From aadf150fec8b3b8c80b32823de193c16c76d2447 Mon Sep 17 00:00:00 2001 From: Chris F Ravenscroft Date: Sun, 6 Nov 2022 20:10:22 -0800 Subject: [PATCH 1/3] Dev -> Master get rid of old Docker files (#288) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Reverse pull request from master to dev. Reverse pull request. * Fix/docker latest tag (#260) * Dev (#254) * use functional options pattern to inject logr (#124) * use functional options pattern to inject logr Signed-off-by: Jörn Friedrich Dreyer * cleanup log formatting Signed-off-by: Jörn Friedrich Dreyer * allow clean shutdown (#126) * fix owncloud posix query, log message and provisioning api results (#128) Signed-off-by: Jörn Friedrich Dreyer * don't hardcode graphapi endpoint Signed-off-by: Jörn Friedrich Dreyer * add support for write handlers (#135) Signed-off-by: Jörn Friedrich Dreyer * config: match shadowaccount objectlcass (#136) Signed-off-by: Jörn Friedrich Dreyer * Makefile compatiblility (#134) Co-authored-by: Jörn Friedrich Dreyer * update travis.yml (#154) Signed-off-by: Jörn Friedrich Dreyer * check owncloud status code is ok (#153) Signed-off-by: Jörn Friedrich Dreyer * Bulid and push multiarch docker images (#142) Fix #141. With this change, a github action is added that builds a multiarch docker image on every commit, supporting x86_64, aarch64 and arm/v7. When the action is triggered on a release or tag, it also uploads the versioned image to github container image registry. Co-authored-by: Jörn Friedrich Dreyer * don't mix graph and provisioning api (#157) Signed-off-by: Jörn Friedrich Dreyer * Reuse http client as much as possible and allow insecure transport (#160) * Allow using configmaps when deploying in kubernetes (#161) * Ensure config watcher also works in kubernetes When using configmaps in kubernetes, the file is a symlink, and then file-watcher is not opdated with a write event. Instead it receives a CHMOD and a REMOVE event. This change adds two things 1) Removal of the current wacther and adding of a new watcher for the same path 2) The do-reload conditional is updated to also include the remove event. * Align write and removed conditionals * Fix API server json formating (#163) (#164) * Update README.md (#167) Fixing bad port in quickstart * Use port 3893 with ldapsearch in example (#150) * feat: add flags for ldap listen addresses (#169) Signed-off-by: Mark Sagi-Kazar * Assets build fix. (#171) * Docker build fix. * Makefile fix. * update readme, config and deps (#170) Signed-off-by: Jörn Friedrich Dreyer * Remove byanke's donation fields * Database plugins (#133) This commit actually covers a few items. In future commits, I will keep features distinct. This is only happening this time around due to how long it took to merge this branch. Covered: - Database plugins (at this time: SQLite, MySQL, Postgres) - Backends acting as middleware: added the [[Backends]] configuration directive while retaining backward compatibility with [Backend] - Schema introspection (root DSE query with base scope) - When proxying, insert queried attribute back in upstream response, if absent, so that the LDAP library does not filter out all entries - When chaining backends, any backend can be used to inject OTP value in password, before reaching a non-OTP-aware backend (currently guarded by a True statement in case we find an issue (I did thoroughly test but you never know)) - Handling of special "1.1" attributes filter meaning "I do not want attributes" (RFC 4511, 4.5.1.8) - Support for "want types only" queries, even when proxying * Mac M1 Support and LDAP Req Attributes (#192) * Mac M1 Support * Augmented root DSS and schema discovery based on content of schema directory * LDAP workaround where req. attribute gets injected in response now works with combined filters * SubSchema query can return a minimal set, freeipa or openldap's schemas * Feature/upgrade ldap library version (#194) * Stronger, salted paswords using bcrypt. (#195) * Fixed badges in README file and added a