Documentation
¶
Overview ¶
Package ldap implements simple-bind LDAP/Active Directory authentication.
On a successful bind the account is upserted into the local users table, so RBAC grants, shares and quotas treat a directory user like any other. The browser session that follows is the ordinary `filex_session` cookie — minted through internal/auth/drivers/local so there is exactly one definition of a session's shape.
Two entry points, deliberately ¶
- Login is the browser path: verify, then mint a session.
- VerifyPassword is the protocol path (WebDAV, SFTP, FTPS, S3, NFS): verify and nothing else. Those protocols present the password on EVERY request; minting a session per request would fill the sessions table with rows nobody can ever use or revoke.
Both share verify(), so the directory is consulted in exactly one way.
Index ¶
- Constants
- type Driver
- func (d *Driver) Authenticate(_ *http.Request) (*model.User, error)
- func (d *Driver) Capabilities() auth.Capabilities
- func (d *Driver) ClaimsEmail(email string) bool
- func (d *Driver) Directory() string
- func (d *Driver) Init(_ context.Context, cfg map[string]any) error
- func (d *Driver) Login(ctx context.Context, identifier, password string) (*model.User, string, error)
- func (d *Driver) Logout(ctx context.Context, token string) error
- func (d *Driver) Name() string
- func (d *Driver) Probe(ctx context.Context, cfg map[string]any, _ *http.Request) []auth.ProbeCheck
- func (d *Driver) SyncDirectory(ctx context.Context) (*auth.DirectorySyncReport, error)
- func (d *Driver) SyncInterval() time.Duration
- func (d *Driver) VerifyPassword(ctx context.Context, identifier, password string) (*model.User, error)
Constants ¶
const OwnerTenantKey = "owner_tenant"
OwnerTenantKey is the configuration key authsetup sets on a tenant's own LDAP instance: the id of the tenant it belongs to.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Driver ¶
type Driver struct {
// contains filtered or unexported fields
}
Driver is the LDAP/AD auth driver — one directory. An install may have several (Admin → Identity providers → Add a provider): each is its own instance, and directory is its slug.
func (*Driver) Authenticate ¶
Authenticate is a no-op: this driver has no per-request credential to read. A directory account's requests carry the same session cookie as everyone else's, and the local driver resolves those.
⚠ This method being a flat refusal is exactly why the driver used to be unreachable: the auth middleware walks the enabled drivers calling Authenticate, so being "enabled" told it nothing. Login is reached through auth.LoginChain instead — see internal/auth/chain.go.
func (*Driver) Capabilities ¶
func (d *Driver) Capabilities() auth.Capabilities
Capabilities implements auth.Driver.
func (*Driver) ClaimsEmail ¶ added in v0.52.0
ClaimsEmail reports whether this directory owns an address: it names e-mail domains (email_domains) and the address is in one. A directory that names none claims nothing — it signs in any address, but owns none.
func (*Driver) Login ¶
func (d *Driver) Login(ctx context.Context, identifier, password string) (*model.User, string, error)
Login verifies the credentials against the directory and mints a browser session for the resulting account.
The browser sign-in is also where the person's LDAP links are brought in step with the directory (syncLinkGroups); the file protocols, which present the password on every request, never move those memberships.
func (*Driver) Logout ¶
Logout revokes a session minted by Login.
⚠ Its real job is making *Driver satisfy auth.LoginDriver. Without it the driver could not be placed in the login chain AT ALL — the compiler said "missing method Logout" — which is half of why the directory path was unreachable.
func (*Driver) Probe ¶
Probe tests an LDAP configuration the way a sign-in would use it, stopping at the first step that fails:
required the address and the base DN are filled in
address the address is ldap:// or ldaps://
connect the directory answers at that address (TLS verified for ldaps)
starttls StartTLS succeeds, when it is switched on for ldap://
bind the service account binds with its password — or, with no
service account, the bind is anonymous and said to be
base the base DN exists and is readable by that bind
people, groups / groups_search, sync_groups — what sign-in and directory
sync will find there (probeDirectory)
⚠ Nothing is written and nobody signs in: this is the service bind and one base-scope read, which is what every login starts with. What it cannot check — that a particular person's filter matches — is left to a login.
func (*Driver) SyncDirectory ¶ added in v0.52.0
SyncDirectory implements auth.DirectorySyncer.
func (*Driver) SyncInterval ¶ added in v0.52.0
SyncInterval implements auth.DirectorySyncer.
func (*Driver) VerifyPassword ¶
func (d *Driver) VerifyPassword(ctx context.Context, identifier, password string) (*model.User, error)
VerifyPassword checks a password against the directory and returns the local account, WITHOUT minting a session. This is what the non-HTTP protocols use; see internal/protocolauth.
Source Files