From 10b0191818ebcf1282981499fd79935fc16759bb Mon Sep 17 00:00:00 2001 From: Chris F Ravenscroft Date: Mon, 2 Aug 2021 17:20:42 -0700 Subject: [PATCH] =?UTF-8?q?Variable=20"unixid"=20is=20now=20respectively?= =?UTF-8?q?=20"UIDNumber"=20and=20"GIDNumber"=20for=E2=80=A6=20(#201)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 6 ++-- glauth.go | 15 +++++++++ pkg/config/config.go | 6 ++-- pkg/handler/config.go | 24 ++++++------- pkg/handler/owncloud.go | 2 +- pkg/plugins/README.md | 40 +++++++++++----------- pkg/plugins/basesqlhandler.go | 56 +++++++++++++++---------------- pkg/plugins/mysql.go | 4 +-- pkg/plugins/postgres.go | 4 +-- pkg/plugins/sqlite.go | 4 +-- sample-simple.cfg | 16 ++++----- scripts/docker/default-config.cfg | 10 +++--- scripts/travis/test-config.cfg | 28 ++++++++-------- 13 files changed, 116 insertions(+), 99 deletions(-) diff --git a/README.md b/README.md index d5adfa4..0fd0008 100644 --- a/README.md +++ b/README.md @@ -84,18 +84,18 @@ Here's a sample config wth hardcoded users and groups: baseDN = "dc=glauth,dc=com" [[users]] name = "hackers" - unixid = 5001 + uidnumber = 5001 primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood sshkeys = [ "ssh-dss AAAAB3..." ] [[users]] name = "uberhackers" - unixid = 5006 + uidnumber = 5006 primarygroup = 5501 passbcrypt = "243261243130244B62463462656F7265504F762E794F324957746D656541326B4B46596275674A79336A476845764B616D65446169784E41384F4432" # dogood [[groups]] name = "superheros" - unixid = 5501 + gidnumber = 5501 ``` To create the password SHA hash, use this command: `echo -n "mysecret" | openssl dgst -sha256` Instead of a local configuration file, GLAuth can fetch its configuration from S3. This is an easy way to ensure redundant GLAuth servers are always in-sync. diff --git a/glauth.go b/glauth.go index a0a40f0..2e4f32b 100644 --- a/glauth.go +++ b/glauth.go @@ -390,6 +390,21 @@ func validateConfig(cfg config.Config) (*config.Config, error) { return &cfg, fmt.Errorf("invalid backend %s - must be 'config', 'ldap', 'owncloud' or 'plugin'", cfg.Backends[i].Datastore) } } + + // TODO: remove after deprecating UnixID on User and Group + for _, user := range cfg.Users { + if user.UnixID != 0 { + user.UIDNumber = user.UnixID + log.V(2).Info(fmt.Sprintf("User '%s': 'unixid' is deprecated - please move to 'uidnumber' as per documentation", user.Name)) + } + } + for _, group := range cfg.Groups { + if group.UnixID != 0 { + group.GIDNumber = group.UnixID + log.V(2).Info(fmt.Sprintf("Group '%s': 'unixid' is deprecated - please move to 'gidnumber' as per documentation", group.Name)) + } + } + return &cfg, nil } diff --git a/pkg/config/config.go b/pkg/config/config.go index 5af12e9..b119319 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -59,7 +59,8 @@ type User struct { OTPSecret string Yubikey string Disabled bool - UnixID int + UnixID int // TODO: remove after deprecating UnixID on User and Group + UIDNumber int Mail string LoginShell string GivenName string @@ -68,7 +69,8 @@ type User struct { } type Group struct { Name string - UnixID int + UnixID int // TODO: remove after deprecating UnixID on User and Group + GIDNumber int IncludeGroups []int } type Config struct { diff --git a/pkg/handler/config.go b/pkg/handler/config.go index 7fa84f3..86b6e51 100644 --- a/pkg/handler/config.go +++ b/pkg/handler/config.go @@ -101,8 +101,8 @@ func (h configHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resultC return ldap.LDAPResultInvalidCredentials, nil } // validate group membership - if user.PrimaryGroup != group.UnixID { - h.log.V(2).Info("primary group mismatch", "username", userName, "primarygroup", user.PrimaryGroup, "groupid", group.UnixID) + if user.PrimaryGroup != group.GIDNumber { + h.log.V(2).Info("primary group mismatch", "username", userName, "primarygroup", user.PrimaryGroup, "groupid", group.GIDNumber) return ldap.LDAPResultInvalidCredentials, nil } @@ -322,10 +322,10 