Documentation
¶
Overview ¶
Package backend provides backend functionality.
Index ¶
- func DeleteWebAuthnFromRedis(ctx context.Context, logger *slog.Logger, cfg config.File, ...) error
- func GetCacheNames(cfg config.File, channel Channel, requestedProtocol string, ...) (cacheNames config.StringSet)
- func GetUserAccountFromCache(ctx context.Context, cfg config.File, logger *slog.Logger, ...) (accountName string)
- func LDAPAuthWorker(ctx context.Context, cfg config.File, logger *slog.Logger, channel Channel, ...)
- func LDAPEndpointWithCtx(cfg config.File) lua.LGFunction
- func LDAPMainWorker(ctx context.Context, cfg config.File, logger *slog.Logger, channel Channel, ...)
- func LDAPModifyWithCtx(ctx context.Context) lua.LGFunction
- func LDAPSearchWithCtx(ctx context.Context) lua.LGFunction
- func LoadCacheFromRedis(ctx context.Context, cfg config.File, logger *slog.Logger, ...) (isRedisErr bool, err error)
- func LoadCacheFromRedisWithSF(ctx context.Context, cfg config.File, logger *slog.Logger, ...) (isRedisErr bool, err error)
- func LoaderLDAPStateless() lua.LGFunction
- func LoaderModLDAP(ctx context.Context, cfg config.File) lua.LGFunction
- func LookupUserAccountFromRedis(ctx context.Context, cfg config.File, redisClient rediscli.Client, ...) (accountName string, err error)
- func LuaLDAPEndpoint(cfg config.File) lua.LGFunction
- func LuaLDAPModify(ctx context.Context) lua.LGFunction
- func LuaLDAPSearch(ctx context.Context) lua.LGFunction
- func LuaMainWorker(ctx context.Context, cfg config.File, logger *slog.Logger, ...) (err error)
- func ResolveAccountIdentifier(ctx context.Context, cfg config.File, logger *slog.Logger, ...) (accountName string)
- func SaveUserDataToRedis(ctx context.Context, cfg config.File, logger *slog.Logger, ...)
- func SaveWebAuthnToRedis(ctx context.Context, logger *slog.Logger, cfg config.File, ...) error
- func SetDefaultRedisClient(c rediscli.Client)
- func SetLuaLDAPQueue(enqueuer LDAPRequestEnqueuer)
- func SetUserAccountMapping(ctx context.Context, cfg config.File, redisClient rediscli.Client, ...) error
- func TrySignalDone(ch chan bktype.Done)
- type Channel
- type LDAPAuthQueue
- type LDAPChannel
- type LDAPPoolFactory
- type LDAPQueue
- type LDAPRequestEnqueuer
- type LDAPWorkerDeps
- type LuaChannel
- type LuaChannelImpl
- type User
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DeleteWebAuthnFromRedis ¶
func DeleteWebAuthnFromRedis(ctx context.Context, logger *slog.Logger, cfg config.File, redisClient rediscli.Client, uniqueUserID string) error
DeleteWebAuthnFromRedis removes a cached WebAuthn user entry by unique user ID.
func GetCacheNames ¶
func GetCacheNames(cfg config.File, channel Channel, requestedProtocol string, backends definitions.CacheNameBackend) (cacheNames config.StringSet)
GetCacheNames retrieves cache names for the specified protocol from either LDAP, Lua, or both backends as per the input. If no cache names are found, a default cache name "__default__" is returned.
func GetUserAccountFromCache ¶
func GetUserAccountFromCache(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, accountCache *accountcache.Manager, username, protocol, oidcClientID, guid string) (accountName string)
GetUserAccountFromCache fetches the user account name from Redis cache using the provided username. Logs errors and increments Redis read counter. Returns an empty string if the account name is not found or an error occurs.
