gsadmin/glauth
1
0
Fork 0
mirror of https://github.com/glauth/glauth.git synced 2026-10-24 21:23:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Variable "unixid" is now respectively "UIDNumber" and "GIDNumber" for… (#201)

Browse Source
This commit is contained in:
Chris F Ravenscroft
2021-08-02 17:20:42 -07:00
committed by GitHub
parent 53ddd3c4f4
commit 10b0191818
13 changed files with 116 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -3
View File
@@ -84,18 +84,18 @@ Here's a sample config wth hardcoded users and groups:
baseDN = "dc=glauth,dc=com"
[[users]]
name = "hackers"
unixid = 5001
uidnumber = 5001
primarygroup = 5501
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
sshkeys = [ "ssh-dss AAAAB3..." ]
[[users]]
name = "uberhackers"
unixid = 5006
uidnumber = 5006
primarygroup = 5501
passbcrypt = "243261243130244B62463462656F7265504F762E794F324957746D656541326B4B46596275674A79336A476845764B616D65446169784E41384F4432" # dogood
[[groups]]
name = "superheros"
unixid = 5501
gidnumber = 5501
```
To create the password SHA hash, use this command: `echo -n "mysecret" | openssl dgst -sha256`
Instead of a local configuration file, GLAuth can fetch its configuration from S3. This is an easy way to ensure redundant GLAuth servers are always in-sync.
glauth.go
+15
View File
@@ -390,6 +390,21 @@ func validateConfig(cfg config.Config) (*config.Config, error) {
return &cfg, fmt.Errorf("invalid backend %s - must be 'config', 'ldap', 'owncloud' or 'plugin'", cfg.Backends[i].Datastore)
}
}
// TODO: remove after deprecating UnixID on User and Group
for _, user := range cfg.Users {
if user.UnixID != 0 {
user.UIDNumber = user.UnixID
log.V(2).Info(fmt.Sprintf("User '%s': 'unixid' is deprecated - please move to 'uidnumber' as per documentation", user.Name))
}
}
for _, group := range cfg.Groups {
if group.UnixID != 0 {
group.GIDNumber = group.UnixID
log.V(2).Info(fmt.Sprintf("Group '%s': 'unixid' is deprecated - please move to 'gidnumber' as per documentation", group.Name))
}
}
return &cfg, nil
}
pkg/config/config.go
+4 -2
View File
@@ -59,7 +59,8 @@ type User struct {
OTPSecret string
Yubikey string
Disabled bool
UnixID int
UnixID int // TODO: remove after deprecating UnixID on User and Group
UIDNumber int
Mail string
LoginShell string
GivenName string
@@ -68,7 +69,8 @@ type User struct {
}
type Group struct {
Name string
UnixID int
UnixID int // TODO: remove after deprecating UnixID on User and Group
GIDNumber int
IncludeGroups []int
}
type Config struct {
pkg/handler/config.go
+12 -12
View File
@@ -101,8 +101,8 @@ func (h configHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resultC
return ldap.LDAPResultInvalidCredentials, nil
}
// validate group membership
if user.PrimaryGroup != group.UnixID {
h.log.V(2).Info("primary group mismatch", "username", userName, "primarygroup", user.PrimaryGroup, "groupid", group.UnixID)
if user.PrimaryGroup != group.GIDNumber {
h.log.V(2).Info("primary group mismatch", "username", userName, "primarygroup", user.PrimaryGroup, "groupid", group.GIDNumber)
return ldap.LDAPResultInvalidCredentials, nil
}
@@ -322,10 +322,10 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn
attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{g.Name}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{g.Name}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s", g.Name)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.UnixID)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.GIDNumber)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "uniqueMember", Values: h.getGroupMembers(g.UnixID)})
attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: h.getGroupMemberIDs(g.UnixID)})
attrs = append(attrs, &ldap.EntryAttribute{Name: "uniqueMember", Values: h.getGroupMembers(g.GIDNumber)})
attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: h.getGroupMemberIDs(g.GIDNumber)})
dn := fmt.Sprintf("cn=%s,%s=groups,%s", g.Name, h.backend.GroupFormat, h.backend.BaseDN)
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
}
@@ -344,7 +344,7 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn
}
attrs = append(attrs, &ldap.EntryAttribute{Name: "ou", Values: []string{h.getGroupName(u.PrimaryGroup)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "uidNumber", Values: []string{fmt.Sprintf("%d", u.UnixID)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "uidNumber", Values: []string{fmt.Sprintf("%d", u.UIDNumber)}})
