Skip to content

D
dex
Commit b5d2b7eb authored by Eric Chiang's avatar Eric Chiang Committed by GitHub
Browse files
Options

Merge pull request #483 from ericchiang/ldap-groups 

Clean up LDAP Connector
parents c0eb36c1 5a78e898
Show whitespace changes
Inline Side-by-side
Showing with 307 additions and 259 deletions
.travis.yml
View file @ b5d2b7eb
......@@ -12,6 +12,7 @@ go:
env:
- DEX_TEST_DSN="postgres://postgres@127.0.0.1:15432/postgres?sslmode=disable" ISOLATED=true
DEX_TEST_LDAP_HOST="tlstest.local:1389"
DEX_TEST_LDAPS_HOST="tlstest.local:1636"
DEX_TEST_LDAP_BINDNAME="cn=admin,dc=example,dc=org"
DEX_TEST_LDAP_BINDPASS="admin"
......
Documentation/connectors-configuration.md
View file @ b5d2b7eb
......@@ -45,11 +45,8 @@ The configuration for the local connector is always the same; it looks like this
This connector config lets users authenticate with other OIDC providers. In addition to `id` and `type`, the `oidc` connector takes the following additional fields:
* issuerURL: a `string`. The base URL for the OIDC provider. Should be a URL with an `https` scheme.
* clientID: a `string`. The OIDC client ID.
* clientSecret: a `string`. The OIDC client secret.
* trustedEmailProvider: a `boolean`. If true dex will trust the email address claims from this provider and not require that users verify their emails.
In order to use the `oidc` connector you must register dex as an OIDC client; this mechanism is different from provider to provider. For Google, follow the instructions at their [developer site](https://developers.google.com/identity/protocols/OpenIDConnect?hl=en). Regardless of your provider, registering your client will also provide you with the client ID and secret.
......@@ -80,7 +77,6 @@ Here's what a `oidc` connector looks like configured for authenticating with Goo
This connector config lets users authenticate through [GitHub](https://github.com/). In addition to `id` and `type`, the `github` connector takes the following additional fields:
* clientID: a `string`. The GitHub OAuth application client ID.
* clientSecret: a `string`. The GitHub OAuth application client secret.
To begin, register an OAuth application with GitHub through your, or your organization's [account settings](ttps://github.com/settings/applications/new). To register dex as a client of your GitHub application, enter dex's redirect URL under 'Authorization callback URL':
......@@ -109,7 +105,6 @@ The `github` connector requests read only access to user's email through the [`u
This connector config lets users authenticate through [Bitbucket](https://bitbucket.org/). In addition to `id` and `type`, the `bitbucket` connector takes the following additional fields:
* clientID: a `string`. The Bitbucket OAuth consumer client ID.
* clientSecret: a `string`. The Bitbucket OAuth consumer client secret.
To begin, register an OAuth consumer with Bitbucket through your, or your teams's management page. Follow the documentation at their [developer site](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html).
......@@ -136,83 +131,85 @@ Here's an example of a `bitbucket` connector; the clientID and clientSecret shou
### `ldap` connector
The `ldap` connector allows email/password based authentication hosted by dex, backed by a LDAP directory.
Authentication is performed by binding to the configured LDAP server using the user supplied credentials. Successfull bind equals authenticated user.
The `ldap` connector allows email/password based authentication hosted by dex, backed by a LDAP directory. The connector can operate in two primary modes:
Optionally the connector can be configured to search before authentication. The entryDN found will be used to bind to the LDAP server.
1. Binding against a specific directory using the end user's credentials.
2. Searching a directory for a entry using a service account then attempting to bind with the user's credentials.
This feature must be enabled to get supplementary information from the directory (ID, Name, Email). This feature can also be used to limit access to the service.
User entries are expected to have an email attribute (configurable through "emailAttribute"), and optionally a display name attribute (configurable through "nameAttribute").
Example use case: Allow your users to log in with e-mail address as username instead of the identification string in your DNs (typically username).
___NOTE:___ Users must register with dex at first login. For this to work you have to run dex-worker with --enable-registration.
___NOTE:___ Dex currently requires user registration with the dex system, even if that user already has an account with the upstream LDAP system. Installations that use this connector are recommended to provide the "--enable-automatic-registration" flag.
In addition to `id` and `type`, the `ldap` connector takes the following additional fields:
* serverHost: a `string`. The hostname for the LDAP Server.
* serverPort: a `unsigned 16-bit integer`. The port for the LDAP Server.
* timeout: `duration in milliseconds`. The timeout for connecting to and reading from LDAP Server in Milliseconds. Default: `60000` (60 Seconds)
* host: a `string`. The host and port of the LDAP server in form "host:port".
