Documentation
¶
Overview ¶
Package ldap is GoatFlow's LDAP / Active Directory directory client. It finds a user with a service-account (or anonymous) search and verifies the password by binding as that user, the same way OTRS's Kernel::System::Auth::LDAP does.
Index ¶
Constants ¶
const ( GroupMemberDN = "dn" GroupMemberUsername = "username" )
Group member values accepted by LDAP_GROUP_MEMBER_VALUE.
Variables ¶
var ( ErrUserNotFound = errors.New("ldap: no directory entry matches the login") ErrInvalidCredentials = errors.New("ldap: invalid credentials") ErrAmbiguousUser = errors.New("ldap: user filter matches more than one entry") ErrNotAuthorized = errors.New("ldap: user is not a member of LDAP_AGENT_GROUPS or LDAP_ADMIN_GROUPS") )
Authentication outcomes callers map to their own errors.
Functions ¶
Types ¶
type Client ¶ added in v0.10.0
type Client struct {
// contains filtered or unexported fields
}
Client authenticates users against one LDAP server. It opens a new connection per call, so it is safe for concurrent use.
func NewClient ¶ added in v0.10.0
NewClient builds a client; it fails when the configured CA file is unusable.
func (*Client) Authenticate ¶ added in v0.10.0
Authenticate looks the login up and verifies password by binding as the matching entry. An empty password always fails: LDAP treats a simple bind with an empty password as an anonymous bind that "succeeds".
func (*Client) GroupFilter ¶ added in v0.10.0
GroupFilter returns the group search filter for user, escaped like UserFilter.
func (*Client) IsAdmin ¶ added in v0.10.0
IsAdmin reports whether the user belongs to one of LDAP_ADMIN_GROUPS.
func (*Client) UserFilter ¶ added in v0.10.0
UserFilter returns the search filter for login with every filter metacharacter in login escaped (RFC 4515), so input cannot alter the filter.
func (*Client) WarnInsecure ¶ added in v0.10.0
func (c *Client) WarnInsecure()
WarnInsecure logs settings that weaken transport security.
type Config ¶
type Config struct {
// Connection
Host string
Port int
UseSSL bool // ldaps://
UseTLS bool // StartTLS on ldap://
SkipTLSVerify bool
CACertFile string
Timeout time.Duration
// Service account used for the user search; empty BindDN searches anonymously.
BindDN string
BindPassword string
// User search
BaseDN string
UserBaseDN string // defaults to BaseDN
UserFilter string // exactly one %s, replaced by the escaped login
IsActiveDirectory bool
Domain string // AD: also match userPrincipalName=<login>@<Domain>
// Attribute mapping
UsernameAttribute string // value becomes the GoatFlow login; empty keeps the typed login
EmailAttribute string
FirstNameAttribute string
LastNameAttribute string
DisplayNameAttribute string
// Groups
GroupBaseDN string
GroupFilter string // exactly one %s, replaced by the escaped member value
GroupAttribute string
GroupMemberValue string // "dn" or "username": what replaces %s in GroupFilter
AdminGroups []string
AgentGroups []string
// GoatFlow agent account mapping
AutoCreateUsers bool
AutoUpdateUsers bool
InitialGroups []string
}
Config holds the LDAP settings, read from LDAP_* environment variables.
func LoadFromEnvironment ¶
LoadFromEnvironment reads and validates the LDAP_* environment variables. The error lists every invalid setting by variable name.
type User ¶
type User struct {
DN string
Username string // GoatFlow login: the UsernameAttribute value, else the typed login
Email string
FirstName string
LastName string
DisplayName string
Groups []string // GroupAttribute values of the groups the user belongs to
}
User is a directory entry whose password has been verified.
Source Files