if u.Disabled {
attrs = append(attrs, &ldap.EntryAttribute{Name: "accountStatus", Values: []string{"inactive"}})
@@ -445,7 +445,7 @@ func (h configHandler) getGroupMembers(gid int) []string {
}
for _, g := range h.cfg.Groups {
if gid == g.UnixID {
if gid == g.GIDNumber {
for _, includegroupid := range g.IncludeGroups {
if includegroupid != gid {
includegroupmembers := h.getGroupMembers(includegroupid)
@@ -483,7 +483,7 @@ func (h configHandler) getGroupMemberIDs(gid int) []string {
}
for _, g := range h.cfg.Groups {
if gid == g.UnixID {
if gid == g.GIDNumber {
for _, includegroupid := range g.IncludeGroups {
if includegroupid == gid {
h.log.V(2).Info("Ignoring myself as included group", "groupid", includegroupid)
@@ -513,14 +513,14 @@ func (h configHandler) getGroupDNs(gids []int) []string {
groups := make(map[string]bool)
for _, gid := range gids {
for _, g := range h.cfg.Groups {
if g.UnixID == gid {
if g.GIDNumber == gid {
dn := fmt.Sprintf("cn=%s,%s=groups,%s", g.Name, h.backend.GroupFormat, h.backend.BaseDN)
groups[dn] = true
}
for _, includegroupid := range g.IncludeGroups {
if includegroupid == gid && g.UnixID != gid {
includegroupdns := h.getGroupDNs([]int{g.UnixID})
if includegroupid == gid && g.GIDNumber != gid {
includegroupdns := h.getGroupDNs([]int{g.GIDNumber})
for _, includegroupdn := range includegroupdns {
groups[includegroupdn] = true
@@ -542,7 +542,7 @@ func (h configHandler) getGroupDNs(gids []int) []string {
func (h configHandler) getGroupName(gid int) string {
for _, g := range h.cfg.Groups {
if g.UnixID == gid {
if g.GIDNumber == gid {
return g.Name
}
}
pkg/handler/owncloud.go
+1 -1
View File
@@ -123,7 +123,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
attrs := []*ldap.EntryAttribute{}
attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{*g.ID}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *g.ID)}})
// attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.UnixID)}})
// attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}})
if g.Members != nil {
members := make([]string, len(g.Members))
pkg/plugins/README.md
+20 -20
View File
@@ -42,70 +42,70 @@ Tables:
Here is how to insert example data using your database's REPL (more detailed information can be found in pkg/plugins/sample-database.cfg)
```sql
INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('hackers', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO groups(name, unixid) VALUES('superheros', 5501);
INSERT INTO groups(name, unixid) VALUES('crusaders', 5502);
INSERT INTO groups(name, unixid) VALUES('civilians', 5503);
INSERT INTO groups(name, unixid) VALUES('caped', 5504);
INSERT INTO groups(name, unixid) VALUES('lovesailing', 5505);
INSERT INTO groups(name, unixid) VALUES('smoker', 5506);
INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('hackers', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO groups(name, gidnumber) VALUES('superheros', 5501);
INSERT INTO groups(name, gidnumber) VALUES('crusaders', 5502);
INSERT INTO groups(name, gidnumber) VALUES('civilians', 5503);
INSERT INTO groups(name, gidnumber) VALUES('caped', 5504);
INSERT INTO groups(name, gidnumber) VALUES('lovesailing', 5505);
INSERT INTO groups(name, gidnumber) VALUES('smoker', 5506);
INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5503, 5501);
INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5502);
INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5501);
INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('user1', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('user2', 5002, 5502, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('user3', 5003, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO users(name, unixid, primarygroup, passsha256, othergroups) VALUES('user4', 5004, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a', '5505,5506');
INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('user1', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('user2', 5002, 5502, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('user3', 5003, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
INSERT INTO users(name, uidnumber, primarygroup, passsha256, othergroups) VALUES('user4', 5004, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a', '5505,5506');
```
This should be equivalent to this configuration:
```text