* useTLS: a `boolean`. Whether the LDAP Connector should issue a StartTLS after successfully connecting to the LDAP Server.
* useSSL: a `boolean`. Whether the LDAP Connector should expect the connection to be encrypted, typically used with ldaps port (636/tcp).
* certFile: a `string`. Optional Certificate to present to LDAP server.
* keyFile: a `string`. Key associated with Certificate specified in `certFile`.
* certFile: a `string`. Optional path to x509 client certificate to present to LDAP server.
* keyFile: a `string`. Key associated with x509 client cert specified in `certFile`.
* caFile: a `string`. Filename for PEM-file containing the set of root certificate authorities that the LDAP client use when verifying the server certificates. Default: use the host's root CA set.
* skipCertVerification: a `boolean`. Skip server certificate chain verification.
* maxIdleConn: a `integer`. Maximum number of idle LDAP Connections to keep in connection pool. Default: `5`
* baseDN: a `string`. Base DN from which Bind DN is built and searches are based.
* nameAttribute: a `string`. Attribute to map to Name. Default: `cn`
* emailAttribute: a `string`. Attribute to map to Email. Default: `mail`
* nameAttribute: a `string`. Entity attribute to map to display name of users. Default: `cn`
* emailAttribute: a `string`. Required. Attribute to map to Email. Default: `mail`
* searchBeforeAuth: a `boolean`. Perform search for entryDN to be used for bind.
* searchFilter: a `string`. Filter to apply to search. Variable substititions: `%u` User supplied username/e-mail address. `%b` BaseDN. Searches that return multiple entries are considered ambiguous and will return an error.
* searchScope: a `string`. Scope of the search. `base|one|sub`. Default: `one`
* searchBindDN: a `string`. DN to bind as for search operations.
* searchBindPw: a `string`. Password for bind for search operations.
* bindTemplate: a `string`. Template to build bindDN from user supplied credentials. Variable subtitutions: `%u` User supplied username/e-mail address. `%b` BaseDN. Default: `uid=%u,%b`.
* searchFilter: a `string`. Filter to apply to search. Variable substititions: `%u` User supplied username/e-mail address. `%b` BaseDN.
### Example: Authenticating against a specific directory
* searchScope: a `string`. Scope of the search. `base|one|sub`. Default: `one`
To authenticate against a specific LDAP directory level, use the "bindTemplate" field. This string describes how to map a username to a LDAP entity.
* searchBindDN: a `string`. DN to bind as for search operations.
```
{
"type": "ldap",
"id": "ldap",
"host": "127.0.0.1:389",
"baseDN": "cn=users,cn=accounts,dc=auth,dc=example,dc=com",
"bindTemplate": "uid=%u,%d"
}
```
* searchBindPw: a `string`. Password for bind for search operations.
"bindTemplate" is a format string. `%d` is replaced by the value of "baseDN" and `%u` is replaced by the username attempting to login. In this case if a user "janedoe" attempts to authenticate, the bindTemplate will be expanded to:
```
uid=janedoe,cn=users,cn=accounts,dc=auth,dc=example,dc=com
```
* bindTemplate: a `string`. Template to build bindDN from user supplied credentials. Variable subtitutions: `%u` User supplied username/e-mail address. `%b` BaseDN. Default: `uid=%u,%b` ___NOTE:___ This is not used when searchBeforeAuth is enabled.
The connector then attempts to bind as this entry using the password provided by the end user.
* trustedEmailProvider: a `boolean`. If true dex will trust the email address claims from this provider and not require that users verify their emails.
### Example: Searching the directory
Here's an example of a `ldap` connector;
The following configuration will search a directory using an LDAP filter. With FreeIPA
```
{
"type": "ldap",
"id": "ldap",
"serverHost": "127.0.0.1",
"serverPort": 389,
"useTLS": true,
"useSSL": false,
"skipCertVerification": false,
"baseDN": "ou=People,dc=example,dc=com",
"nameAttribute": "cn",
"emailAttribute": "mail",
"host": "127.0.0.1:389",
"baseDN": "cn=auth,dc=example,dc=com",
"searchBeforeAuth": true,
"searchFilter": "(mail=%u)",
"searchScope": "one",
"searchBindDN": "searchuser",
"searchBindPw": "supersecret",
"bindTemplate": "uid=%u,%b",
"trustedEmailProvider": true
"searchFilter": "(&(objectClass=person)(uid=%u))",
"searchScope": "sub",
"searchBindDN": "serviceAccountUser",
"searchBindPw": "serviceAccountPassword"
}
```
"searchFilter" is a format string expanded in a similar manner as "bindTemplate". If the user "janedoe" attempts to authenticate, the connector will run the following query using the service account credentials.
