bind as BindDN[%s]: %v" , source . BindDN , err )
2018-12-28 00:51:19 +08:00
return nil
}
2022-06-20 18:02:49 +08:00
log . Trace ( "Bound as BindDN %s" , source . BindDN )
2018-12-28 00:51:19 +08:00
} else {
log . Trace ( "Proceeding with anonymous LDAP search." )
}
2022-06-20 18:02:49 +08:00
userDN , found = source . findUserDN ( l , name )
2015-09-05 11:39:23 +08:00
if ! found {
2017-05-10 21:10:18 +08:00
return nil
2015-09-05 11:39:23 +08:00
}
2015-08-13 07:58:27 +08:00
}
2022-06-20 18:02:49 +08:00
if ! source . AttributesInBind {
2016-02-16 19:33:16 +08:00
// binds user (checking password) before looking-up attributes in user context
err = bindUser ( l , userDN , passwd )
if err != nil {
2017-05-10 21:10:18 +08:00
return nil
2016-02-16 19:33:16 +08:00
}
2014-04-23 00:55:27 +08:00
}
2022-06-20 18:02:49 +08:00
userFilter , ok := source . sanitizedUserQuery ( name )
2015-10-27 09:08:59 +08:00
if ! ok {
2017-05-10 21:10:18 +08:00
return nil
2015-10-27 09:08:59 +08:00
}
2022-06-20 18:02:49 +08:00
isAttributeSSHPublicKeySet := len ( strings . TrimSpace ( source . AttributeSSHPublicKey ) ) > 0
isAtributeAvatarSet := len ( strings . TrimSpace ( source . AttributeAvatar ) ) > 0
2019-01-24 07:25:33 +08:00
2022-06-20 18:02:49 +08:00
attribs := [ ] string { source . AttributeUsername , source . AttributeName , source . AttributeSurname , source . AttributeMail }
if len ( strings . TrimSpace ( source . UserUID ) ) > 0 {
attribs = append ( attribs , source . UserUID )
2020-09-10 23:30:07 +08:00
}
2019-01-24 07:25:33 +08:00
if isAttributeSSHPublicKeySet {
2022-06-20 18:02:49 +08:00
attribs = append ( attribs , source . AttributeSSHPublicKey )
2019-01-24 07:25:33 +08:00
}
2021-09-27 10:39:36 +08:00
if isAtributeAvatarSet {
2022-06-20 18:02:49 +08:00
attribs = append ( attribs , source . AttributeAvatar )
2021-09-27 10:39:36 +08:00
}
2019-01-24 07:25:33 +08:00
2022-06-20 18:02:49 +08:00
log . Trace ( "Fetching attributes '%v', '%v', '%v', '%v', '%v', '%v', '%v' with filter '%s' and base '%s'" , source . AttributeUsername , source . AttributeName , source . AttributeSurname , source . AttributeMail , source . AttributeSSHPublicKey , source . AttributeAvatar , source . UserUID , userFilter , userDN )
2014-09-08 08:04:47 +08:00
search := ldap . NewSearchRequest (
2015-08-13 07:58:27 +08:00
userDN , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , userFilter ,
2019-01-24 07:25:33 +08:00
attribs , nil )
2015-08-13 07:58:27 +08:00
2014-04-23 00:55:27 +08:00
sr , err := l . Search ( search )
if err != nil {
2019-04-02 15:48:31 +08:00
log . Error ( "LDAP Search failed unexpectedly! (%v)" , err )
2017-05-10 21:10:18 +08:00
return nil
2015-08-13 07:58:27 +08:00
} else if len ( sr . Entries ) < 1 {
2015-09-05 11:39:23 +08:00
if directBind {
2019-01-20 03:57:27 +08:00
log . Trace ( "User filter inhibited user login." )
2015-09-05 11:39:23 +08:00
} else {
2019-01-20 03:57:27 +08:00
log . Trace ( "LDAP Search found no matching entries." )
2015-09-05 11:39:23 +08:00