func LDAPAuthWorker ¶
func LDAPAuthWorker(ctx context.Context, cfg config.File, logger *slog.Logger, channel Channel, poolName string, deps LDAPWorkerDeps)
LDAPAuthWorker is responsible for handling LDAP authentication requests using a connection pool and concurrency control. It initializes the authentication connection pool, starts a resource management process, and handles requests or exits gracefully. It now uses a priority queue instead of channels for better request handling.
func LDAPEndpointWithCtx ¶
func LDAPEndpointWithCtx(cfg config.File) lua.LGFunction
LDAPEndpointWithCtx is a WithCtx-factory alias returning the same function as LuaLDAPEndpoint(cfg).
func LDAPMainWorker ¶
func LDAPMainWorker(ctx context.Context, cfg config.File, logger *slog.Logger, channel Channel, poolName string, deps LDAPWorkerDeps)
LDAPMainWorker orchestrates LDAP lookup operations, manages a connection pool, and processes incoming requests in a loop. It now uses a priority queue instead of channels for better request handling.
func LDAPModifyWithCtx ¶
func LDAPModifyWithCtx(ctx context.Context) lua.LGFunction
LDAPModifyWithCtx is a WithCtx-factory alias returning the same function as LuaLDAPModify(ctx).
func LDAPSearchWithCtx ¶
func LDAPSearchWithCtx(ctx context.Context) lua.LGFunction
LDAPSearchWithCtx is a WithCtx-factory alias returning the same function as LuaLDAPSearch(ctx).
func LoadCacheFromRedis ¶
func LoadCacheFromRedis(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, key string, ucp *bktype.PositivePasswordCache) (isRedisErr bool, err error)
LoadCacheFromRedis retrieves cache data from Redis Hash based on a provided key and populates the given structure. It increments Redis read metrics and logs errors or debug information appropriately during the operation. Returns whether the error originated from Redis and any encountered error during retrieval or unmarshaling.
func LoadCacheFromRedisWithSF ¶
func LoadCacheFromRedisWithSF(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, key string, ucp *bktype.PositivePasswordCache) (isRedisErr bool, err error)
LoadCacheFromRedisWithSF is a wrapper around LoadCacheFromRedis that uses singleflight to avoid redundant Redis lookups.
func LoaderLDAPStateless ¶
func LoaderLDAPStateless() lua.LGFunction
LoaderLDAPStateless returns an empty, stateless module table for nauthilus_ldap. It is intended to be preloaded once per VM (base environment). Per-request bindings will later clone this table and inject bound functions via WithCtx factories.
func LoaderModLDAP ¶
LoaderModLDAP initializes and loads the LDAP module into the Lua state with predefined functions for LDAP operations.
func LookupUserAccountFromRedis ¶
func LookupUserAccountFromRedis(ctx context.Context, cfg config.File, redisClient rediscli.Client, username, protocol, oidcClientID string) (accountName string, err error)
LookupUserAccountFromRedis returns the user account value from the user Redis hash.
func LuaLDAPEndpoint ¶
func LuaLDAPEndpoint(cfg config.File) lua.LGFunction
LuaLDAPEndpoint provides the exported LuaLDAPEndpoint function.
func LuaLDAPModify ¶
LuaLDAPModify is a function that modifies LDAP entries based on the given Lua table input. It validates the input table, creates an LDAP modification request, and sends it via priority queue. The function returns results via Lua stack, "OK" on success, or an error message if the operation fails.
func LuaLDAPSearch ¶
LuaLDAPSearch initializes and registers an LDAP search function for Lua, handling inputs, validation, and processing.
func LuaMainWorker ¶
func LuaMainWorker(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, channel Channel, backendName string) (err error)
LuaMainWorker processes Lua script requests in a loop until the context is canceled. It compiles the Lua script and handles requests using a dedicated goroutine for each. It now uses a priority queue instead of channels for better request handling.
func ResolveAccountIdentifier ¶
func ResolveAccountIdentifier(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, identifier, protocol, oidcClientID, guid string) (accountName string)
ResolveAccountIdentifier resolves an identifier that may be either a username or an account name. It first tries to look up a mapping in the USER hash; if not found, it treats the identifier as an account name.