[[users]]
name = "hackers"
unixid = 5001
uidnumber = 5001
primarygroup = 5501
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
[[users]]
name = "user1"
unixid = 5001
uidnumber = 5001
primarygroup = 5501
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
[[users]]
name = "user2"
unixid = 5002
uidnumber = 5002
primarygroup = 5502
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
[[users]]
name = "user3"
unixid = 5003
uidnumber = 5003
primarygroup = 5504
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
[[users]]
name = "user4"
unixid = 5003
uidnumber = 5003
primarygroup = 5504
othergroups = [5505, 5506]
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
[[groups]]
name = "superheros"
unixid = 5501
gidnumber = 5501
[[groups]]
name = "crusaders"
unixid = 5502
gidnumber = 5502
[[groups]]
name = "civilians"
unixid = 5503
gidnumber = 5503
includegroups = [ 5501 ]
[[groups]]
name = "caped"
unixid = 5504
gidnumber = 5504
includegroups = [ 5502, 5501 ]
```
and LDAP should return these `memberOf` values:
pkg/plugins/basesqlhandler.go
+28 -28
View File
@@ -110,9 +110,9 @@ func (h databaseHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resul
// find the user
user := config.User{}
err = h.database.cnx.QueryRow(fmt.Sprintf(`
SELECT u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey
SELECT u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey
FROM users u WHERE lower(u.name)=%s`, h.sqlBackend.GetPrepareSymbol()), userName).Scan(
&user.UnixID, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey)
&user.UIDNumber, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey)
if err != nil {
h.log.V(2).Info(fmt.Sprintf("Bind Error: User %s not found.", userName))
return ldap.LDAPResultInvalidCredentials, nil
@@ -120,14 +120,14 @@ func (h databaseHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resul
// find the group
group := config.Group{}
err = h.database.cnx.QueryRow(fmt.Sprintf(`
SELECT g.unixid FROM groups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan(
&group.UnixID)
SELECT g.gidnumber FROM groups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan(
&group.GIDNumber)
if err != nil {
h.log.V(2).Info(fmt.Sprintf("Bind Error: Group %s not found.", userName))
return ldap.LDAPResultInvalidCredentials, nil
}
// validate group membership
if user.PrimaryGroup != group.UnixID {
if user.PrimaryGroup != group.GIDNumber {
h.log.V(2).Info(fmt.Sprintf("Bind Error: User %s primary group is not %s.", userName, groupName))
return ldap.LDAPResultInvalidCredentials, nil
}
@@ -273,7 +273,7 @@ func (h databaseHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
}
rows, err := h.database.cnx.Query(`
SELECT u.name,u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups,u.givenname,u.sn,u.mail,u.loginshell,u.homedirectory,u.disabled
SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups,u.givenname,u.sn,u.mail,u.loginshell,u.homedirectory,u.disabled
FROM users u`)
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: Unable to retrieve data [%s]", err.Error())
@@ -284,7 +284,7 @@ func (h databaseHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
var disabled int
u := config.User{}
for rows.Next() {
err := rows.Scan(&u.Name, &u.UnixID, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups, &u.GivenName, &u.SN, &u.Mail, &u.LoginShell, &u.Homedir, &disabled)
err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups, &u.GivenName, &u.SN, &u.Mail, &u.LoginShell, &u.Homedir, &disabled)
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: Unable to retrieve data [%s]", err.Error())
}
@@ -319,9 +319,9 @@ func (h databaseHandler) FindUser(userName string) (f bool, u config.User, err e
found := false
err = h.database.cnx.QueryRow(fmt.Sprintf(`
SELECT u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey
SELECT u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey
FROM users u WHERE lower(u.name)=%s`, h.sqlBackend.GetPrepareSymbol()), userName).Scan(
&user.UnixID, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey)
&user.UIDNumber, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey)
if err == nil {
found = true
}
@@ -360,10 +360,10 @@ func (h databaseHandler) commaListToTable(commaList string) []int {
func (h databaseHandler) memoizeGroups() ([]config.Group, error) {
workMemGroups := make([]*config.Group, 0)
rows, err := h.database.cnx.Query(`