couple improvements (#196) * fix lock for ownCloud / graph backend (#198) Signed-off-by: Jörn Friedrich Dreyer * the config struct is only needed by the config backend (#199) * Variable "unixid" is now respectively "UIDNumber" and "GIDNumber" for… (#201) * fix: keep watch config file when changed,renamed,removed (#189) I will need to run `glauth.go` through `gofmt` myself but that is fine. * Returning when unable to start config watcher (#203) * Introducing goconvey testing and refactoring of config and ... (#204) * Introducing goconvey testing and refactoring of config and plugin backends. * gofmt, oops * Refactored re-insertion of requested attributes * Allow bind operations with no group provided (#205) * Support for userPrincipalName binding and browsing. (#206) * Support for userPrincipalName binding and browsing. * Fixed travis CI test for userprincipalname * fixing travis tests for more users * Rate limit after failed binds (#207) * Capabilities -- part 2 (#214) + do not dump config at startup * Attempting migration from Travis to Github Actions * Migration Step#2 * Migration Step#3 * Migration Step#4 * Migration Step#5 * Migration Step#6 * Migration Step#7 * Migration Step#8 * Migration Step#9 * Migration Step#9 * Migration dev... * Migration dev... * Migration dev... * Migration dev... * Docker with plugins, first step (#215) * Docker with plugins, first step * Build better docker images, including plugins * Merge back from dev to feature branch step #2 * Added capabilities to CI * - Now creating two docker images, including one with plugins - Moving from Travis CI to GitHub Actions * Plugins now run on distroless (#217) * Getting rid of Travis CI now that it doesn't support FOSS anymore. * Internal Stats -- performance view (#221) * Local merge * Update CI to forget about bindata * Forgot to cleanup the cleanup... * assets: use stdlib "embed" package (#200) This should make it easier to include GLAuth in other projects using `go get` * 'Airgapping' web assets for security and preventing breakage (#227) * v2 -- V2 hierarchy (#228) * Search refactoring, tree traversal and scope correctness (#229) Search refactoring, tree traversal and scope correctness. * Feature/multi cfg (#233) * Feature/custom attributes (#240) * Makefiles: platform releases (#241) * Feature/release script (#242) * Bug/fix docker build in v2 (#244) * Fix #246 and #252 Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay * Cleanup Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay * Feature/dbsshkeys (#262) * Dev -> Master after v1/v2 cleanup (#261) * Reverse pull request from master to dev. Reverse pull request. * Fix/docker latest tag (#260) * Dev (#254) * use functional options pattern to inject logr (#124) * use functional options pattern to inject logr Signed-off-by: Jörn Friedrich Dreyer * cleanup log formatting Signed-off-by: Jörn Friedrich Dreyer * allow clean shutdown (#126) * fix owncloud posix query, log message and provisioning api results (#128) Signed-off-by: Jörn Friedrich Dreyer * don't hardcode graphapi endpoint Signed-off-by: Jörn Friedrich Dreyer * add support for write handlers (#135) Signed-off-by: Jörn Friedrich Dreyer * config: match shadowaccount objectlcass (#136) Signed-off-by: Jörn Friedrich Dreyer * Makefile compatiblility (#134) Co-authored-by: Jörn Friedrich Dreyer * update travis.yml (#154) Signed-off-by: Jörn Friedrich Dreyer * check owncloud status code is ok (#153) Signed-off-by: Jörn Friedrich Dreyer * Bulid and push multiarch docker images (#142) Fix #141. With this change, a github action is added that builds a multiarch docker image on every commit, supporting x86_64, aarch64 and arm/v7. When the action is triggered on a release or tag, it also uploads the versioned image to github container image registry. Co-authored-by: Jörn Friedrich Dreyer * don't mix graph and provisioning api (#157) Signed-off-by: Jörn Friedrich Dreyer * Reuse http client as much as possible and allow insecure transport (#160) * Allow using configmaps