func SaveUserDataToRedis ¶
func SaveUserDataToRedis(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, guid string, key string, ttl time.Duration, cache *bktype.PositivePasswordCache)
SaveUserDataToRedis is a generic routine to store a cache object on Redis using Redis Hash for better memory efficiency. It stores each field of the PositivePasswordCache structure as a separate hash field, with complex fields serialized as JSON.
func SaveWebAuthnToRedis ¶
func SaveWebAuthnToRedis(ctx context.Context, logger *slog.Logger, cfg config.File, redisClient rediscli.Client, user *User, ttl time.Duration) error
SaveWebAuthnToRedis saves a user's WebAuthn credentials to Redis with a specified TTL using Redis Hash. Returns an error if serialization or Redis storage operation fails.
func SetDefaultRedisClient ¶
SetDefaultRedisClient sets the backend-wide default Redis client.
func SetLuaLDAPQueue ¶
func SetLuaLDAPQueue(enqueuer LDAPRequestEnqueuer)
SetLuaLDAPQueue replaces the Lua LDAP queue enqueuer (nil restores defaults).
func SetUserAccountMapping ¶
func SetUserAccountMapping(ctx context.Context, cfg config.File, redisClient rediscli.Client, username, protocol, oidcClientID, account string) error
SetUserAccountMapping writes/updates the username → account mapping in Redis.
func TrySignalDone ¶
TrySignalDone provides the exported TrySignalDone function.
Types ¶
type Channel ¶
type Channel interface {
// GetLdapChannel retrieves and returns the LDAPChannel instance associated with the implementation of the Channel interface.
GetLdapChannel() LDAPChannel
// GetLuaChannel retrieves and returns the LuaChannel instance associated with the Channel interface implementation.
GetLuaChannel() LuaChannel
}
Channel is an interface comprising methods to retrieve LDAPChannel and LuaChannel instances.
func NewChannel ¶
NewChannel initializes and returns a new instance of the Channel interface implementation.
type LDAPAuthQueue ¶
type LDAPAuthQueue interface {
AddPoolName(poolName string)
SetMaxQueueLength(poolName string, length int)
PopWithContext(ctx context.Context, poolName string) *bktype.LDAPAuthRequest
}
LDAPAuthQueue abstracts the authentication request queue for LDAP workers.
type LDAPChannel ¶
type LDAPChannel interface {
// GetLookupEndChan returns a channel that signals the completion of lookup operations.
GetLookupEndChan(poolName string) chan bktype.Done
// GetAuthEndChan returns the channel used to signal the completion of authentication operations.
GetAuthEndChan(poolName string) chan bktype.Done
// GetPoolNames retrieves and returns a list of names for all configured LDAP connection pools.
GetPoolNames() []string
// AddChannel creates and initializes all necessary channels for the specified LDAP connection pool by poolName.
AddChannel(poolName string) error
}
LDAPChannel defines an interface for managing LDAP-related channels for communication and operation handling.
func NewLDAPChannel ¶
func NewLDAPChannel(poolName string) LDAPChannel
NewLDAPChannel provides the exported NewLDAPChannel function.
type LDAPPoolFactory ¶
type LDAPPoolFactory interface {
NewPool(ctx context.Context, cfg config.File, logger *slog.Logger, poolType int, poolName string) ldappool.LDAPPool
}
LDAPPoolFactory creates LDAP pools for lookup or authentication workers.
type LDAPQueue ¶
type LDAPQueue interface {
AddPoolName(poolName string)
SetMaxQueueLength(poolName string, length int)
PopWithContext(ctx context.Context, poolName string) *bktype.LDAPRequest
}
LDAPQueue abstracts the shared lookup request queue for LDAP workers.
type LDAPRequestEnqueuer ¶
type LDAPRequestEnqueuer interface {
Push(request *bktype.LDAPRequest, priority int)
}
LDAPRequestEnqueuer enqueues LDAP lookup requests with a priority.
type LDAPWorkerDeps ¶
type LDAPWorkerDeps struct {
Queue LDAPQueue
AuthQueue LDAPAuthQueue
PoolFactory LDAPPoolFactory
}
LDAPWorkerDeps provides injectable dependencies for LDAP worker startup.
type LuaChannel ¶
type LuaChannel interface {
// GetLookupEndChan returns a channel used to signal the completion of lookup operations.