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{g.Name}}) attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{g.Name}}) attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s", g.Name)}}) - attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.UnixID)}}) + attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.GIDNumber)}}) attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}}) - attrs = append(attrs, &ldap.EntryAttribute{Name: "uniqueMember", Values: h.getGroupMembers(g.UnixID)}) - attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: h.getGroupMemberIDs(g.UnixID)}) + attrs = append(attrs, &ldap.EntryAttribute{Name: "uniqueMember", Values: h.getGroupMembers(g.GIDNumber)}) + attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: h.getGroupMemberIDs(g.GIDNumber)}) dn := fmt.Sprintf("cn=%s,%s=groups,%s", g.Name, h.backend.GroupFormat, h.backend.BaseDN) entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs}) } @@ -344,7 +344,7 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn } attrs = append(attrs, &ldap.EntryAttribute{Name: "ou", Values: []string{h.getGroupName(u.PrimaryGroup)}}) - attrs = append(attrs, &ldap.EntryAttribute{Name: "uidNumber", Values: []string{fmt.Sprintf("%d", u.UnixID)}}) + attrs = append(attrs, &ldap.EntryAttribute{Name: "uidNumber", Values: []string{fmt.Sprintf("%d", u.UIDNumber)}}) if u.Disabled { attrs = append(attrs, &ldap.EntryAttribute{Name: "accountStatus", Values: []string{"inactive"}}) @@ -445,7 +445,7 @@ func (h configHandler) getGroupMembers(gid int) []string { } for _, g := range h.cfg.Groups { - if gid == g.UnixID { + if gid == g.GIDNumber { for _, includegroupid := range g.IncludeGroups { if includegroupid != gid { includegroupmembers := h.getGroupMembers(includegroupid) @@ -483,7 +483,7 @@ func (h configHandler) getGroupMemberIDs(gid int) []string { } for _, g := range h.cfg.Groups { - if gid == g.UnixID { + if gid == g.GIDNumber { for _, includegroupid := range g.IncludeGroups { if includegroupid == gid { h.log.V(2).Info("Ignoring myself as included group", "groupid", includegroupid) @@ -513,14 +513,14 @@ func (h configHandler) getGroupDNs(gids []int) []string { groups := make(map[string]bool) for _, gid := range gids { for _, g := range h.cfg.Groups { - if g.UnixID == gid { + if g.GIDNumber == gid { dn := fmt.Sprintf("cn=%s,%s=groups,%s", g.Name, h.backend.GroupFormat, h.backend.BaseDN) groups[dn] = true } for _, includegroupid := range g.IncludeGroups { - if includegroupid == gid && g.UnixID != gid { - includegroupdns := h.getGroupDNs([]int{g.UnixID}) + if includegroupid == gid && g.GIDNumber != gid { + includegroupdns := h.getGroupDNs([]int{g.GIDNumber}) for _, includegroupdn := range includegroupdns { groups[includegroupdn] = true @@ -542,7 +542,7 @@ func (h configHandler) getGroupDNs(gids []int) []string { func (h configHandler) getGroupName(gid int) string { for _, g := range h.cfg.Groups { - if g.UnixID == gid { + if g.GIDNumber == gid { return g.Name } } diff --git a/pkg/handler/owncloud.go b/pkg/handler/owncloud.go index 51f8802..ad81470 100644 --- a/pkg/handler/owncloud.go +++ b/pkg/handler/owncloud.go @@ -123,7 +123,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con attrs := []*ldap.EntryAttribute{} attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{*g.ID}}) attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *g.ID)}}) - // attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.UnixID)}}) + // attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}}) attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}}) if g.Members != nil { members := make([]string, len(g.Members)) diff --git a/pkg/plugins/README.md b/pkg/plugins/README.md index b935af4..ed87c1a 100644 --- a/pkg/plugins/README.md +++ b/pkg/plugins/README.md @@ -42,70 +42,70 @@ Tables: Here is how to insert example data using your database's REPL (more detailed information can be found in pkg/plugins/sample-database.cfg) ```sql -INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('hackers', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); -INSERT