}
2017-05-10 21:10:18 +08:00
return nil
2014-04-23 00:55:27 +08:00
}
2015-08-13 07:58:27 +08:00
2019-01-24 07:25:33 +08:00
var sshPublicKey [ ] string
2021-09-27 10:39:36 +08:00
var Avatar [ ] byte
2019-01-24 07:25:33 +08:00
2022-06-20 18:02:49 +08:00
username := sr . Entries [ 0 ] . GetAttributeValue ( source . AttributeUsername )
firstname := sr . Entries [ 0 ] . GetAttributeValue ( source . AttributeName )
surname := sr . Entries [ 0 ] . GetAttributeValue ( source . AttributeSurname )
mail := sr . Entries [ 0 ] . GetAttributeValue ( source . AttributeMail )
uid := sr . Entries [ 0 ] . GetAttributeValue ( source . UserUID )
if source . UserUID == "dn" || source . UserUID == "DN" {
2022-02-11 22:24:58 +08:00
uid = sr . Entries [ 0 ] . DN
}
2020-09-10 23:30:07 +08:00
// Check group membership
2022-06-20 18:02:49 +08:00
if source . GroupsEnabled && source . GroupFilter != "" {
groupFilter , ok := source . sanitizedGroupFilter ( source . GroupFilter )
2020-09-10 23:30:07 +08:00
if ! ok {
return nil
}
2022-06-20 18:02:49 +08:00
groupDN , ok := source . sanitizedGroupDN ( source . GroupDN )
2020-09-10 23:30:07 +08:00
if ! ok {
return nil
}
2022-06-20 18:02:49 +08:00
log . Trace ( "Fetching groups '%v' with filter '%s' and base '%s'" , source . GroupMemberUID , groupFilter , groupDN )
2020-09-10 23:30:07 +08:00
groupSearch := ldap . NewSearchRequest (
groupDN , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , groupFilter ,
2022-06-20 18:02:49 +08:00
[ ] string { source . GroupMemberUID } ,
2020-09-10 23:30:07 +08:00
nil )
srg , err := l . Search ( groupSearch )
if err != nil {
log . Error ( "LDAP group search failed: %v" , err )
return nil
} else if len ( srg . Entries ) < 1 {
log . Error ( "LDAP group search failed: 0 entries" )
return nil
}
isMember := false
Entries :
for _ , group := range srg . Entries {
2022-06-20 18:02:49 +08:00
for _ , member := range group . GetAttributeValues ( source . GroupMemberUID ) {
if ( source . UserUID == "dn" && member == sr . Entries [ 0 ] . DN ) || member == uid {
2020-09-10 23:30:07 +08:00
isMember = true
break Entries
}
}
}
if ! isMember {
log . Error ( "LDAP group membership test failed" )
return nil
}
}
2019-01-24 07:25:33 +08:00
if isAttributeSSHPublicKeySet {
2022-06-20 18:02:49 +08:00
sshPublicKey = sr . Entries [ 0 ] . GetAttributeValues ( source . AttributeSSHPublicKey )
2019-01-24 07:25:33 +08:00
}
2022-06-20 18:02:49 +08:00
isAdmin := checkAdmin ( l , source , userDN )
2020-03-05 14:30:33 +08:00
var isRestricted bool
if ! isAdmin {
2022-06-20 18:02:49 +08:00
isRestricted = checkRestricted ( l , source , userDN )
2020-03-05 14:30:33 +08:00
}
2015-08-19 12:34:03 +08:00
2021-09-27 10:39:36 +08:00
if isAtributeAvatarSet {
2022-06-20 18:02:49 +08:00
Avatar = sr . Entries [ 0 ] . GetRawAttributeValue ( source . AttributeAvatar )
2021-09-27 10:39:36 +08:00
}
2022-02-11 22:24:58 +08:00
teamsToAdd := make ( map [ string ] [ ] string )
teamsToRemove := make ( map [ string ] [ ] string )
2022-06-20 18:02:49 +08:00