```
(&(objectClass=person)(uid=janedoe))
```
If the search finds an entry, it will attempt to use the provided password to bind as that entry.
__NOTE__: Searches that return multiple entries will return an error.
## Setting the Configuration
To set a connectors configuration in dex, put it in some temporary file, then use the dexctl command to upload it to dex:
......
connector/connector_ldap.go
View file @ b5d2b7eb
......@@ -3,6 +3,8 @@ package connector
import (
"crypto/tls"
"crypto/x509"
"errors"
"net"
"fmt"
......@@ -28,30 +30,63 @@ const (
func init() {
RegisterConnectorConfigType(LDAPConnectorType, func() ConnectorConfig { return &LDAPConnectorConfig{} })
// Set default ldap timeout.
ldap.DefaultTimeout = 30 * time.Second
}
type LDAPConnectorConfig struct {
ID string `json:"id"`
ServerHost string `json:"serverHost"`
ServerPort uint16 `json:"serverPort"`
Timeout time.Duration `json:"timeout"`
// Host and port of ldap service in form "host:port"
Host string `json:"host"`
// UseTLS indicates that the connector should use the TLS port.
UseTLS bool `json:"useTLS"`
UseSSL bool `json:"useSSL"`
// Trusted TLS certificate when connecting to the LDAP server. If empty the
// host's root certificates will be used.
CaFile string `json:"caFile"`
// CertFile and KeyFile are used to specifiy client certificate data.
CertFile string `json:"certFile"`
KeyFile string `json:"keyFile"`
CaFile string `json:"caFile"`
SkipCertVerification bool `json:"skipCertVerification"`
MaxIdleConn int `json:"maxIdleConn"`
BaseDN string `json:"baseDN"`
NameAttribute string `json:"nameAttribute"`
EmailAttribute string `json:"emailAttribute"`
// The place to start all searches from.
BaseDN string `json:"baseDN"`
// Search fields indicate how to search for user records in LDAP.
SearchBeforeAuth bool `json:"searchBeforeAuth"`
SearchFilter string `json:"searchFilter"`
SearchScope string `json:"searchScope"`
SearchBindDN string `json:"searchBindDN"`
SearchBindPw string `json:"searchBindPw"`
SearchGroupFilter string `json:"searchGroupFilter"`
// BindTemplate is a format string that maps user names to a record to bind as.
// It's passed both the username entered by the end user and the base DN.
//
// For example the bindTemplate
//
// "uid=%u,%d"
//
// with the username "johndoe" and basename "ou=People,dc=example,dc=com" would attempt
// to bind as
//
// "uid=johndoe,ou=People,dc=example,dc=com"
//
BindTemplate string `json:"bindTemplate"`
TrustedEmailProvider bool `json:"trustedEmailProvider"`
// DEPRICATED fields that exist for backward compatibility.
// Use "host" instead of "ServerHost" and "ServerPort"
ServerHost string `json:"serverHost"`
ServerPort uint16 `json:"serverPort"`
Timeout time.Duration `json:"timeout"`
}
func (cfg *LDAPConnectorConfig) ConnectorID() string {
......@@ -64,13 +99,27 @@ func (cfg *LDAPConnectorConfig) ConnectorType() string {
type LDAPConnector struct {
id string
idp *LDAPIdentityProvider
namespace url.URL
trustedEmailProvider bool
loginFunc oidc.LoginFunc
loginTpl *template.Template
baseDN string
nameAttribute string
emailAttribute string
searchBeforeAuth bool
searchFilter string
searchScope int
searchBindDN string
searchBindPw string
bindTemplate string
ldapPool *LDAPPool
}
const defaultPoolCheckTimer = 7200 * time.Second
func (cfg *LDAPConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *template.Template) (Connector, error) {
ns.Path = path.Join(ns.Path, httpPathCallback)
tpl := tpls.Lookup(LDAPLoginPageTemplateName)
......@@ -78,14 +127,6 @@ func (cfg *LDAPConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *t
return nil, fmt.Errorf("unable to find necessary HTML template")
}
// defaults
const defaultNameAttribute = "cn"
const defaultEmailAttribute = "mail"
const defaultBindTemplate = "uid=%u,%b"
const defaultSearchScope = ldap.ScopeWholeSubtree
const defaultMaxIdleConns = 5
const defaultPoolCheckTimer = 7200 * time.Second
if cfg.UseTLS && cfg.UseSSL {
return nil, fmt.Errorf("Invalid configuration. useTLS and useSSL are mutual exclusive.")
}
......@@ -94,26 +135,23 @@ func (cfg *LDAPConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *t
return nil, fmt.Errorf("Invalid configuration. Both certFile and keyFile must be specified.")