SELECT g1.name,g1.unixid,ig.includegroupid
SELECT g1.name,g1.gidnumber,ig.includegroupid
FROM groups g1
LEFT JOIN includegroups ig ON g1.unixid=ig.parentgroupid
LEFT JOIN groups g2 ON ig.includegroupid=g2.unixid`)
LEFT JOIN includegroups ig ON g1.gidnumber=ig.parentgroupid
LEFT JOIN groups g2 ON ig.includegroupid=g2.gidnumber`)
if err != nil {
return nil, errors.New("Unable to memoize groups list")
}
@@ -381,7 +381,7 @@ func (h databaseHandler) memoizeGroups() ([]config.Group, error) {
}
if recentId != groupId {
recentId = groupId
g := config.Group{Name: groupName, UnixID: groupId}
g := config.Group{Name: groupName, GIDNumber: groupId}
pg = &g // To manipulate end of slice
workMemGroups = append(workMemGroups, &g)
}
@@ -391,7 +391,7 @@ func (h databaseHandler) memoizeGroups() ([]config.Group, error) {
}
memGroups := make([]config.Group, len(workMemGroups))
for i, v := range workMemGroups {
memGroups[i] = config.Group{Name: v.Name, UnixID: v.UnixID, IncludeGroups: v.IncludeGroups}
memGroups[i] = config.Group{Name: v.Name, GIDNumber: v.GIDNumber, IncludeGroups: v.IncludeGroups}
}
return memGroups, nil
}
@@ -401,7 +401,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string {
members := make(map[string]bool)
rows, err := h.database.cnx.Query(`
SELECT u.name,u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups
SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups
FROM users u WHERE lower(u.name)=?`,
)
if err != nil {
@@ -413,7 +413,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string {
var otherGroups string
u := config.User{}
for rows.Next() {
err := rows.Scan(&u.Name, &u.UnixID, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups)
err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups)
if err != nil {
return []string{}
}
@@ -432,7 +432,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string {
}
for _, g := range h.MemGroups {
if gid == g.UnixID {
if gid == g.GIDNumber {
for _, includegroupid := range g.IncludeGroups {
if includegroupid != gid {
includegroupmembers := h.getGroupMembers(includegroupid)
@@ -459,7 +459,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string {
func (h databaseHandler) getGroupMemberIDs(gid int) []string {
members := make(map[string]bool)
rows, err := h.database.cnx.Query(`
SELECT u.name,u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups
SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups
FROM users u`)
if err != nil {
// Silent fail... for now
@@ -470,7 +470,7 @@ func (h databaseHandler) getGroupMemberIDs(gid int) []string {
var otherGroups string
u := config.User{}
for rows.Next() {
err := rows.Scan(&u.Name, &u.UnixID, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups)
err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups)
if err != nil {
return []string{}
}
@@ -487,7 +487,7 @@ func (h databaseHandler) getGroupMemberIDs(gid int) []string {
}
for _, g := range h.MemGroups {
if gid == g.UnixID {
if gid == g.GIDNumber {
for _, includegroupid := range g.IncludeGroups {
if includegroupid == gid {
h.log.V(3).Info(fmt.Sprintf("Group: %d - Ignoring myself as included group", includegroupid))
@@ -517,14 +517,14 @@ func (h databaseHandler) getGroupDNs(gids []int) []string {
groups := make(map[string]bool)
for _, gid := range gids {
for _, g := range h.MemGroups {
if g.UnixID == gid {
if g.GIDNumber == gid {
dn := fmt.Sprintf("cn=%s,ou=groups,%s", g.Name, h.backend.BaseDN)
groups[dn] = true
}
for _, includegroupid := range g.IncludeGroups {
if includegroupid == gid && g.UnixID != gid {
includegroupdns := h.getGroupDNs([]int{g.UnixID})
if includegroupid == gid && g.GIDNumber != gid {
includegroupdns := h.getGroupDNs([]int{g.GIDNumber})
for _, includegroupdn := range includegroupdns {
groups[includegroupdn] = true
@@ -547,7 +547,7 @@ func (h databaseHandler) getGroupDNs(gids []int) []string {
// Invoked for every user being returned from our database
func (h databaseHandler) getGroupName(gid int) string {
for _, g := range h.MemGroups {
if g.UnixID == gid {
if g.GIDNumber == gid {
return g.Name
}
}
@@ -559,10 +559,10 @@ func (h databaseHandler) getGroup(g config.Group) *ldap.Entry {
attrs := []*ldap.EntryAttribute{}
attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{g.Name}})
attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", g.Name)}})
attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.UnixID)}})
attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}})
attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixGroup"}})
attrs = append(attrs, &ldap.EntryAttribute{"uniqueMember", h.getGroupMembers(g.UnixID)})
attrs = append(attrs, &ldap.EntryAttribute{"memberUid", h.getGroupMemberIDs(g.UnixID)})
attrs = append(attrs, &ldap.EntryAttribute{"uniqueMember", h.getGroupMembers(g.GIDNumber)})
attrs = append(attrs, &ldap.EntryAttribute{"memberUid", h.getGroupMemberIDs(g.GIDNumber)})
dn := fmt.Sprintf("cn=%s,ou=groups,%s", g.Name, h.backend.BaseDN)
return &ldap.Entry{dn, attrs}
}
@@ -581,7 +581,7 @@ func (h databaseHandler) getAccount(u config.User) *ldap.Entry {
}
attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}})
attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UnixID)}})
attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UIDNumber)}})
if u.Disabled {
attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"inactive"}})
pkg/plugins/mysql.go
+2 -2
View File
@@ -30,7 +30,7 @@ func (b MysqlBackend) CreateSchema(db *sql.DB) {
CREATE TABLE IF NOT EXISTS users (
id INTEGER AUTO_INCREMENT PRIMARY KEY,
name VARCHAR(64) NOT NULL,
unixid INTEGER NOT NULL,
uidnumber INTEGER NOT NULL,
primarygroup INTEGER NOT NULL,
othergroups VARCHAR(1024) DEFAULT '',
givenname VARCHAR(64) DEFAULT '',
@@ -47,7 +47,7 @@ CREATE TABLE IF NOT EXISTS users (
statement.Exec()
statement, _ = db.Prepare("CREATE UNIQUE INDEX idx_user_name on users(name)")
statement.Exec()
statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(64) NOT NULL, unixid INTEGER NOT NULL)")
statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(64) NOT NULL, gidnumber INTEGER NOT NULL)")
statement.Exec()
statement, _ = db.Prepare("CREATE UNIQUE INDEX idx_group_name on groups(name)")
statement.Exec()
pkg/plugins/postgres.go
+2 -2
View File
@@ -30,7 +30,7 @@ func (b PostgresBackend) CreateSchema(db *sql.DB) {
CREATE TABLE IF NOT EXISTS users (
id SERIAL PRIMARY KEY,
name TEXT NOT NULL,
unixid INTEGER NOT NULL,
uidnumber INTEGER NOT NULL,
primarygroup INTEGER NOT NULL,
othergroups TEXT DEFAULT '',
givenname TEXT DEFAULT '',
@@ -47,7 +47,7 @@ CREATE TABLE IF NOT EXISTS users (
statement.Exec()
statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_user_name on users(name)")
statement.Exec()
statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id SERIAL PRIMARY KEY, name TEXT NOT NULL, unixid INTEGER NOT NULL)")
statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id SERIAL PRIMARY KEY, name TEXT NOT NULL, gidnumber INTEGER NOT NULL)")
statement.Exec()
statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_group_name on groups(name)")
statement.Exec()
pkg/plugins/sqlite.go
+2 -2
View File
@@ -30,7 +30,7 @@ func (b SqliteBackend) CreateSchema(db *sql.DB) {
CREATE TABLE IF NOT EXISTS users (
id INTEGER PRIMARY KEY,
name TEXT NOT NULL,
unixid INTEGER NOT NULL,
uidnumber INTEGER NOT NULL,
primarygroup INTEGER NOT NULL,
othergroups TEXT DEFAULT '',
givenname TEXT DEFAULT '',
@@ -47,7 +47,7 @@ CREATE TABLE IF NOT EXISTS users (
statement.Exec()
statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_user_name on users(name)")
statement.Exec()
statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER PRIMARY KEY, name TEXT NOT NULL, unixid INTEGER NOT NULL)")
statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER PRIMARY KEY, name TEXT NOT NULL, gidnumber INTEGER NOT NULL)")
statement.Exec()
statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_group_name on groups(name)")
statement.Exec()
sample-simple.cfg
+8 -8
View File
@@ -49,7 +49,7 @@ debug = true
# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256
[[users]]
name = "hackers"
unixid = 5001
uidnumber = 5001
primarygroup = 5501
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
@@ -59,7 +59,7 @@ debug = true
givenname="John"
sn="Doe"
mail = "jdoe@example.com"
unixid = 5002
uidnumber = 5002
primarygroup = 5501
loginShell = "/bin/sh"
homeDir = "/root"
@@ -73,14 +73,14 @@ debug = true
[[users]]
name = "serviceuser"
unixid = 5003
uidnumber = 5003
primarygroup = 5502
passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
# Test user showing 2 factor auth authentication
[[users]]
name = "otpuser"
unixid = 5004
uidnumber = 5004
primarygroup = 5501
passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
@@ -88,7 +88,7 @@ debug = true
[[users]]
name = "uberhackers"