if source . GroupsEnabled && ( source . GroupTeamMap != "" || source . GroupTeamMapRemoval ) {
teamsToAdd , teamsToRemove = source . getMappedMemberships ( l , uid )
2022-02-11 22:24:58 +08:00
}
2022-06-20 18:02:49 +08:00
if ! directBind && source . AttributesInBind {
2022-05-03 20:41:11 +08:00
// binds user (checking password) after looking-up attributes in BindDN context
err = bindUser ( l , userDN , passwd )
if err != nil {
return nil
}
}
2017-05-10 21:10:18 +08:00
return & SearchResult {
2022-02-11 22:24:58 +08:00
LowerName : strings . ToLower ( username ) ,
Username : username ,
Name : firstname ,
Surname : surname ,
Mail : mail ,
SSHPublicKey : sshPublicKey ,
IsAdmin : isAdmin ,
IsRestricted : isRestricted ,
Avatar : Avatar ,
LdapTeamAdd : teamsToAdd ,
LdapTeamRemove : teamsToRemove ,
2017-05-10 21:10:18 +08:00
}
}
2018-05-05 22:30:47 +08:00
// UsePagedSearch returns if need to use paged search
2022-06-20 18:02:49 +08:00
func ( source * Source ) UsePagedSearch ( ) bool {
return source . SearchPageSize > 0
2018-05-05 22:30:47 +08:00
}
2017-05-10 21:10:18 +08:00
// SearchEntries : search an LDAP source for all users matching userFilter
2022-06-20 18:02:49 +08:00
func ( source * Source ) SearchEntries ( ) ( [ ] * SearchResult , error ) {
l , err := dial ( source )
2017-05-10 21:10:18 +08:00
if err != nil {
2022-06-20 18:02:49 +08:00
log . Error ( "LDAP Connect error, %s:%v" , source . Host , err )
source . Enabled = false
2019-08-25 02:53:37 +08:00
return nil , err
2017-05-10 21:10:18 +08:00
}
defer l . Close ( )
2022-06-20 18:02:49 +08:00
if source . BindDN != "" && source . BindPassword != "" {
err := l . Bind ( source . BindDN , source . BindPassword )
2016-02-16 19:33:16 +08:00
if err != nil {
2022-06-20 18:02:49 +08:00
log . Debug ( "Failed to bind as BindDN[%s]: %v" , source . BindDN , err )
2019-08-25 02:53:37 +08:00
return nil , err
2017-05-10 21:10:18 +08:00
}
2022-06-20 18:02:49 +08:00
log . Trace ( "Bound as BindDN %s" , source . BindDN )
2017-05-10 21:10:18 +08:00
} else {
log . Trace ( "Proceeding with anonymous LDAP search." )
}
2022-06-20 18:02:49 +08:00
userFilter := fmt . Sprintf ( source . Filter , "*" )
2017-05-10 21:10:18 +08:00
2022-06-20 18:02:49 +08:00
isAttributeSSHPublicKeySet := len ( strings . TrimSpace ( source . AttributeSSHPublicKey ) ) > 0
isAtributeAvatarSet := len ( strings . TrimSpace ( source . AttributeAvatar ) ) > 0
2019-01-24 07:25:33 +08:00
2022-06-20 18:02:49 +08:00
attribs := [ ] string { source . AttributeUsername , source . AttributeName , source . AttributeSurname , source . AttributeMail , source . UserUID }
2019-01-24 07:25:33 +08:00
if isAttributeSSHPublicKeySet {
2022-06-20 18:02:49 +08:00
attribs = append ( attribs , source . AttributeSSHPublicKey )
2019-01-24 07:25:33 +08:00
}
2021-09-27 10:39:36 +08:00
if isAtributeAvatarSet {
2022-06-20 18:02:49 +08:00
attribs = append ( attribs , source . AttributeAvatar )
2021-09-27 10:39:36 +08:00
}
2019-01-24 07:25:33 +08:00
2022-06-20 18:02:49 +08:00