}
nameAttribute := defaultNameAttribute
if len(cfg.NameAttribute) > 0 {
nameAttribute = cfg.NameAttribute
// Set default values
if cfg.NameAttribute == "" {
cfg.NameAttribute = "cn"
}
emailAttribute := defaultEmailAttribute
if len(cfg.EmailAttribute) > 0 {
emailAttribute = cfg.EmailAttribute
if cfg.EmailAttribute == "" {
cfg.EmailAttribute = "mail"
}
bindTemplate := defaultBindTemplate
if len(cfg.BindTemplate) > 0 {
if cfg.SearchBeforeAuth {
log.Warningf("bindTemplate not used when searchBeforeAuth specified.")
if cfg.MaxIdleConn > 0 {
cfg.MaxIdleConn = 5
}
bindTemplate = cfg.BindTemplate
if cfg.BindTemplate == "" {
cfg.BindTemplate = "uid=%u,%b"
} else if cfg.SearchBeforeAuth {
log.Warningf("bindTemplate not used when searchBeforeAuth specified.")
}
searchScope := defaultSearchScope
if len(cfg.SearchScope) > 0 {
searchScope := ldap.ScopeWholeSubtree
if cfg.SearchScope != "" {
switch {
case strings.EqualFold(cfg.SearchScope, "BASE"):
searchScope = ldap.ScopeBaseObject
......@@ -126,15 +164,21 @@ func (cfg *LDAPConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *t
}
}
if cfg.Timeout != 0 {
ldap.DefaultTimeout = cfg.Timeout * time.Millisecond
if cfg.Host == "" {
if cfg.ServerHost == "" {
return nil, errors.New("no host provided")
}
// For backward compatibility construct host form old fields.
cfg.Host = fmt.Sprintf("%s:%d", cfg.ServerHost, cfg.ServerPort)
}
tlsConfig := &tls.Config{
ServerName: cfg.ServerHost,
InsecureSkipVerify: cfg.SkipCertVerification,
host, _, err := net.SplitHostPort(cfg.Host)
if err != nil {
return nil, fmt.Errorf("host is not of form 'host:port': %v", err)
}
tlsConfig := &tls.Config{ServerName: host}
if (cfg.UseTLS || cfg.UseSSL) && len(cfg.CaFile) > 0 {
buf, err := ioutil.ReadFile(cfg.CaFile)
if err != nil {
......@@ -158,41 +202,28 @@ func (cfg *LDAPConnectorConfig) Connector(ns url.URL, lf oidc.LoginFunc, tpls *t
tlsConfig.Certificates = []tls.Certificate{cert}
}
maxIdleConn := defaultMaxIdleConns
if cfg.MaxIdleConn > 0 {
maxIdleConn = cfg.MaxIdleConn
}
ldapPool := &LDAPPool{
MaxIdleConn: maxIdleConn,
PoolCheckTimer: defaultPoolCheckTimer,
ServerHost: cfg.ServerHost,
ServerPort: cfg.ServerPort,
UseTLS: cfg.UseTLS,
UseSSL: cfg.UseSSL,
TLSConfig: tlsConfig,
}
idp := &LDAPIdentityProvider{
idpc := &LDAPConnector{
id: cfg.ID,
namespace: ns,
loginFunc: lf,
loginTpl: tpl,
baseDN: cfg.BaseDN,
nameAttribute: nameAttribute,
emailAttribute: emailAttribute,
nameAttribute: cfg.NameAttribute,
emailAttribute: cfg.EmailAttribute,
searchBeforeAuth: cfg.SearchBeforeAuth,
searchFilter: cfg.SearchFilter,
searchScope: searchScope,
searchBindDN: cfg.SearchBindDN,
searchBindPw: cfg.SearchBindPw,
bindTemplate: bindTemplate,
ldapPool: ldapPool,
}
idpc := &LDAPConnector{
id: cfg.ID,
idp: idp,
namespace: ns,
trustedEmailProvider: cfg.TrustedEmailProvider,
loginFunc: lf,
loginTpl: tpl,
bindTemplate: cfg.BindTemplate,
ldapPool: &LDAPPool{
MaxIdleConn: cfg.MaxIdleConn,
PoolCheckTimer: defaultPoolCheckTimer,
Host: cfg.Host,
UseTLS: cfg.UseTLS,
UseSSL: cfg.UseSSL,
TLSConfig: tlsConfig,
},
}
return idpc, nil
......@@ -203,11 +234,10 @@ func (c *LDAPConnector) ID() string {
}
func (c *LDAPConnector) Healthy() error {
ldapConn, err := c.idp.ldapPool.Acquire()
if err == nil {
c.idp.ldapPool.Put(ldapConn)
}
return err
return c.ldapPool.Do(func(c *ldap.Conn) error {
// Attempt an anonymous bind.