when deploying in kubernetes (#161) * Ensure config watcher also works in kubernetes When using configmaps in kubernetes, the file is a symlink, and then file-watcher is not opdated with a write event. Instead it receives a CHMOD and a REMOVE event. This change adds two things 1) Removal of the current wacther and adding of a new watcher for the same path 2) The do-reload conditional is updated to also include the remove event. * Align write and removed conditionals * Fix API server json formating (#163) (#164) * Update README.md (#167) Fixing bad port in quickstart * Use port 3893 with ldapsearch in example (#150) * feat: add flags for ldap listen addresses (#169) Signed-off-by: Mark Sagi-Kazar * Assets build fix. (#171) * Docker build fix. * Makefile fix. * update readme, config and deps (#170) Signed-off-by: Jörn Friedrich Dreyer * Remove byanke's donation fields * Database plugins (#133) This commit actually covers a few items. In future commits, I will keep features distinct. This is only happening this time around due to how long it took to merge this branch. Covered: - Database plugins (at this time: SQLite, MySQL, Postgres) - Backends acting as middleware: added the [[Backends]] configuration directive while retaining backward compatibility with [Backend] - Schema introspection (root DSE query with base scope) - When proxying, insert queried attribute back in upstream response, if absent, so that the LDAP library does not filter out all entries - When chaining backends, any backend can be used to inject OTP value in password, before reaching a non-OTP-aware backend (currently guarded by a True statement in case we find an issue (I did thoroughly test but you never know)) - Handling of special "1.1" attributes filter meaning "I do not want attributes" (RFC 4511, 4.5.1.8) - Support for "want types only" queries, even when proxying * Mac M1 Support and LDAP Req Attributes (#192) * Mac M1 Support * Augmented root DSS and schema discovery based on content of schema directory * LDAP workaround where req. attribute gets injected in response now works with combined filters * SubSchema query can return a minimal set, freeipa or openldap's schemas * Feature/upgrade ldap library version (#194) * Stronger, salted paswords using bcrypt. (#195) * Fixed badges in README file and added a couple improvements (#196) * fix lock for ownCloud / graph backend (#198) Signed-off-by: Jörn Friedrich Dreyer * the config struct is only needed by the config backend (#199) * Variable "unixid" is now respectively "UIDNumber" and "GIDNumber" for… (#201) * fix: keep watch config file when changed,renamed,removed (#189) I will need to run `glauth.go` through `gofmt` myself but that is fine. * Returning when unable to start config watcher (#203) * Introducing goconvey testing and refactoring of config and ... (#204) * Introducing goconvey testing and refactoring of config and plugin backends. * gofmt, oops * Refactored re-insertion of requested attributes * Allow bind operations with no group provided (#205) * Support for userPrincipalName binding and browsing. (#206) * Support for userPrincipalName binding and browsing. * Fixed travis CI test for userprincipalname * fixing travis tests for more users * Rate limit after failed binds (#207) * Capabilities -- part 2 (#214) + do not dump config at startup * Attempting migration from Travis to Github Actions * Migration Step#2 * Migration Step#3 * Migration Step#4 * Migration Step#5 * Migration Step#6 * Migration Step#7 * Migration Step#8 * Migration Step#9 * Migration Step#9 * Migration dev... * Migration dev... * Migration dev... * Migration dev... * Docker with plugins, first step (#215) * Docker with plugins, first step * Build better docker images, including plugins * Merge back from dev to feature branch step #2 * Added capabilities to CI * - Now creating two docker images, including one with plugins - Moving from Travis CI to GitHub Actions * Plugins now run on distroless (#217) * Getting rid of Travis CI now that it