cc-backend/auth/ldap.go

package auth

import (
	"crypto/tls"
	"errors"
	"fmt"
	"log"
	"os"
	"strings"
	"sync"

	"github.com/go-ldap/ldap/v3"
	"github.com/jmoiron/sqlx"
)

type LdapConfig struct {
	Url        string `json:"url"`
	UserBase   string `json:"user_base"`
	SearchDN   string `json:"search_dn"`
	UserBind   string `json:"user_bind"`
	UserFilter string `json:"user_filter"`
	TLS        bool   `json:"tls"`
}

var ldapAuthEnabled bool = false
var ldapConfig *LdapConfig
var ldapAdminPassword string

func initLdap(config *LdapConfig) error {
	ldapAdminPassword = os.Getenv("LDAP_ADMIN_PASSWORD")
	if ldapAdminPassword == "" {
		log.Println("warning: environment variable 'LDAP_ADMIN_PASSWORD' not set")
	}

	ldapConfig = config
	ldapAuthEnabled = true
	return nil
}

var ldapConnectionsLock sync.Mutex
var ldapConnections []*ldap.Conn = []*ldap.Conn{}

// TODO: Add a connection pool or something like
// that so that connections can be reused/cached.
func getLdapConnection() (*ldap.Conn, error) {
	ldapConnectionsLock.Lock()
	n := len(ldapConnections)
	if n > 0 {
		conn := ldapConnections[n-1]
		ldapConnections = ldapConnections[:n-1]
		ldapConnectionsLock.Unlock()
		return conn, nil
	}
	ldapConnectionsLock.Unlock()

	conn, err := ldap.DialURL(ldapConfig.Url)
	if err != nil {
		return nil, err
	}

	if ldapConfig.TLS {
		if err := conn.StartTLS(&tls.Config{InsecureSkipVerify: true}); err != nil {
			conn.Close()
			return nil, err
		}
	}

	if err := conn.Bind(ldapConfig.SearchDN, ldapAdminPassword); err != nil {
		conn.Close()
		return nil, err
	}

	return conn, nil
}

func releaseConnection(conn *ldap.Conn) {
	// Re-bind to the user we can run queries with
	if err := conn.Bind(ldapConfig.SearchDN, ldapAdminPassword); err != nil {
		conn.Close()
		log.Printf("ldap error: %s", err.Error())
	}

	ldapConnectionsLock.Lock()
	defer ldapConnectionsLock.Unlock()

	n := len(ldapConnections)
	if n > 2 {
		conn.Close()
		return
	}

	ldapConnections = append(ldapConnections, conn)
}

func loginViaLdap(user *User, password string) error {
	l, err := getLdapConnection()
	if err != nil {
		return err
	}
	defer releaseConnection(l)

	userDn := strings.Replace(ldapConfig.UserBind, "{username}", user.Username, -1)
	if err := l.Bind(userDn, password); err != nil {
		return err
	}

	user.ViaLdap = true
	return nil
}

// Delete users where user.ldap is 1 and that do not show up in the ldap search results.
// Add users to the users table that are new in the ldap search results.
func SyncWithLDAP(db *sqlx.DB) error {
	if !ldapAuthEnabled {
		return errors.New("ldap not enabled")
	}

	const IN_DB int = 1
	const IN_LDAP int = 2
	const IN_BOTH int = 3

	users := map[string]int{}
	rows, err := db.Query(`SELECT username FROM user WHERE user.ldap = 1`)
	if err != nil {
		return err
	}

	for rows.Next() {
		var username string
		if err := rows.Scan(&username); err != nil {
			return err
		}

		users[username] = IN_DB
	}

	l, err := getLdapConnection()
	if err != nil {
		return err
	}
	defer releaseConnection(l)

	ldapResults, err := l.Search(ldap.NewSearchRequest(
		ldapConfig.UserBase, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
		ldapConfig.UserFilter, []string{"dn", "uid", "gecos"}, nil))
	if err != nil {
		return err
	}

	newnames := map[string]string{}
	for _, entry := range ldapResults.Entries {
		username := entry.GetAttributeValue("uid")
		if username == "" {
			return errors.New("no attribute 'uid'")
		}

		_, ok := users[username]
		if !ok {
			users[username] = IN_LDAP
			newnames[username] = entry.GetAttributeValue("gecos")
		} else {
			users[username] = IN_BOTH
		}
	}

	for username, where := range users {
		if where == IN_DB {
			fmt.Printf("ldap-sync: remove '%s' (does not show up in LDAP anymore)\n", username)
			if _, err := db.Exec(`DELETE FROM user WHERE user.username = ?`, username); err != nil {
				return err
			}
		} else if where == IN_LDAP {
			name := newnames[username]
			fmt.Printf("ldap-sync: add '%s' (name: '%s', roles: [], ldap: true)\n", username, name)
			if _, err := db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
				username, 1, name, "[]"); err != nil {
				return err
			}
		}
	}

	return nil
}