return c.Bind("", "")
})
}
func (c *LDAPConnector) LoginURL(sessionKey, prompt string) (string, error) {
......@@ -221,7 +251,7 @@ func (c *LDAPConnector) LoginURL(sessionKey, prompt string) (string, error) {
func (c *LDAPConnector) Register(mux *http.ServeMux, errorURL url.URL) {
route := path.Join(c.namespace.Path, "login")
mux.Handle(route, handleLoginFunc(c.loginFunc, c.loginTpl, c.idp, route, errorURL))
mux.Handle(route, handlePasswordLogin(c.loginFunc, c.loginTpl, c, route, errorURL))
}
func (c *LDAPConnector) Sync() chan struct{} {
......@@ -230,8 +260,8 @@ func (c *LDAPConnector) Sync() chan struct{} {
go func() {
for {
select {
case <-time.After(c.idp.ldapPool.PoolCheckTimer):
alive, killed := c.idp.ldapPool.CheckConnections()
case <-time.After(c.ldapPool.PoolCheckTimer):
alive, killed := c.ldapPool.CheckConnections()
if alive > 0 {
log.Infof("Connector ID=%v idle_conns=%v", c.id, alive)
}
......@@ -247,38 +277,41 @@ func (c *LDAPConnector) Sync() chan struct{} {
}
func (c *LDAPConnector) TrustedEmailProvider() bool {
return c.trustedEmailProvider
return true
}
// A LDAPPool is a Connection Pool for LDAP connections
// Initialize exported fields and use Acquire() to get a connection.
// Use Put() to put it back into the pool.
// A LDAPPool is a Connection Pool for LDAP connections. Use Do() to request connections
// from the pool.
type LDAPPool struct {
m sync.Mutex
conns map[*ldap.Conn]struct{}
MaxIdleConn int
PoolCheckTimer time.Duration
ServerHost string
ServerPort uint16
Host string
UseTLS bool
UseSSL bool
TLSConfig *tls.Config
}
// Acquire removes and returns a random connection from the pool. A new connection is returned
// if there are no connections available in the pool.
func (p *LDAPPool) Acquire() (*ldap.Conn, error) {
// Do runs a function which requires an LDAP connection.
//
// The connection will be unauthenticated with the server and should not be closed by f.
func (p *LDAPPool) Do(f func(conn *ldap.Conn) error) (err error) {
conn := p.removeRandomConn()
if conn != nil {
return conn, nil
if conn == nil {
conn, err = p.ldapConnect()
if err != nil {
return err
}
return p.ldapConnect()
}
defer p.put(conn)
return f(conn)
}
// Put makes a connection ready for re-use and puts it back into the pool. If the connection
// put makes a connection ready for re-use and puts it back into the pool. If the connection
// cannot be reused it is discarded. If there already are MaxIdleConn connections in the pool
// the connection is discarded.
func (p *LDAPPool) Put(c *ldap.Conn) {
func (p *LDAPPool) put(c *ldap.Conn) {
p.m.Lock()
if p.conns == nil {
// First call to Put, initialize map
......@@ -345,7 +378,7 @@ func (p *LDAPPool) CheckConnections() (int, int) {
if ok {
err := ldapPing(conn)
if err == nil {
p.Put(conn)
p.put(conn)
alive++
} else {
conn.Close()
......@@ -363,31 +396,17 @@ func ldapPing(conn *ldap.Conn) error {
return err
}
type LDAPIdentityProvider struct {
baseDN string
nameAttribute string
emailAttribute string
searchBeforeAuth bool
searchFilter string
searchScope int
searchBindDN string
searchBindPw string
bindTemplate string
ldapPool *LDAPPool
}
func (p *LDAPPool) ldapConnect() (*ldap.Conn, error) {
var err error
var ldapConn *ldap.Conn
log.Debugf("LDAPConnect()")
if p.UseSSL {
ldapConn, err = ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", p.ServerHost, p.ServerPort), p.TLSConfig)
ldapConn, err = ldap.DialTLS("tcp", p.Host, p.TLSConfig)
if err != nil {
return nil, err
}
} else {
ldapConn, err = ldap.Dial("tcp", fmt.Sprintf("%s:%d", p.ServerHost, p.ServerPort))
ldapConn, err = ldap.Dial("tcp", p.Host)
if err != nil {
return nil, err
}
......@@ -402,74 +421,114 @@ func (p *LDAPPool) ldapConnect() (*ldap.Conn, error) {
return ldapConn, err
}
func (m *LDAPIdentityProvider) ParseString(template, username string) string {
// invalidBindCredentials determines if a bind error was the result of invalid
// credentials.