GetLookupEndChan(backendName string) chan bktype.Done
// GetBackendNames returns a list of all available backend names configured in the LuaChannel implementation.
GetBackendNames() []string
// AddChannel adds a new channel for the specified backend identified by the backendName.
// Returns an error if the backendName is invalid or the channel could not be created.
AddChannel(backendName string) error
}
LuaChannel defines an interface for managing Lua-related channels used for communication and request handling.
func NewLuaChannel ¶
func NewLuaChannel(backendName string) LuaChannel
NewLuaChannel creates and returns a new instance of LuaChannel, initialized as a LuaChannelImpl.
type LuaChannelImpl ¶
type LuaChannelImpl struct {
// contains filtered or unexported fields
}
LuaChannelImpl describes the exported LuaChannelImpl type.
func (*LuaChannelImpl) AddChannel ¶
func (c *LuaChannelImpl) AddChannel(backendName string) error
AddChannel initializes channels for request and completion handling for a specified backend name. Returns an error if the backend name is invalid.
func (*LuaChannelImpl) GetBackendNames ¶
func (c *LuaChannelImpl) GetBackendNames() []string
GetBackendNames retrieves a list of backend names from the LuaChannelImpl's lookupEndChan map.
func (*LuaChannelImpl) GetLookupEndChan ¶
func (c *LuaChannelImpl) GetLookupEndChan(backendName string) chan bktype.Done
GetLookupEndChan returns a channel of type Done that signals the end of a lookup operation.
type User ¶
type User struct {
ID string `redis:"Id"`
Name string `redis:"name"`
DisplayName string `redis:"display_name"`
Credentials []mfa.PersistentCredential `redis:"credentials"`
Attributes bktype.AttributeMapping `redis:"-"`
Groups []string `redis:"-"`
GroupDistinguishedNames []string `redis:"-"`
TOTPSecretField string `redis:"totp_secret_field"`
TOTPRecoveryField string `redis:"totp_recovery_field"`
}
User represents the user model
func GetWebAuthnFromRedis ¶
func GetWebAuthnFromRedis(ctx context.Context, cfg config.File, logger *slog.Logger, redisClient rediscli.Client, uniqueUserID string) (user *User, err error)
GetWebAuthnFromRedis retrieves a User object from Redis Hash using the provided unique user ID. Returns the User object or an error if retrieval or unmarshaling fails.
func (*User) AddCredential ¶
func (u *User) AddCredential(cred webauthn.Credential, name string)
AddCredential associates the credential to the user
func (*User) WebAuthnCredentials ¶
func (u *User) WebAuthnCredentials() []webauthn.Credential
WebAuthnCredentials returns credentials owned by the user
func (*User) WebAuthnDisplayName ¶
WebAuthnDisplayName returns the user's display name
func (*User) WebAuthnIcon ¶
WebAuthnIcon is not (yet) implemented
func (*User) WebAuthnName ¶
WebAuthnName returns the user's username
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package accountcache provides accountcache functionality.
|
Package accountcache provides accountcache functionality. |
|
Package bktype provides bktype functionality.
|
Package bktype provides bktype functionality. |
|
Package ldappool provides ldappool functionality.
|
Package ldappool provides ldappool functionality. |
|
Package priorityqueue provides priorityqueue functionality.
|
Package priorityqueue provides priorityqueue functionality. |
|
Package remote implements edge-side backends backed by a Nauthilus authority.
|
Package remote implements edge-side backends backed by a Nauthilus authority. |