Documentation
¶
Index ¶
- Variables
- func ValidUserFilter(filter string) bool
- type Client
- type Dialer
- type Service
- func (s *Service) Authenticate(ctx context.Context, username, password string) (*store.User, error)
- func (s *Service) GetSettings(ctx context.Context) (*store.LDAPSettings, error)
- func (s *Service) Run(ctx context.Context)
- func (s *Service) SetDialer(d Dialer)
- func (s *Service) Sync(ctx context.Context) (*SyncResult, error)
- func (s *Service) Test(ctx context.Context, req TestRequest) (*TestResult, error)
- func (s *Service) UpdateSettings(ctx context.Context, settings *store.LDAPSettings, rawBindPassword *string) error
- type SyncResult
- type TestRequest
- type TestResult
Constants ¶
This section is empty.
Variables ¶
var ( ErrDisabled = errors.New("ldap is disabled") ErrInvalidCredentials = errors.New("invalid ldap credentials") ErrUserNotFound = errors.New("ldap user not found") ErrAmbiguousUser = errors.New("multiple ldap users match the query") ErrAutoRegisterOff = errors.New("ldap auto registration is disabled") // ErrLocalAccount means the directory entry maps to a local (non-LDAP) // account. Such accounts are never linked to or authenticated through LDAP, // otherwise a directory entry named e.g. "admin" would take over the local // admin. ErrLocalAccount = errors.New("ldap entry collides with a local account") // ErrInvalidUsername means the directory username does not satisfy the // panel's username rules (store.ValidUsername), so no account is created. ErrInvalidUsername = errors.New("ldap username is not a valid panel username") )
Functions ¶
func ValidUserFilter ¶ added in v0.11.0
ValidUserFilter reports whether a user filter template has at most one %s (the escaped username is substituted once).
Types ¶
type Client ¶
type Client interface {
Bind(username, password string) error
Search(searchRequest *ldapv3.SearchRequest) (*ldapv3.SearchResult, error)
SearchWithPaging(searchRequest *ldapv3.SearchRequest, pagingSize uint32) (*ldapv3.SearchResult, error)
Close() error
}
Client is the interface subset of ldapv3.Conn used by the service.
type Dialer ¶
type Dialer func(cfg *store.LDAPSettings, bindPassword string) (Client, error)
Dialer establishes an LDAP connection and, when cfg.BindDN is set, binds as that service account with bindPassword. go-ldap refuses empty-password binds, so a connection for a user's own bind must not ask for the service bind (see Service.dialUnbound).
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service provides LDAP authentication, directory sync, and configuration testing.
func NewService ¶
NewService constructs an LDAP service.
func (*Service) Authenticate ¶
Authenticate verifies user credentials against LDAP and provisions/updates the local user.
func (*Service) GetSettings ¶
GetSettings retrieves the current LDAP configuration.
func (*Service) Sync ¶
func (s *Service) Sync(ctx context.Context) (*SyncResult, error)
Sync iterates directory users matching the sync filter and creates/updates local records.
func (*Service) Test ¶
func (s *Service) Test(ctx context.Context, req TestRequest) (*TestResult, error)
Test checks connectivity, bind credentials, user search and optional user password verification.
func (*Service) UpdateSettings ¶
func (s *Service) UpdateSettings(ctx context.Context, settings *store.LDAPSettings, rawBindPassword *string) error
UpdateSettings updates the LDAP configuration and seals the bind password if supplied.
type SyncResult ¶
type SyncResult struct {
SyncedCount int `json:"synced_count"`
Status string `json:"status"`
Error string `json:"error,omitempty"`
}
SyncResult reports the outcome of a manual or scheduled directory sync.
type TestRequest ¶
type TestRequest struct {
Settings *store.LDAPSettings `json:"settings,omitempty"`
RawBindPassword *string `json:"raw_bind_password,omitempty"`
TestUsername string `json:"test_username,omitempty"`
TestPassword string `json:"test_password,omitempty"`
}
TestRequest configures a test connection and/or lookup attempt.
type TestResult ¶
type TestResult struct {
OK bool `json:"ok"`
Message string `json:"message"`
Connected bool `json:"connected"`
Bound bool `json:"bound"`
UserFound bool `json:"user_found"`
UserDN string `json:"user_dn,omitempty"`
UserBound bool `json:"user_bound"`
Attributes map[string]string `json:"attributes,omitempty"`
Groups []string `json:"groups,omitempty"`
MappedGroupID *int64 `json:"mapped_group_id,omitempty"`
}
TestResult reports the outcome of the test.
Source Files