log . Trace ( "Fetching attributes '%v', '%v', '%v', '%v', '%v', '%v' with filter %s and base %s" , source . AttributeUsername , source . AttributeName , source . AttributeSurname , source . AttributeMail , source . AttributeSSHPublicKey , source . AttributeAvatar , userFilter , source . UserBase )
2017-05-10 21:10:18 +08:00
search := ldap . NewSearchRequest (
2022-06-20 18:02:49 +08:00
source . UserBase , ldap . ScopeWholeSubtree , ldap . NeverDerefAliases , 0 , 0 , false , userFilter ,
2019-01-24 07:25:33 +08:00
attribs , nil )
2017-05-10 21:10:18 +08:00
2018-05-05 22:30:47 +08:00
var sr * ldap . SearchResult
2022-06-20 18:02:49 +08:00
if source . UsePagedSearch ( ) {
sr , err = l . SearchWithPaging ( search , source . SearchPageSize )
2018-05-05 22:30:47 +08:00
} else {
sr , err = l . Search ( search )
}
2017-05-10 21:10:18 +08:00
if err != nil {
2019-04-02 15:48:31 +08:00
log . Error ( "LDAP Search failed unexpectedly! (%v)" , err )
2019-08-25 02:53:37 +08:00
return nil , err
2017-05-10 21:10:18 +08:00
}
result := make ( [ ] * SearchResult , len ( sr . Entries ) )
for i , v := range sr . Entries {
2022-02-11 22:24:58 +08:00
teamsToAdd := make ( map [ string ] [ ] string )
teamsToRemove := make ( map [ string ] [ ] string )
2022-06-20 18:02:49 +08:00
if source . GroupsEnabled && ( source . GroupTeamMap != "" || source . GroupTeamMapRemoval ) {
userAttributeListedInGroup := v . GetAttributeValue ( source . UserUID )
if source . UserUID == "dn" || source . UserUID == "DN" {
2022-02-11 22:24:58 +08:00
userAttributeListedInGroup = v . DN
}
2022-06-20 18:02:49 +08:00
teamsToAdd , teamsToRemove = source . getMappedMemberships ( l , userAttributeListedInGroup )
2022-02-11 22:24:58 +08:00
}
2017-05-10 21:10:18 +08:00
result [ i ] = & SearchResult {
2022-06-20 18:02:49 +08:00
Username : v . GetAttributeValue ( source . AttributeUsername ) ,
Name : v . GetAttributeValue ( source . AttributeName ) ,
Surname : v . GetAttributeValue ( source . AttributeSurname ) ,
Mail : v . GetAttributeValue ( source . AttributeMail ) ,
IsAdmin : checkAdmin ( l , source , v . DN ) ,
2022-02-11 22:24:58 +08:00
LdapTeamAdd : teamsToAdd ,
LdapTeamRemove : teamsToRemove ,
2019-01-24 07:25:33 +08:00
}
2020-03-05 14:30:33 +08:00
if ! result [ i ] . IsAdmin {
2022-06-20 18:02:49 +08:00
result [ i ] . IsRestricted = checkRestricted ( l , source , v . DN )
2020-03-05 14:30:33 +08:00
}
2019-01-24 07:25:33 +08:00
if isAttributeSSHPublicKeySet {
2022-06-20 18:02:49 +08:00
result [ i ] . SSHPublicKey = v . GetAttributeValues ( source . AttributeSSHPublicKey )
2016-02-16 19:33:16 +08:00
}
2021-09-27 10:39:36 +08:00
if isAtributeAvatarSet {
2022-06-20 18:02:49 +08:00
result [ i ] . Avatar = v . GetRawAttributeValue ( source . AttributeAvatar )
2021-09-27 10:39:36 +08:00
}
2021-09-15 17:28:37 +08:00
result [ i ] . LowerName = strings . ToLower ( result [ i ] . Username )
2016-02-16 19:33:16 +08:00
}
2019-08-25 02:53:37 +08:00
return result , nil
2014-04-23 00:55:27 +08:00
}