doesn't support FOSS anymore. * Internal Stats -- performance view (#221) * Local merge * Update CI to forget about bindata * Forgot to cleanup the cleanup... * assets: use stdlib "embed" package (#200) This should make it easier to include GLAuth in other projects using `go get` * 'Airgapping' web assets for security and preventing breakage (#227) * v2 -- V2 hierarchy (#228) * Search refactoring, tree traversal and scope correctness (#229) Search refactoring, tree traversal and scope correctness. * Feature/multi cfg (#233) * Feature/custom attributes (#240) * Makefiles: platform releases (#241) * Feature/release script (#242) * Bug/fix docker build in v2 (#244) * Fix #246 and #252 Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay * Cleanup Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay * SSH Keys support in database plugins Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay * Better plugin build for darwin * add link to documentation, only discovered it while perusing issues list (#276) * Plugin: Unix PAM Authentication (https://github.com/glauth/glauth/pull/263) (#277) * Plugin: Unix PAM Authentication (#263) * Add plugin using pam authentication Adds an additional plugin which us authenticating against the PAM unix backend and exposing users and groups local to the machine glauth is running on. This can be used to expose local users for authentication in other services which support ldap only. * plugins: pam: Rewrite Bind() to use ldapopshelper Modernizes the implementation of Bind() to make use of the helper functions provided by LDAPOpsHelper. In order to support custom authentication the existing config.User has received an additional PassAppCustom property which allows to specify a custom authentication callback for a user. In case of the PAM backend this will be used to authenticate against the local PAM database. * plugins: pam: Rewrite Search() to use ldapopshelper Modernizes the implementation of Search() to make use of the helper functions provided by LDAPOpsHelper. * plugins: pam: Capability through group membership Adds a configuration option which decides if a user gets the search capability or not based on the group memberships of a user. * plugins: pam: Apply formatting Runs gofmt and go get on all changes done earlier * plugins: pam: Address feedback from CodeClimate - reduce code similarity - document new exports - address casing of variables and functions - reduce complexity of FindPosixGroups() - reduce complexity of FindPosixAccounts() - fix else branch in ldapopshelper Co-authored-by: Marius Zwicker * Updated README for pam plugin * Updated README for pam plugin Co-authored-by: Marius Zwicker Co-authored-by: Marius Zwicker * Removing db plugins * Changing plugind package * Remove main frmo plugin * Move plugins to their own repos (#283) * Plugins release build delegated to plugin Makefile * Build and push docker containers * README points to documentation * Shortened README * Prometheus exported (#284) * Prometheus exporter * Feature/zerolog (#285) * Zerolog * Adjusted logging levels * Structured logging including ldap library * Feature/check config (#286) Add config check `--check-config` * Removed last trace of old docker files Co-authored-by: Jörn Friedrich Dreyer Co-authored-by: Zhou Wenzong Co-authored-by: Jairo Llopis Co-authored-by: Benedikt Kulmann Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com> Co-authored-by: Thibault Soubiran Co-authored-by: Clement JACOB Co-authored-by: Lutz Horn Co-authored-by: Márk Sági-Kazár Co-authored-by: Peter Heise Co-authored-by: Ben Yanke Co-authored-by: fanlix Co-authored-by: Hank Donnay Co-authored-by: dlitster Co-authored-by: Marius Zwicker Co-authored-by: Marius Zwicker --- v2/Dockerfile-plugins | 65 ---------------------------------------- v2/Dockerfile-standalone | 61 ------------------------------------- 2 files changed, 126 deletions(-) delete mode 100644 v2/Dockerfile-plugins delete mode 100644 v2/Dockerfile-standalone diff --git a/v2/Dockerfile-plugins