cc-backend/internal/auth/ldap.go

236 lines
5.8 KiB
Go
Raw Normal View History

// Copyright (C) 2023 NHR@FAU, University Erlangen-Nuremberg.
// All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
package auth
import (
"errors"
2023-06-15 12:00:45 +02:00
"fmt"
2022-07-07 14:08:37 +02:00
"net/http"
"os"
"strings"
"time"
2022-06-21 17:52:36 +02:00
"github.com/ClusterCockpit/cc-backend/pkg/log"
"github.com/ClusterCockpit/cc-backend/pkg/schema"
"github.com/go-ldap/ldap/v3"
)
type LdapAuthenticator struct {
2022-07-07 14:08:37 +02:00
auth *Authentication
config *schema.LdapConfig
2022-07-07 14:08:37 +02:00
syncPassword string
}
var _ Authenticator = (*LdapAuthenticator)(nil)
func (la *LdapAuthenticator) Init(
auth *Authentication,
conf interface{}) error {
2022-07-07 14:08:37 +02:00
la.auth = auth
la.config = conf.(*schema.LdapConfig)
2022-07-07 14:08:37 +02:00
la.syncPassword = os.Getenv("LDAP_ADMIN_PASSWORD")
if la.syncPassword == "" {
log.Warn("environment variable 'LDAP_ADMIN_PASSWORD' not set (ldap sync will not work)")
}
2022-07-25 17:27:42 +02:00
if la.config != nil && la.config.SyncInterval != "" {
2022-07-07 14:08:37 +02:00
interval, err := time.ParseDuration(la.config.SyncInterval)
if err != nil {
log.Warnf("Could not parse duration for sync interval: %v", la.config.SyncInterval)
return err
}
if interval == 0 {
2023-02-15 11:50:51 +01:00
log.Info("Sync interval is zero")
return nil
}
go func() {
ticker := time.NewTicker(interval)
for t := range ticker.C {
log.Printf("sync started at %s", t.Format(time.RFC3339))
2022-07-07 14:08:37 +02:00
if err := la.Sync(); err != nil {
log.Errorf("sync failed: %s", err.Error())
}
log.Print("sync done")
}
}()
2023-08-16 09:19:41 +02:00
} else {
return fmt.Errorf("missing LDAP configuration")
}
return nil
}
func (la *LdapAuthenticator) CanLogin(
user *User,
username string,
rw http.ResponseWriter,
r *http.Request) bool {
if user != nil && user.AuthSource == AuthViaLDAP {
return true
} else {
2023-08-16 09:19:41 +02:00
if la.config != nil && la.config.SyncUserOnLogin {
l, err := la.getLdapConnection(true)
if err != nil {
log.Error("LDAP connection error")
}
// Search for the given username
searchRequest := ldap.NewSearchRequest(
la.config.UserBase,
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
fmt.Sprintf("(%s(uid=%s))", la.config.UserFilter, username),
[]string{"dn", "uid", "gecos"}, nil)
sr, err := l.Search(searchRequest)
if err != nil {
log.Warn(err)
return false
}
if len(sr.Entries) != 1 {
log.Warn("User does not exist or too many entries returned")
return false
}
entry := sr.Entries[0]
name := entry.GetAttributeValue("gecos")
if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
username, 1, name, "[\""+GetRoleString(RoleUser)+"\"]"); err != nil {
log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
return false
}
return true
}
}
return false
}
func (la *LdapAuthenticator) Login(
user *User,
rw http.ResponseWriter,
r *http.Request) (*User, error) {
2022-07-07 14:08:37 +02:00
l, err := la.getLdapConnection(false)
if err != nil {
log.Warn("Error while getting ldap connection")
2022-07-07 14:08:37 +02:00
return nil, err
}
2022-02-14 14:22:44 +01:00
defer l.Close()
2022-07-07 14:08:37 +02:00
userDn := strings.Replace(la.config.UserBind, "{username}", user.Username, -1)
if err := l.Bind(userDn, r.FormValue("password")); err != nil {
2023-06-15 12:00:45 +02:00
log.Errorf("AUTH/LOCAL > Authentication for user %s failed: %v", user.Username, err)
return nil, fmt.Errorf("AUTH/LDAP > Authentication failed")
}
2022-07-07 14:08:37 +02:00
return user, nil
}
func (la *LdapAuthenticator) Sync() error {
const IN_DB int = 1
const IN_LDAP int = 2
const IN_BOTH int = 3
users := map[string]int{}
2022-07-07 14:08:37 +02:00
rows, err := la.auth.db.Query(`SELECT username FROM user WHERE user.ldap = 1`)
if err != nil {
log.Warn("Error while querying LDAP users")
return err
}
for rows.Next() {
var username string
if err := rows.Scan(&username); err != nil {
log.Warnf("Error while scanning for user '%s'", username)
return err
}
users[username] = IN_DB
}
2022-07-07 14:08:37 +02:00
l, err := la.getLdapConnection(true)
if err != nil {
log.Error("LDAP connection error")
return err
}
2022-02-14 14:22:44 +01:00
defer l.Close()
ldapResults, err := l.Search(ldap.NewSearchRequest(
la.config.UserBase,
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
fmt.Sprintf("(%s(uid=%s))", la.config.UserFilter, "*"),
[]string{"dn", "uid", "gecos"}, nil))
if err != nil {
log.Warn("LDAP search error")
return err
}
newnames := map[string]string{}
for _, entry := range ldapResults.Entries {
username := entry.GetAttributeValue("uid")
if username == "" {
return errors.New("no attribute 'uid'")
}
_, ok := users[username]
if !ok {
users[username] = IN_LDAP
newnames[username] = entry.GetAttributeValue("gecos")
} else {
users[username] = IN_BOTH
}
}
for username, where := range users {
2022-07-07 14:08:37 +02:00
if where == IN_DB && la.config.SyncDelOldUsers {
log.Debugf("sync: remove %v (does not show up in LDAP anymore)", username)
2022-07-07 14:08:37 +02:00
if _, err := la.auth.db.Exec(`DELETE FROM user WHERE user.username = ?`, username); err != nil {
log.Errorf("User '%s' not in LDAP anymore: Delete from DB failed", username)
return err
}
} else if where == IN_LDAP {
name := newnames[username]
log.Debugf("sync: add %v (name: %v, roles: [user], ldap: true)", username, name)
2022-07-07 14:08:37 +02:00
if _, err := la.auth.db.Exec(`INSERT INTO user (username, ldap, name, roles) VALUES (?, ?, ?, ?)`,
username, 1, name, "[\""+GetRoleString(RoleUser)+"\"]"); err != nil {
log.Errorf("User '%s' new in LDAP: Insert into DB failed", username)
return err
}
}
}
return nil
}
2022-07-07 14:08:37 +02:00
// TODO: Add a connection pool or something like
// that so that connections can be reused/cached.
func (la *LdapAuthenticator) getLdapConnection(admin bool) (*ldap.Conn, error) {
2022-07-07 14:08:37 +02:00
conn, err := ldap.DialURL(la.config.Url)
if err != nil {
log.Warn("LDAP URL dial failed")
2022-07-07 14:08:37 +02:00
return nil, err
}
if admin {
if err := conn.Bind(la.config.SearchDN, la.syncPassword); err != nil {
conn.Close()
log.Warn("LDAP connection bind failed")
2022-07-07 14:08:37 +02:00
return nil, err
}
}
return conn, nil
}