INTO groups(name, unixid) VALUES('superheros', 5501); -INSERT INTO groups(name, unixid) VALUES('crusaders', 5502); -INSERT INTO groups(name, unixid) VALUES('civilians', 5503); -INSERT INTO groups(name, unixid) VALUES('caped', 5504); -INSERT INTO groups(name, unixid) VALUES('lovesailing', 5505); -INSERT INTO groups(name, unixid) VALUES('smoker', 5506); +INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('hackers', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); +INSERT INTO groups(name, gidnumber) VALUES('superheros', 5501); +INSERT INTO groups(name, gidnumber) VALUES('crusaders', 5502); +INSERT INTO groups(name, gidnumber) VALUES('civilians', 5503); +INSERT INTO groups(name, gidnumber) VALUES('caped', 5504); +INSERT INTO groups(name, gidnumber) VALUES('lovesailing', 5505); +INSERT INTO groups(name, gidnumber) VALUES('smoker', 5506); INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5503, 5501); INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5502); INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5501); -INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('user1', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); -INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('user2', 5002, 5502, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); -INSERT INTO users(name, unixid, primarygroup, passsha256) VALUES('user3', 5003, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); -INSERT INTO users(name, unixid, primarygroup, passsha256, othergroups) VALUES('user4', 5004, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a', '5505,5506'); +INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('user1', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); +INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('user2', 5002, 5502, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); +INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('user3', 5003, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a'); +INSERT INTO users(name, uidnumber, primarygroup, passsha256, othergroups) VALUES('user4', 5004, 5504, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a', '5505,5506'); ``` This should be equivalent to this configuration: ```text [[users]] name = "hackers" - unixid = 5001 + uidnumber = 5001 primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood [[users]] name = "user1" - unixid = 5001 + uidnumber = 5001 primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood [[users]] name = "user2" - unixid = 5002 + uidnumber = 5002 primarygroup = 5502 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood [[users]] name = "user3" - unixid = 5003 + uidnumber = 5003 primarygroup = 5504 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood [[users]] name = "user4" - unixid = 5003 + uidnumber = 5003 primarygroup = 5504 othergroups = [5505, 5506] passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood [[groups]] name = "superheros" - unixid = 5501 + gidnumber = 5501 [[groups]] name = "crusaders" - unixid = 5502 + gidnumber = 5502 [[groups]] name = "civilians" - unixid = 5503 + gidnumber = 5503 includegroups = [ 5501 ] [[groups]] name = "caped" - unixid = 5504 + gidnumber = 5504 includegroups = [ 5502, 5501 ] ``` and LDAP should return these `memberOf` values: diff --git a/pkg/plugins/basesqlhandler.go b/pkg/plugins/basesqlhandler.go index 00084c4..0172eac 100644 --- a/pkg/plugins/basesqlhandler.go +++ b/pkg/plugins/basesqlhandler.go @@ -110,9 +110,9 @@ func (h databaseHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resul // find the user user := config.User{} err = h.database.cnx.QueryRow(fmt.Sprintf(` - SELECT u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey + SELECT u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey FROM users u WHERE lower(u.name)=%s`, h.sqlBackend.GetPrepareSymbol()), userName).Scan( - &user.UnixID, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey) + &user.UIDNumber, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey) if