b/v2/Dockerfile-plugins deleted file mode 100644 index 2ad1c91..0000000 --- a/v2/Dockerfile-plugins +++ /dev/null @@ -1,65 +0,0 @@ -################# -# Build Step -################# - -FROM golang:buster as build -LABEL maintainers="Ben Yanke , Jörn Friedrich Dreyer , Chris F Ravenscroft " - -# Setup work env -RUN mkdir /app /tmp/gocode -ADD local/app /app/ -WORKDIR /app/v2 - -# Required envs for GO -ENV GOPATH=/tmp/gocode -ENV GOOS=linux -ENV GOARCH=amd64 -ENV GO_ENABLED=1 - -# Only needed for alpine builds // also: busybox -RUN apt -qq update && apt -qq install -y git make build-essential busybox-static dumb-init - -# Install deps -RUN go get -d -v ./... - -# Build and copy final result -RUN uname -a -RUN uname -m -RUN bash -c '[[ $(uname -m) == x86_64 ]] && { make linuxamd64 && cp ./bin/linuxamd64/glauth /app/v2/glauth; make plugins_linux_amd64 && cp ./bin/linuxamd64/*.so /app/v2/; } || { true; }' -RUN bash -c '[[ $(uname -m) == aarch64 ]] && { make linuxarm64 && cp ./bin/linuxarm64/glauth /app/v2/glauth; make plugins_linux_arm64 && cp ./bin/linuxarm64/*.so /app/v2/; } || { true; }' -RUN ls -l /app/v2/bin/linuxamd64 - -# Check glauth works -RUN /app/v2/glauth --version - -################# -# Run Step -################# - -FROM gcr.io/distroless/base-debian10 as run -LABEL maintainers="Ben Yanke , Jörn Friedrich Dreyer , Chris F Ravenscroft " - -# Copy binary from build container -COPY --from=build /app/v2/glauth /app/glauth -COPY --from=build /app/v2/*.so /app/ - -# Copy docker specific scripts from build container -COPY --from=build /app/v2/scripts/docker/start-plugins.sh /app/docker/ -COPY --from=build /app/v2/scripts/docker/default-config-plugins.cfg /app/docker/ -COPY --from=build /app/v2/scripts/docker/gl.db /app/docker/ - -# Just what we need -COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init -COPY --from=build /bin/busybox /bin/sh -COPY --from=build /bin/busybox /bin/ln -COPY --from=build /bin/busybox /bin/rm -# Debug env: COPY --from=build /bin/busybox /bin/busybox -RUN ln /bin/sh /usr/bin/cp && ln /bin/sh /usr/bin/mkdir && rm /bin/ln /bin/rm - -# Install init - -# Expose web and LDAP ports -EXPOSE 389 636 5555 - -ENTRYPOINT ["/usr/bin/dumb-init", "--"] -CMD ["/bin/sh", "/app/docker/start-plugins.sh"] diff --git a/v2/Dockerfile-standalone b/v2/Dockerfile-standalone deleted file mode 100644 index cd6316a..0000000 --- a/v2/Dockerfile-standalone +++ /dev/null @@ -1,61 +0,0 @@ -################# -# Build Step -################# - -FROM golang:alpine as build -LABEL maintainers="Ben Yanke , Jörn Friedrich Dreyer , Chris F Ravenscroft " - -# Setup work env -RUN mkdir /app /tmp/gocode -ADD local/app /app/ -WORKDIR /app/v2 - -# Required envs for GO -ENV GOPATH=/tmp/gocode -ENV GOOS=linux -ENV GOARCH=amd64 -ENV CGO_ENABLED=0 - -# Only needed for alpine builds // also: busybox -RUN apk add --no-cache git make busybox-static dumb-init - -# Install deps -RUN go get -d -v ./... - -# Build and copy final result -RUN uname -a -RUN if [ $(uname -m) == x86_64 ]; then make linuxamd64 && cp ./bin/linuxamd64/glauth /app/v2/glauth; fi -RUN if [ $(uname -m) == aarch64 ]; then make linuxarm64 && cp ./bin/linuxarm64/glauth /app/v2/glauth; fi -RUN if [ $(uname -m) == armv7l ]; then make linuxarm && cp ./bin/linuxarm/glauth /app/v2/glauth; fi - -# Check glauth works -RUN /app/v2/glauth --version - -################# -# Run Step -################# - -FROM gcr.io/distroless/base-debian10 as run -LABEL maintainers="Ben Yanke , Jörn Friedrich Dreyer , Chris F Ravenscroft " - -# Copy binary from build container -COPY --from=build /app/v2/glauth /app/glauth - -# Copy docker specific scripts from build container -COPY --from=build /app/v2/scripts/docker/start-standalone.sh /app/docker/ -COPY --from=build /app/v2/scripts/docker/default-config-standalone.cfg /app/docker/ - -# Just what we need -COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init -COPY --from=build /bin/busybox.static /bin/sh -COPY --from=build /bin/busybox.static /bin/ln -COPY --from=build /bin/busybox.static /bin/rm -RUN ln /bin/sh /usr/bin/cp && ln /bin/sh /usr/bin/mkdir && rm /bin/ln /bin/rm - -# Install init - -# Expose web and LDAP ports -EXPOSE 389 636 5555 - -ENTRYPOINT ["/usr/bin/dumb-init", "--"] -CMD ["/bin/sh", "/app/docker/start-standalone.sh"] From 0e7769ff841e096dbf0cb67768cbd2ab7142f6fb Mon Sep 17 00:00:00 2001 From: Chris F Ravenscroft Date: Sat, 12 Nov 2022 14:59:43 -0800 Subject: [PATCH 2/3] No SysLog on Windows (#289) (#290) --- v2/glauth.go | 41 +-------- v2/go.mod | 2 - v2/go.sum | 4 - v2/pkg/logging/loghandler_other.go | 84 +++++++++++++++++++ .../{loghandler.go => loghandler_windows.go} | 27 +++++- 5 files changed, 111 insertions(+), 47 deletions(-) create mode 100644 v2/pkg/logging/loghandler_other.go rename v2/pkg/logging/{loghandler.go => loghandler_windows.go} (63%) diff --git a/v2/glauth.go b/v2/glauth.go index 6f4a29c..1e24b39 100644 --- a/v2/glauth.go +++ b/v2/glauth.go @@ -17,9 +17,7 @@ import ( "github.com/rs/zerolog" "gopkg.in/amz.v3/aws" "gopkg.in/amz.v3/s3" - "io" "io/ioutil" - "log/syslog" "net/http" "os" "path/filepath" @@ -768,7 +766,7 @@ func doConfig(checkConfig bool) error { // Handle logging settings for new config // - we do this last to make sure we only respect a fully validated config - initLogging(activeConfig.Debug, activeConfig.Syslog, activeConfig.StructuredLog) + log = logging.InitLogging(activeConfig.Debug, activeConfig.Syslog, activeConfig.StructuredLog) if !checkConfig { if activeConfig.Debug { @@ -781,40 +779,3 @@ func doConfig(checkConfig bool) error { return nil } - -// initLogging sets up logging to stderr -func initLogging(reqdebug bool, reqsyslog bool, reqstructlog bool) { - var level zerolog.Level - if reqdebug { - level = zerolog.DebugLevel - } else { - level = zerolog.InfoLevel - } - - var mainWriter io.Writer - if reqstructlog { - // Vroom vroom - mainWriter = os.Stderr - zerolog.TimeFieldFormat = time.RFC1123Z - } else { - // This is the inefficient writer - mainWriter = zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.RFC1123Z} - } - - if reqsyslog { - s, err := syslog.New(syslog.LOG_INFO, "glauth") - if err != nil { - fmt.Println("Unable to write to syslog: ignoring...") - reqsyslog = false - } else { - writers := zerolog.MultiLevelWriter(mainWriter, zerolog.SyslogLevelWriter(s)) - log = zerolog.New(writers).Level(level).With().Timestamp().Logger() - } - } - - if !reqsyslog { - log = zerolog.New(mainWriter).Level(level).With().Timestamp().Logger() - } - - logging.RewireLogging(log, reqstructlog) -} diff --git a/v2/go.mod b/v2/go.mod index 812fbde..d52786e 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -11,11 +11,9 @@ require ( github.com/boombuler/barcode v1.0.1 // indirect github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 github.com/fsnotify/fsnotify v1.4.9 - github.com/go-logr/logr v0.4.0 github.com/hydronica/toml v0.4.2 github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba - github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 github.com/pquerna/otp v1.3.0 github.com/prometheus/client_golang v1.13.0 github.com/rs/zerolog v1.28.0 diff --git a/v2/go.sum b/v2/go.sum index c2e1118..3b73023 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -81,8 +81,6 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs= -github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc= -github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU= github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= @@ -188,8 +186,6 @@ github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 h1:D9EvfGQvlkKaD github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484/go.mod h1:O1EljZ+oHprtxDDPHiMWVo/5dBT6PlvWX5PSwj80aBA= github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba h1:DO8NFYdcRv1dnyAINJIBm6Bw2XibtLvQniNFGzf2W8E= github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba/go.mod h1:4S0XndRL8HNOaQBfdViJ2F/GPCgL524xlXRuXFH12/U= -github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 