func invalidBindCredentials(err error) bool {
ldapErr, ok := err.(*ldap.Error)
if ok {
return false
}
return ldapErr.ResultCode == ldap.LDAPResultInvalidCredentials
}
func (c *LDAPConnector) formatDN(template, username string) string {
result := template
result = strings.Replace(result, "%u", username, -1)
result = strings.Replace(result, "%b", m.baseDN, -1)
result = strings.Replace(result, "%b", c.baseDN, -1)
return result
}
func (m *LDAPIdentityProvider) Identity(username, password string) (*oidc.Identity, error) {
var err error
var bindDN, ldapUid, ldapName, ldapEmail string
var ldapConn *ldap.Conn
ldapConn, err = m.ldapPool.Acquire()
if err != nil {
return nil, err
func (c *LDAPConnector) Identity(username, password string) (*oidc.Identity, error) {
log.Errorf("handling identity")
var (
identity *oidc.Identity
err error
)
if c.searchBeforeAuth {
err = c.ldapPool.Do(func(conn *ldap.Conn) error {
if err := conn.Bind(c.searchBindDN, c.searchBindPw); err != nil {
// Don't wrap error as it may be a specific LDAP error.
return err
}
defer m.ldapPool.Put(ldapConn)
if m.searchBeforeAuth {
err = ldapConn.Bind(m.searchBindDN, m.searchBindPw)
filter := c.formatDN(c.searchFilter, username)
req := &ldap.SearchRequest{
BaseDN: c.baseDN,
Scope: c.searchScope,
Filter: filter,
Attributes: []string{c.nameAttribute, c.emailAttribute},
}
resp, err := conn.Search(req)
if err != nil {
return nil, err
return fmt.Errorf("search failed: %v", err)
}
switch len(resp.Entries) {
case 0:
return errors.New("user not found by search")
case 1:
default:
// For now reject searches that return multiple entries to avoid ambiguity.
log.Errorf("LDAP search %q returned %d entries. Must disambiguate searchFilter.", filter, len(resp.Entries))
return errors.New("search returned multiple entries")
}
filter := m.ParseString(m.searchFilter, username)
entry := resp.Entries[0]
email := entry.GetAttributeValue(c.emailAttribute)
if email == "" {
return fmt.Errorf("no email attribute found")
}
attributes := []string{
m.nameAttribute,
m.emailAttribute,
identity = &oidc.Identity{
ID: entry.DN,
Name: entry.GetAttributeValue(c.nameAttribute),
Email: email,
}
s := ldap.NewSearchRequest(m.baseDN, m.searchScope, ldap.NeverDerefAliases, 0, 0, false, filter, attributes, nil)
// Attempt to bind as the end user.
return conn.Bind(entry.DN, password)
})
} else {
err = c.ldapPool.Do(func(conn *ldap.Conn) error {
userBindDN := c.formatDN(c.bindTemplate, username)
if err := conn.Bind(userBindDN, password); err != nil {
// Don't wrap error as it may be a specific LDAP error.
return err
}
sr, err := ldapConn.Search(s)
req := &ldap.SearchRequest{
BaseDN: userBindDN,
Scope: ldap.ScopeBaseObject, // Only attempt to
Filter: "(objectClass=*)",
}
resp, err := conn.Search(req)
if err != nil {
return nil, err
return fmt.Errorf("search failed: %v", err)
}
if len(sr.Entries) == 0 {
err = fmt.Errorf("Search returned no match. filter='%v' base='%v'", filter, m.baseDN)
return nil, err
if len(resp.Entries) == 0 {
// Are there cases were a user wouldn't be able to see their own entity?
