VAULT 18227/introduce cap ldap library #22185
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,6 +8,7 @@ | |
| "fmt" | ||
| "strings" | ||
|
|
||
| "github.com/hashicorp/cap/ldap" | ||
|
Check failure on line 11 in builtin/credential/ldap/backend.go
|
||
| "github.com/hashicorp/go-secure-stdlib/strutil" | ||
|
|
||
| "github.com/hashicorp/vault/sdk/framework" | ||
|
|
@@ -76,82 +77,25 @@ | |
| return "", nil, logical.ErrorResponse("password cannot be of zero length when passwordless binds are being denied"), nil, nil | ||
| } | ||
|
|
||
| ldapClient, err := ldap.NewClient(ctx, ldaputil.ConvertConfig(cfg.ConfigEntry)) | ||
| if err != nil { | ||
| return "", nil, logical.ErrorResponse(err.Error()), nil, nil | ||
| } | ||
|
|
||
| // Clean connection | ||
|
There was a problem hiding this comment. All of the code deleted below is implemented via the We do need to specify options to also get |
||
| defer ldapClient.Close(ctx) | ||
|
|
||
| c, err := ldapClient.Authenticate(ctx, username, password, ldap.WithGroups(), ldap.WithUserAttributes()) | ||
| if err != nil { | ||
| if strings.Contains(err.Error(), "discovery of user bind DN failed") || | ||
| strings.Contains(err.Error(), "unable to bind user") { | ||
|
Comment on lines
+90
to
+91
There was a problem hiding this comment. A little manual, as the |
||
| return "", nil, logical.ErrorResponse(errUserBindFailed), nil, logical.ErrInvalidCredentials | ||
| } | ||
|
|
||
| return "", nil, logical.ErrorResponse(err.Error()), nil, nil | ||
| } | ||
|
|
||
| ldapGroups := c.Groups | ||
| ldapResponse := &logical.Response{ | ||
| Data: map[string]interface{}{}, | ||
| } | ||
|
|
@@ -162,6 +106,10 @@ | |
| ldapResponse.AddWarning(errString) | ||
| } | ||
|
|
||
| for _, warning := range c.Warnings { | ||
| ldapResponse.AddWarning(string(warning)) | ||
| } | ||
|
|
||
| var allGroups []string | ||
| canonicalUsername := username | ||
| cs := *cfg.CaseSensitiveNames | ||
|
|
@@ -206,13 +154,11 @@ | |
| return username, policies, ldapResponse, allGroups, nil | ||
| } | ||
|
|
||
|
Comment on lines
-209
to
-213
There was a problem hiding this comment. The implementation of this can be found here. I believe it boils down to finding the 'CN' (common name) attribute. |
||
| userAttrValues := c.UserAttributes[cfg.UserAttr] | ||
|
There was a problem hiding this comment. UUIC There was a problem hiding this comment. Yeah it seems like the cap/ldap implementation doesn't apply the But based on the existing client, vault/sdk/helper/ldaputil/client.go Line 149 in be83f12 cfg.UserAttr as well.
|
||
| if len(userAttrValues) == 0 { | ||
| return "", nil, logical.ErrorResponse("missing entity alias attribute value"), nil, nil | ||
| } | ||
| entityAliasAttribute := userAttrValues[0] | ||
|
|
||
| return entityAliasAttribute, policies, ldapResponse, allGroups, nil | ||
| } | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| ```release-note:improvement | ||
| auth/ldap: introduce cap/ldap.Client for LDAP authentication | ||
| auth/ldap: deprecates `connection_timeout` in favor of `request_timeout` for timeouts | ||
| sdk/ldaputil: deprecates Client in favor of cap/ldap.Client | ||
| ``` |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,12 +18,13 @@ | |
| "text/template" | ||
| "time" | ||
|
|
||
| "github.com/go-ldap/ldap/v3" | ||
|
Check failure on line 21 in sdk/helper/ldaputil/client.go
|
||
| hclog "github.com/hashicorp/go-hclog" | ||
| multierror "github.com/hashicorp/go-multierror" | ||
| "github.com/hashicorp/go-secure-stdlib/tlsutil" | ||
| ) | ||
|
|
||
| // Deprecated: Use ldap.Client instead | ||
|
There was a problem hiding this comment. I'm thinking we'll want to leave this as not deprecated. It's still used in a couple of different plugins (openldap example) for secrets engine use cases. I don't think cap/ldap will ever replace the usage given that it's targeted at authentication. |
||
| type Client struct { | ||
| Logger hclog.Logger | ||
| LDAP LDAP | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👋🏼