unixid = 5005
uidnumber = 5005
primarygroup = 5501
# bcrypt format: hex($2y$2^<number of rounds>$<salt>$<hash>)
passappbcrypt = [
@@ -103,15 +103,15 @@ debug = true
# The groups section contains a hardcoded list of valid users.
[[groups]]
name = "superheros"
unixid = 5501
gidnumber = 5501
[[groups]]
name = "svcaccts"
unixid = 5502
gidnumber = 5502
[[groups]]
name = "vpn"
unixid = 5503
gidnumber = 5503
includegroups = [ 5501 ]
#################
scripts/docker/default-config.cfg
+5 -5
View File
@@ -28,7 +28,7 @@ debug = true
# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256
[[users]]
name = "hackers"
unixid = 5001
uidnumber = 5001
primarygroup = 5501
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
@@ -38,7 +38,7 @@ debug = true
givenname="John"
sn="Doe"
mail = "jdoe@example.com"
unixid = 5002
uidnumber = 5002
primarygroup = 5501
loginShell = "/bin/sh"
homeDir = "/root"
@@ -48,7 +48,7 @@ debug = true
[[users]]
name = "serviceuser"
unixid = 5003
uidnumber = 5003
primarygroup = 5502
passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
@@ -56,11 +56,11 @@ debug = true
# The groups section contains a hardcoded list of valid users.
[[groups]]
name = "superheros"
unixid = 5501
gidnumber = 5501
[[groups]]
name = "svcaccts"
unixid = 5502
gidnumber = 5502
#################
# Enable and configure the optional REST API here.
scripts/travis/test-config.cfg
+14 -14
View File
@@ -28,7 +28,7 @@ debug = true
# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256
[[users]]
name = "hackers"
unixid = 5001
uidnumber = 5001
primarygroup = 5501
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
@@ -38,7 +38,7 @@ debug = true
givenname="John"
sn="Doe"
mail = "jdoe@example.com"
unixid = 5002
uidnumber = 5002
primarygroup = 5501
loginShell = "/bin/sh"
homeDir = "/root"
@@ -51,7 +51,7 @@ debug = true
givenname="James"
sn="Doe"
mail = "jdoe2@example.com"
unixid = 5003
uidnumber = 5003
primarygroup = 5501
loginShell = "/bin/sh"
otherGroups = [5505,5507]
@@ -65,7 +65,7 @@ debug = true
givenname="Alex"
sn="Doe"
mail = "adoe@example.com"
unixid = 5004
uidnumber = 5004
primarygroup = 5501
loginShell = "/bin/sh"
otherGroups = [5505,5507]
@@ -80,7 +80,7 @@ debug = true
givenname="Jack"
sn="Doe"
mail = "jdoe3@example.com"
unixid = 5005
uidnumber = 5005
primarygroup = 5501
loginShell = "/bin/sh"
otherGroups = [5505,5507]
@@ -97,7 +97,7 @@ debug = true
givenname="Sarah"
sn="Doe"
mail = "sdoe@example.com"
unixid = 5006
uidnumber = 5006
primarygroup = 5501
loginShell = "/bin/sh"
otherGroups = [5505,5507]
@@ -112,7 +112,7 @@ debug = true
[[users]]
name = "serviceuser"
unixid = 5003
uidnumber = 5003
primarygroup = 5502
passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
@@ -120,35 +120,35 @@ debug = true
# The groups section contains a hardcoded list of valid users.
[[groups]]
name = "superheros"
unixid = 5501
gidnumber = 5501
[[groups]]
name = "svcaccts"
unixid = 5502
gidnumber = 5502
[[groups]]
name = "vpnaccess"
unixid = 5503
gidnumber = 5503
includegroups = [ 5501 ]
[[groups]]
name = "allaccs"
unixid = 5504
gidnumber = 5504
includegroups = [ 5501, 5502 ]
[[groups]]
name = "mailadmin"
unixid = 5505
gidnumber = 5505
[[groups]]
name = "webmail"
unixid = 5506
gidnumber = 5506
[[groups]]
name = "fulltime"
unixid = 5507
gidnumber = 5507
#################
# Enable and configure the optional REST API here.