err != nil { h.log.V(2).Info(fmt.Sprintf("Bind Error: User %s not found.", userName)) return ldap.LDAPResultInvalidCredentials, nil @@ -120,14 +120,14 @@ func (h databaseHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resul // find the group group := config.Group{} err = h.database.cnx.QueryRow(fmt.Sprintf(` - SELECT g.unixid FROM groups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan( - &group.UnixID) + SELECT g.gidnumber FROM groups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan( + &group.GIDNumber) if err != nil { h.log.V(2).Info(fmt.Sprintf("Bind Error: Group %s not found.", userName)) return ldap.LDAPResultInvalidCredentials, nil } // validate group membership - if user.PrimaryGroup != group.UnixID { + if user.PrimaryGroup != group.GIDNumber { h.log.V(2).Info(fmt.Sprintf("Bind Error: User %s primary group is not %s.", userName, groupName)) return ldap.LDAPResultInvalidCredentials, nil } @@ -273,7 +273,7 @@ func (h databaseHandler) Search(bindDN string, searchReq ldap.SearchRequest, con } rows, err := h.database.cnx.Query(` - SELECT u.name,u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups,u.givenname,u.sn,u.mail,u.loginshell,u.homedirectory,u.disabled + SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups,u.givenname,u.sn,u.mail,u.loginshell,u.homedirectory,u.disabled FROM users u`) if err != nil { return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: Unable to retrieve data [%s]", err.Error()) @@ -284,7 +284,7 @@ func (h databaseHandler) Search(bindDN string, searchReq ldap.SearchRequest, con var disabled int u := config.User{} for rows.Next() { - err := rows.Scan(&u.Name, &u.UnixID, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups, &u.GivenName, &u.SN, &u.Mail, &u.LoginShell, &u.Homedir, &disabled) + err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups, &u.GivenName, &u.SN, &u.Mail, &u.LoginShell, &u.Homedir, &disabled) if err != nil { return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: Unable to retrieve data [%s]", err.Error()) } @@ -319,9 +319,9 @@ func (h databaseHandler) FindUser(userName string) (f bool, u config.User, err e found := false err = h.database.cnx.QueryRow(fmt.Sprintf(` - SELECT u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey + SELECT u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey FROM users u WHERE lower(u.name)=%s`, h.sqlBackend.GetPrepareSymbol()), userName).Scan( - &user.UnixID, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey) + &user.UIDNumber, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey) if err == nil { found = true } @@ -360,10 +360,10 @@ func (h databaseHandler) commaListToTable(commaList string) []int { func (h databaseHandler) memoizeGroups() ([]config.Group, error) { workMemGroups := make([]*config.Group, 0) rows, err := h.database.cnx.Query(` - SELECT g1.name,g1.unixid,ig.includegroupid + SELECT g1.name,g1.gidnumber,ig.includegroupid FROM groups g1 - LEFT JOIN includegroups ig ON g1.unixid=ig.parentgroupid - LEFT JOIN groups g2 ON ig.includegroupid=g2.unixid`) + LEFT JOIN includegroups ig ON g1.gidnumber=ig.parentgroupid + LEFT JOIN groups g2 ON ig.includegroupid=g2.gidnumber`) if err != nil { return nil, errors.New("Unable to memoize groups list") } @@ -381,7 +381,7 @@ func (h databaseHandler) memoizeGroups() ([]config.Group, error) { } if recentId != groupId { recentId = groupId - g := config.Group{Name: groupName, UnixID: groupId} + g := config.Group{Name: groupName, GIDNumber: groupId} pg = &g // To manipulate end of slice workMemGroups = append(workMemGroups, &g) } @@ -391,7 +391,7 @@ func (h databaseHandler) memoizeGroups() ([]config.Group, error) { } memGroups := make([]config.Group, len(workMemGroups)) for i, v := range workMemGroups { - memGroups[i] = config.Group{Name: v.Name, UnixID: v.UnixID, IncludeGroups: v.IncludeGroups} + memGroups[i] = config.Group{Name: v.Name, GIDNumber: v.GIDNumber, IncludeGroups: v.IncludeGroups} } return memGroups, nil } @@ -401,7 +401,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string { members := make(map[string]bool) rows, err := h.database.cnx.Query(` - SELECT u.name,u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups + SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups FROM users u WHERE lower(u.name)=?`, ) if err != nil { @@ -413,7 +413,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string { var otherGroups string u := config.User{} for rows.Next() { - err := rows.Scan(&u.Name, &u.UnixID, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups) + err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups) if err != nil { return []string{} } @@ -432,7 +432,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string { } for _, g := range h.MemGroups { - if gid == g.UnixID { + if gid == g.GIDNumber { for _, includegroupid := range g.IncludeGroups { if includegroupid != gid { includegroupmembers := h.getGroupMembers(includegroupid) @@ -459,7 +459,7 @@ func (h databaseHandler) getGroupMembers(gid int) []string { func (h databaseHandler) getGroupMemberIDs(gid int) []string { members := make(map[string]bool) rows, err := h.database.cnx.Query(` - SELECT u.name,u.unixid,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups + SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups FROM users u`) if err != nil { // Silent fail... for now @@ -470,7 +470,7 @@ func (h databaseHandler) getGroupMemberIDs(gid int) []string { var otherGroups string u := config.User{} for rows.Next() { - err := rows.Scan(&u.Name, &u.UnixID, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups) + err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups) if err != nil { return []string{} } @@ -487,7 +487,7 @@ func (h databaseHandler) getGroupMemberIDs(gid int) []string { } for _, g := range h.MemGroups { - if gid == g.UnixID { + if gid == g.GIDNumber { for _, includegroupid := range g.IncludeGroups { if includegroupid == gid { h.log.V(3).Info(fmt.Sprintf("Group: %d - Ignoring myself as included group", includegroupid)) @@ -517,14 +517,14 @@ func (h databaseHandler) getGroupDNs(gids []int) []string { groups := make(map[string]bool) for _, gid := range gids { for _, g := range h.MemGroups { - if g.UnixID == gid { + if g.GIDNumber == gid { dn := fmt.Sprintf("cn=%s,ou=groups,%s", g.Name, h.backend.BaseDN) groups[dn] = true } for _, includegroupid := range g.IncludeGroups { - if includegroupid == gid && g.UnixID != gid { - includegroupdns := h.getGroupDNs([]int{g.UnixID}) + if includegroupid == gid && g.GIDNumber != gid { + includegroupdns := h.getGroupDNs([]int{g.GIDNumber}) for _, includegroupdn := range includegroupdns { groups[includegroupdn] = true @@ -547,7 +547,7 @@ func (h databaseHandler) getGroupDNs(gids []int) []string { // Invoked for every user being returned from our database func (h databaseHandler) getGroupName(gid int) string { for _, g := range h.MemGroups { - if g.UnixID == gid { + if g.GIDNumber == gid { return g.Name } } @@ -559,10 +559,10 @@ func (h databaseHandler) getGroup(g config.Group) *ldap.Entry { attrs := []*ldap.EntryAttribute{} attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{g.Name}}) attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", g.Name)}}) - attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.UnixID)}}) + attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}}) attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixGroup"}}) - attrs = append(attrs, &ldap.EntryAttribute{"uniqueMember", h.getGroupMembers(g.UnixID)}) - attrs = append(attrs, &ldap.EntryAttribute{"memberUid", h.getGroupMemberIDs(g.UnixID)}) + attrs = append(attrs, &ldap.EntryAttribute{"uniqueMember", h.getGroupMembers(g.GIDNumber)}) + attrs = append(attrs, &ldap.EntryAttribute{"memberUid", h.getGroupMemberIDs(g.GIDNumber)}) dn := fmt.Sprintf("cn=%s,ou=groups,%s", g.Name, h.backend.BaseDN) return &ldap.Entry{dn, attrs} } @@ -581,7 +581,7 @@ func (h databaseHandler) getAccount(u config.User) *ldap.Entry { } attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}}) - attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UnixID)}}) + attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UIDNumber)}}) if u.Disabled { attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"inactive"}}) diff --git a/pkg/plugins/mysql.go b/pkg/plugins/mysql.go index c7bdf65..fc38065 100644 --- a/pkg/plugins/mysql.go +++ b/pkg/plugins/mysql.go @@ -30,7 +30,7 @@ func (b MysqlBackend) CreateSchema(db *sql.DB) { CREATE TABLE IF NOT EXISTS users ( id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(64) NOT NULL, - unixid INTEGER NOT NULL, + uidnumber INTEGER NOT NULL, primarygroup INTEGER NOT NULL, othergroups VARCHAR(1024) DEFAULT '', givenname VARCHAR(64) DEFAULT '', @@ -47,7 +47,7 @@ CREATE TABLE IF NOT EXISTS users ( statement.Exec() statement, _ = db.Prepare("CREATE UNIQUE INDEX idx_user_name on users(name)") statement.Exec() - statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(64) NOT NULL, unixid INTEGER NOT NULL)") + statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(64) NOT NULL, gidnumber INTEGER NOT NULL)") statement.Exec() statement, _ = db.Prepare("CREATE UNIQUE INDEX idx_group_name on groups(name)") statement.Exec() diff --git a/pkg/plugins/postgres.go b/pkg/plugins/postgres.go index 45b5954..ec5e9e8 100644 --- a/pkg/plugins/postgres.go +++ b/pkg/plugins/postgres.go @@ -30,7 +30,7 @@ func (b PostgresBackend) CreateSchema(db *sql.DB) { CREATE TABLE IF NOT EXISTS users ( id SERIAL PRIMARY KEY, name TEXT NOT NULL, - unixid INTEGER NOT NULL, + uidnumber INTEGER NOT NULL, primarygroup INTEGER NOT NULL, othergroups TEXT DEFAULT '', givenname TEXT DEFAULT '', @@ -47,7 +47,7 @@ CREATE TABLE IF NOT EXISTS users ( statement.Exec() statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_user_name on users(name)") statement.Exec() - statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id SERIAL PRIMARY KEY, name TEXT NOT NULL, unixid INTEGER NOT NULL)") + statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id SERIAL PRIMARY KEY, name TEXT NOT NULL, gidnumber INTEGER NOT NULL)") statement.Exec() statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_group_name on groups(name)") statement.Exec() diff --git a/pkg/plugins/sqlite.go b/pkg/plugins/sqlite.go index fb210f5..be7135d 100644 --- a/pkg/plugins/sqlite.go +++ b/pkg/plugins/sqlite.go @@ -30,7 +30,7 @@ func (b SqliteBackend) CreateSchema(db *sql.DB) { CREATE TABLE IF NOT EXISTS users ( id INTEGER PRIMARY KEY, name TEXT NOT NULL, - unixid INTEGER NOT NULL, + uidnumber INTEGER NOT NULL, primarygroup INTEGER NOT NULL, othergroups TEXT DEFAULT '', givenname TEXT DEFAULT '', @@ -47,7 +47,7 @@ CREATE TABLE IF NOT EXISTS users ( statement.Exec() statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_user_name on users(name)") statement.Exec() - statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER PRIMARY KEY, name TEXT NOT NULL, unixid INTEGER NOT NULL)") + statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER PRIMARY KEY, name TEXT NOT NULL, gidnumber INTEGER NOT NULL)") statement.Exec() statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_group_name on groups(name)") statement.Exec() diff --git a/sample-simple.cfg b/sample-simple.cfg index b7d8306..21c2e61 100644 --- a/sample-simple.cfg +++ b/sample-simple.cfg @@ -49,7 +49,7 @@ debug = true # to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256 [[users]] name = "hackers" - unixid = 5001 + uidnumber = 5001 primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood @@ -59,7 +59,7 @@ debug = true givenname="John" sn="Doe" mail = "jdoe@example.com" - unixid = 5002 + uidnumber = 5002 primarygroup = 5501 loginShell = "/bin/sh" homeDir = "/root" @@ -73,14 +73,14 @@ debug = true [[users]] name = "serviceuser" - unixid = 5003 + uidnumber = 5003 primarygroup = 5502 passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret # Test user showing 2 factor auth authentication [[users]] name = "otpuser" - unixid = 5004 + uidnumber = 5004 primarygroup = 5501 passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk" @@ -88,7 +88,7 @@ debug = true [[users]] name = "uberhackers" - unixid = 5005 + uidnumber = 5005 primarygroup = 5501 # bcrypt format: hex($2y$2^$$) passappbcrypt = [ @@ -103,15 +103,15 @@ debug = true # The groups section contains a hardcoded list of valid users. [[groups]] name = "superheros" - unixid = 5501 + gidnumber = 5501 [[groups]] name = "svcaccts" - unixid = 5502 + gidnumber = 5502 [[groups]] name = "vpn" - unixid = 5503 + gidnumber = 5503 includegroups = [ 5501 ] ################# diff --git a/scripts/docker/default-config.cfg b/scripts/docker/default-config.cfg index 68bb380..21d41b2 100644 --- a/scripts/docker/default-config.cfg +++ b/scripts/docker/default-config.cfg @@ -28,7 +28,7 @@ debug = true # to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256 [[users]] name = "hackers" - unixid = 5001 + uidnumber = 5001 primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood @@ -38,7 +38,7 @@ debug = true givenname="John" sn="Doe" mail = "jdoe@example.com" - unixid = 5002 + uidnumber = 5002 primarygroup = 5501 loginShell = "/bin/sh" homeDir = "/root" @@ -48,7 +48,7 @@ debug = true [[users]] name = "serviceuser" - unixid = 5003 + uidnumber = 5003 primarygroup = 5502 passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret @@ -56,11 +56,11 @@ debug = true # The groups section contains a hardcoded list of valid users. [[groups]] name = "superheros" - unixid = 5501 + gidnumber = 5501 [[groups]] name = "svcaccts" - unixid = 5502 + gidnumber = 5502 ################# # Enable and configure the optional REST API here. diff --git a/scripts/travis/test-config.cfg b/scripts/travis/test-config.cfg index e00d3b7..ce5dfbf 100644 --- a/scripts/travis/test-config.cfg +++ b/scripts/travis/test-config.cfg @@ -28,7 +28,7 @@ debug = true # to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256 [[users]] name = "hackers" - unixid = 5001 + uidnumber = 5001 primarygroup = 5501 passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood @@ -38,7 +38,7 @@ debug = true givenname="John" sn="Doe" mail = "jdoe@example.com" - unixid = 5002 + uidnumber = 5002 primarygroup = 5501 loginShell = "/bin/sh" homeDir = "/root" @@ -51,7 +51,7 @@ debug = true givenname="James" sn="Doe" mail = "jdoe2@example.com" - unixid = 5003 + uidnumber = 5003 primarygroup = 5501 loginShell = "/bin/sh" otherGroups = [5505,5507] @@ -65,7 +65,7 @@ debug = true givenname="Alex" sn="Doe" mail = "adoe@example.com" - unixid = 5004 + uidnumber = 5004 primarygroup = 5501 loginShell = "/bin/sh" otherGroups = [5505,5507] @@ -80,7 +80,7 @@ debug = true givenname="Jack" sn="Doe" mail = "jdoe3@example.com" - unixid = 5005 + uidnumber = 5005 primarygroup = 5501 loginShell = "/bin/sh" otherGroups = [5505,5507] @@ -97,7 +97,7 @@ debug = true givenname="Sarah" sn="Doe" mail = "sdoe@example.com" - unixid = 5006 + uidnumber = 5006 primarygroup = 5501 loginShell = "/bin/sh" otherGroups = [5505,5507] @@ -112,7 +112,7 @@ debug = true [[users]] name = "serviceuser" - unixid = 5003 + uidnumber = 5003 primarygroup = 5502 passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret @@ -120,35 +120,35 @@ debug = true # The groups section contains a hardcoded list of valid users. [[groups]] name = "superheros" - unixid = 5501 + gidnumber = 5501 [[groups]] name = "svcaccts" - unixid = 5502 + gidnumber = 5502 [[groups]] name = "vpnaccess" - unixid = 5503 + gidnumber = 5503 includegroups = [ 5501 ] [[groups]] name = "allaccs" - unixid = 5504 + gidnumber = 5504 includegroups = [ 5501, 5502 ] [[groups]] name = "mailadmin" - unixid = 5505 + gidnumber = 5505 [[groups]] name = "webmail" - unixid = 5506 + gidnumber = 5506 [[groups]] name = "fulltime" - unixid = 5507 + gidnumber = 5507 ################# # Enable and configure the optional REST API here.