return fmt.Errorf("user not found by search")
}
entry := resp.Entries[0]
email := entry.GetAttributeValue(c.emailAttribute)
if email == "" {
return fmt.Errorf("no email attribute found")
}
bindDN = sr.Entries[0].DN
ldapName = sr.Entries[0].GetAttributeValue(m.nameAttribute)
ldapEmail = sr.Entries[0].GetAttributeValue(m.emailAttribute)
// prepare LDAP connection for bind as user
m.ldapPool.Put(ldapConn)
ldapConn, err = m.ldapPool.Acquire()
if err != nil {
return nil, err
identity = &oidc.Identity{
ID: entry.DN,
Name: entry.GetAttributeValue(c.nameAttribute),
Email: email,
}
} else {
bindDN = m.ParseString(m.bindTemplate, username)
return nil
})
}
// authenticate user
err = ldapConn.Bind(bindDN, password)
if err != nil {
if !invalidBindCredentials(err) {
log.Errorf("failed to connect to LDAP for search bind: %v", err)
}
return nil, err
}
ldapUid = bindDN
return &oidc.Identity{
ID: ldapUid,
Name: ldapName,
Email: ldapEmail,
}, nil
return identity, nil
}
connector/connector_ldap_test.go
View file @ b5d2b7eb
......@@ -21,6 +21,7 @@ func init() {
func TestLDAPConnectorConfigValidTLS(t *testing.T) {
cc := LDAPConnectorConfig{
ID: "ldap",
Host: "example.com:636",
UseTLS: true,
UseSSL: false,
}
......@@ -34,6 +35,7 @@ func TestLDAPConnectorConfigValidTLS(t *testing.T) {
func TestLDAPConnectorConfigInvalidSSLandTLS(t *testing.T) {
cc := LDAPConnectorConfig{
ID: "ldap",
Host: "example.com:636",
UseTLS: true,
UseSSL: true,
}
......@@ -47,6 +49,7 @@ func TestLDAPConnectorConfigInvalidSSLandTLS(t *testing.T) {
func TestLDAPConnectorConfigValidSearchScope(t *testing.T) {
cc := LDAPConnectorConfig{
ID: "ldap",
Host: "example.com:636",
SearchScope: "one",
}
......@@ -59,6 +62,7 @@ func TestLDAPConnectorConfigValidSearchScope(t *testing.T) {
func TestLDAPConnectorConfigInvalidSearchScope(t *testing.T) {
cc := LDAPConnectorConfig{
ID: "ldap",
Host: "example.com:636",
SearchScope: "three",
}
......@@ -71,6 +75,7 @@ func TestLDAPConnectorConfigInvalidSearchScope(t *testing.T) {
func TestLDAPConnectorConfigInvalidCertFileNoKeyFile(t *testing.T) {
cc := LDAPConnectorConfig{
ID: "ldap",
Host: "example.com:636",
CertFile: "/tmp/ldap.crt",
}
......@@ -83,6 +88,7 @@ func TestLDAPConnectorConfigInvalidCertFileNoKeyFile(t *testing.T) {
func TestLDAPConnectorConfigValidCertFileAndKeyFile(t *testing.T) {
cc := LDAPConnectorConfig{
ID: "ldap",
Host: "example.com:636",
CertFile: "/tmp/ldap.crt",
KeyFile: "/tmp/ldap.key",
}
......
connector/connector_local.go
View file @ b5d2b7eb
......@@ -87,7 +87,7 @@ func (c *LocalConnector) LoginURL(sessionKey, prompt string) (string, error) {
func (c *LocalConnector) Register(mux *http.ServeMux, errorURL url.URL) {
route := c.namespace.Path + "/login"
mux.Handle(route, handleLoginFunc(c.loginFunc, c.loginTpl, c.idp, route, errorURL))
mux.Handle(route, handlePasswordLogin(c.loginFunc, c.loginTpl, c.idp, route, errorURL))
}
func (c *LocalConnector) Sync() chan struct{} {
......
connector/interface.go
View file @ b5d2b7eb
......@@ -65,7 +65,3 @@ type ConnectorConfigRepo interface {
GetConnectorByID(repo.Transaction, string) (ConnectorConfig, error)
Set(cfgs []ConnectorConfig) error
}
type IdentityProvider interface {
Identity(email, password string) (*oidc.Identity, error)
}
connector/login_local.go
View file @ b5d2b7eb
......@@ -18,7 +18,12 @@ func redirectPostError(w http.ResponseWriter, errorURL url.URL, q url.Values) {
w.WriteHeader(http.StatusSeeOther)
}
func handleLoginFunc(lf oidc.LoginFunc, tpl *template.Template, idp IdentityProvider, localErrorPath string, errorURL url.URL) http.HandlerFunc {
// passwordLoginProvider is a provider which requires a username and password to identify the user.
type passwordLoginProvider interface {
Identity(email, password string) (*oidc.Identity, error)
}
func handlePasswordLogin(lf oidc.LoginFunc, tpl *template.Template, idp passwordLoginProvider, localErrorPath string, errorURL url.URL) http.HandlerFunc {
handleGET := func(w http.ResponseWriter, r *http.Request, errMsg string) {
q := r.URL.Query()
sessionKey := q.Get("session_key")
......@@ -54,9 +59,7 @@ func handleLoginFunc(lf oidc.LoginFunc, tpl *template.Template, idp IdentityProv
}
ident, err := idp.Identity(userid, password)
log.Errorf("IDENTITY: err: %v", err)
if ident == nil || err != nil {
if err != nil {
handleGET(w, r, "invalid login")
return
}
......
functional/ldap_test.go
View file @ b5d2b7eb
package functional
import (
"fmt"
"html/template"
"net"
"net/url"
"os"
"strconv"
"sync"
"testing"
"time"
......@@ -16,45 +13,41 @@ import (
"gopkg.in/ldap.v2"
)
var (
ldapHost string
ldapPort uint16
ldapBindDN string
ldapBindPw string
)
type LDAPServer struct {
Host string
Port uint16
Host string // Address (host:port) of LDAP service.