h1:lDH9UUVJtmYCjyT0CI4q8xvlXPxeZ0gYCVvWbmPlp88= -github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk= github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= diff --git a/v2/pkg/logging/loghandler_other.go b/v2/pkg/logging/loghandler_other.go new file mode 100644 index 0000000..79b50d2 --- /dev/null +++ b/v2/pkg/logging/loghandler_other.go @@ -0,0 +1,84 @@ +//go:build !windows +// +build !windows + +package logging + +import ( + "fmt" + "github.com/rs/zerolog" + "io" + "log" + "log/syslog" + "os" + "regexp" + "strings" + "time" +) + +// We will use this package to wrap log messages coming from libraries who have no interest +// in generating structured output. + +var ( + ldapliblogmatcher = regexp.MustCompile(`^\d{4}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2} `) +) + +func InitLogging(reqdebug bool, reqsyslog bool, reqstructlog bool) zerolog.Logger { + var level zerolog.Level + if reqdebug { + level = zerolog.DebugLevel + } else { + level = zerolog.InfoLevel + } + + var mainWriter io.Writer + if reqstructlog { + // Vroom vroom + mainWriter = os.Stderr + zerolog.TimeFieldFormat = time.RFC1123Z + } else { + // This is the inefficient writer + mainWriter = zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.RFC1123Z} + } + + var logr zerolog.Logger + if reqsyslog { + s, err := syslog.New(syslog.LOG_INFO, "glauth") + if err != nil { + fmt.Println("Unable to write to syslog: ignoring...") + reqsyslog = false + } else { + writers := zerolog.MultiLevelWriter(mainWriter, zerolog.SyslogLevelWriter(s)) + logr = zerolog.New(writers).Level(level).With().Timestamp().Logger() + } + } + + if !reqsyslog { + logr = zerolog.New(mainWriter).Level(level).With().Timestamp().Logger() + } + + log.SetOutput(customWriter{logr: logr, structlog: reqstructlog}) + + return logr +} + +type customWriter struct { + logr zerolog.Logger + structlog bool +} + +func (e customWriter) Write(p []byte) (int, error) { + submatchall := ldapliblogmatcher.FindAllString(string(p), 1) + var msg string + for _, element := range submatchall { + msg = strings.TrimSpace(string(p[len(element):])) + } + if msg == "" { + msg = strings.TrimSpace(string(p)) + } + if e.structlog { + fmt.Fprintf(os.Stderr, "{\"level\":\"info\",\"time\":\"%s\",\"message\":\"%s\"}\n", time.Now().Format(time.RFC1123Z), strings.Replace(strings.TrimSpace(msg), `"`, `\"`, -1)) + } else { + e.logr.Info().Msg(msg) + } + return len(p), nil +} diff --git a/v2/pkg/logging/loghandler.go b/v2/pkg/logging/loghandler_windows.go similarity index 63% rename from v2/pkg/logging/loghandler.go rename to v2/pkg/logging/loghandler_windows.go index 674357d..b538cc0 100644 --- a/v2/pkg/logging/loghandler.go +++ b/v2/pkg/logging/loghandler_windows.go @@ -1,8 +1,12 @@ +//go:build windows +// +build windows + package logging import ( "fmt" "github.com/rs/zerolog" + "io" "log" "os" "regexp" @@ -17,8 +21,29 @@ var ( ldapliblogmatcher = regexp.MustCompile(`^\d{4}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2} `) ) -func RewireLogging(logr zerolog.Logger, reqstructlog bool) { +func InitLogging(reqdebug bool, reqsyslog bool, reqstructlog bool) zerolog.Logger { + var level zerolog.Level + if reqdebug { + level = zerolog.DebugLevel + } else { + level = zerolog.InfoLevel + } + + var mainWriter io.Writer + if reqstructlog { + // Vroom vroom + mainWriter = os.Stderr + zerolog.TimeFieldFormat = time.RFC1123Z + } else { + // This is the inefficient writer + mainWriter = zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.RFC1123Z} + } + + logr := zerolog.New(mainWriter).Level(level).With().Timestamp().Logger() + log.SetOutput(customWriter{logr: logr, structlog: reqstructlog}) + + return logr } type customWriter struct { From 0ccf4926ff4181fd472e1edae8c88d9cc62a731b Mon Sep 17 00:00:00 2001 From: Brian Candler Date: Wed, 12 Apr 2023 16:01:07 +0100 Subject: [PATCH 3/3] Construct DNs under ou=users for uniqueMember group attribute Before: dn: ou=vpn,ou=users,dc=glauth,dc=com ... uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com After: dn: ou=vpn,ou=users,dc=glauth,dc=com ... uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com ^^^^^^^^ --- v2/pkg/handler/config.go | 4 +- v2/pkg/plugins/basesqlhandler.go | 4 +- v2/scripts/ci/good-results/posixGroupList0 | 56 +++++++++++----------- 3 files changed, 32 insertions(+), 32 deletions(-) diff --git a/v2/pkg/handler/config.go b/v2/pkg/handler/config.go index ab2ef5a..4952c8f 100644 --- a/v2/pkg/handler/config.go +++ b/v2/pkg/handler/config.go @@ -238,12 +238,12 @@ func (h configHandler) getGroupMemberDNs(gid int) []string { members := make(map[string]bool) for _, u := range h.cfg.Users { if u.PrimaryGroup == gid { - dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) + dn := fmt.Sprintf("%s=%s,%s=%s,ou=users,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) members[dn] = true } else { for _, othergid := range u.OtherGroups { if othergid == gid { - dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) + dn := fmt.Sprintf("%s=%s,%s=%s,ou=users,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) members[dn] = true } } diff --git a/v2/pkg/plugins/basesqlhandler.go b/v2/pkg/plugins/basesqlhandler.go index f29a27b..309185f 100644 --- a/v2/pkg/plugins/basesqlhandler.go +++ b/v2/pkg/plugins/basesqlhandler.go @@ -369,13 +369,13 @@ func (h databaseHandler) getGroupMemberDNs(gid int) []string { return []string{} } if u.PrimaryGroup == gid { - dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) + dn := fmt.Sprintf("%s=%s,%s=%s,ou=users,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) members[dn] = true } else { u.OtherGroups = h.commaListToIntTable(otherGroups) for _, othergid := range u.OtherGroups { if othergid == gid { - dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) + dn := fmt.Sprintf("%s=%s,%s=%s,ou=users,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN) members[dn] = true } } diff --git a/v2/scripts/ci/good-results/posixGroupList0 b/v2/scripts/ci/good-results/posixGroupList0 index b1fdccc..79d95b9 100644 --- a/v2/scripts/ci/good-results/posixGroupList0 +++ b/v2/scripts/ci/good-results/posixGroupList0 @@ -3,12 +3,12 @@ cn: superheros uid: superheros description: superheros gidNumber: 5501 -uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com +uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=johndoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com memberUid: alexdoe memberUid: hackers memberUid: jackdoe @@ -23,7 +23,7 @@ cn: svcaccts uid: svcaccts description: svcaccts gidNumber: 5502 -uniqueMember: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com +uniqueMember: cn=serviceuser,ou=svcaccts,ou=users,dc=glauth,dc=com memberUid: serviceuser objectClass: posixGroup objectClass: top @@ -33,12 +33,12 @@ cn: vpnaccess uid: vpnaccess description: vpnaccess gidNumber: 5503 -uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com +uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=johndoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com memberUid: alexdoe memberUid: hackers memberUid: jackdoe @@ -53,13 +53,13 @@ cn: allaccs uid: allaccs description: allaccs gidNumber: 5504 -uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com +uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=johndoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=serviceuser,ou=svcaccts,ou=users,dc=glauth,dc=com memberUid: alexdoe memberUid: hackers memberUid: jackdoe @@ -75,10 +75,10 @@ cn: mailadmin uid: mailadmin description: mailadmin gidNumber: 5505 -uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com +uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com memberUid: alexdoe memberUid: jackdoe memberUid: jamesdoe @@ -99,10 +99,10 @@ cn: fulltime uid: fulltime description: fulltime gidNumber: 5507 -uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com -uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com +uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com +uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com memberUid: alexdoe memberUid: jackdoe memberUid: jamesdoe