LDAPSHost string // Address (host:port) of LDAPS service (TLS port).
BindDN string
BindPw string
}
const (
ldapEnvHost = "DEX_TEST_LDAP_HOST"
ldapsEnvHost = "DEX_TEST_LDAPS_HOST"
ldapEnvBindName = "DEX_TEST_LDAP_BINDNAME"
ldapEnvBindPass = "DEX_TEST_LDAP_BINDPASS"
)
func ldapServer(t *testing.T) LDAPServer {
host := os.Getenv(ldapEnvHost)
if host == "" {
t.Fatalf("%s not set", ldapEnvHost)
getenv := func(key string) string {
val := os.Getenv(key)
if val == "" {
t.Fatalf("%s not set", key)
}
var port uint64 = 389
if h, p, err := net.SplitHostPort(host); err == nil {
port, err = strconv.ParseUint(p, 10, 16)
if err != nil {
t.Fatalf("failed to parse port: %v", err)
t.Logf("%s=%v", key, val)
return val
}
host = h
return LDAPServer{
Host: getenv(ldapEnvHost),
LDAPSHost: getenv(ldapsEnvHost),
BindDN: os.Getenv(ldapEnvBindName),
BindPw: os.Getenv(ldapEnvBindPass),
}
return LDAPServer{host, uint16(port), os.Getenv(ldapEnvBindName), os.Getenv(ldapEnvBindPass)}
}
func TestLDAPConnect(t *testing.T) {
server := ldapServer(t)
l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", server.Host, server.Port))
l, err := ldap.Dial("tcp", server.Host)
if err != nil {
t.Fatal(err)
}
......@@ -75,23 +68,20 @@ func TestConnectorLDAPHealthy(t *testing.T) {
{
config: connector.LDAPConnectorConfig{
ID: "ldap",
ServerHost: server.Host,
ServerPort: server.Port + 1,
Host: "localhost:0",
},
wantErr: true,
},
{
config: connector.LDAPConnectorConfig{
ID: "ldap",
ServerHost: server.Host,
ServerPort: server.Port,
Host: server.Host,
},
},
{
config: connector.LDAPConnectorConfig{
ID: "ldap",
ServerHost: server.Host,
ServerPort: server.Port,
Host: server.Host,
UseTLS: true,
CertFile: "/tmp/ldap.crt",
KeyFile: "/tmp/ldap.key",
......@@ -101,8 +91,7 @@ func TestConnectorLDAPHealthy(t *testing.T) {
{
config: connector.LDAPConnectorConfig{
ID: "ldap",
ServerHost: server.Host,
ServerPort: server.Port + 247, // 636
Host: server.LDAPSHost,
UseSSL: true,
CertFile: "/tmp/ldap.crt",
KeyFile: "/tmp/ldap.key",
......@@ -131,8 +120,7 @@ func TestLDAPPoolHighWatermarkAndLockContention(t *testing.T) {
server := ldapServer(t)
ldapPool := &connector.LDAPPool{
MaxIdleConn: 30,
ServerHost: server.Host,
ServerPort: server.Port,
Host: server.Host,
UseTLS: false,
UseSSL: false,
}
......@@ -151,17 +139,16 @@ func TestLDAPPoolHighWatermarkAndLockContention(t *testing.T) {
case <-ctx.Done():
return
default:
ldapConn, err := ldapPool.Acquire()
if err != nil {
t.Errorf("Unable to acquire LDAP Connection: %v", err)
}
s := ldap.NewSearchRequest("", ldap.ScopeBaseObject, ldap.NeverDerefAliases, 0, 0, false, "(objectClass=*)", []string{}, nil)
_, err = ldapConn.Search(s)
err := ldapPool.Do(func(conn *ldap.Conn) error {
s := &ldap.SearchRequest{
Scope: ldap.ScopeBaseObject,
Filter: "(objectClass=*)",
}
_, err := conn.Search(s)
return err
})
if err != nil {
t.Errorf("Search request failed. Dead/invalid LDAP connection from pool?: %v", err)
ldapConn.Close()
} else {
ldapPool.Put(ldapConn)
}
_, _ = ldapPool.CheckConnections()
}
......
static/fixtures/connectors.json.sample
View file @ b5d2b7eb
......@@ -25,8 +25,7 @@
{
"type": "ldap",
"id": "ldap",
"serverHost": "127.0.0.1",
"serverPort": 389,
"host": "127.0.0.1:389",
"useTLS": true,
"useSSL": false,
"caFile": "/etc/ssl/certs/example_com_root.crt",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment