diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..40617d5 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +# Ignore default config file for testing +glauth.cfg + +# Ignore the built binary during testing +glauth diff --git a/README.md b/README.md index 54e7763..9351bd6 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,43 @@ In order to use S3, you must set your AWS credentials. Either: More configuration options are documented here: https://github.com/nmcclain/glauth/blob/master/sample-simple.cfg +### Required Fields + * Name + * The user's username + * ou + * ID of the user's primary group + * uidbumber + * The user's unix user id + * sshPublicKey + * Specify an array of public keys + +### Optional Fields + * givenname + * First name + * Example: John + * default = blank + * sn + * Last name + * Example: Doe + * default = blank + * disabled + * Specify if account is active. + * Set to 'true' (without quotes) to make the LDAP entry add 'AccountStatus = inactive' + * default = false (active) + * mail + * Specify an email + * example: jdoe@example.com + * default = blank + * loginshell + * Specify a different login shell for the user + * Example: /bin/sh, or /sbin/nologin + * default = /bin/bash + * homedirectory + * Specify an overridden home directory for the user + * Example: /home/itadmin + * default = /home/[username] + + ### OpenSSH keys: GLAuth can store a user's SSH authorized keys. Add one or more keys per user as shown above, then setup the goklp helper: https://github.com/appliedtrust/goklp diff --git a/configbackend.go b/configbackend.go index ee84848..6f90c87 100644 --- a/configbackend.go +++ b/configbackend.go @@ -132,12 +132,43 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs := []*ldap.EntryAttribute{} attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{u.Name}}) attrs = append(attrs, &ldap.EntryAttribute{"uid", []string{u.Name}}) + + if len(u.GivenName) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"givenName", []string{u.GivenName}}) + } + + if len(u.SN) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"sn", []string{u.SN}}) + } + + attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}}) attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UnixID)}}) - attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}}) + + if (u.Disabled) { + attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"inactive"}}) + } else { + attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}}) + } + + if len(u.Mail) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"mail", []string{u.Mail}}) + } + attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}}) - attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) - attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) + + if len(u.LoginShell) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{u.LoginShell}}) + } else { + attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) + } + + if len(u.Homedir) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{u.Homedir}}) + } else { + attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) + } + attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", u.Name)}}) attrs = append(attrs, &ldap.EntryAttribute{"gecos", []string{fmt.Sprintf("%s via LDAP", u.Name)}}) attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", u.PrimaryGroup)}}) diff --git a/glauth.go b/glauth.go index ea4282f..d95ab22 100644 --- a/glauth.go +++ b/glauth.go @@ -73,7 +73,13 @@ type configUser struct { PassSHA256 string PrimaryGroup int SSHKeys []string + Disabled bool UnixID int + Mail string + LoginShell string + GivenName string + SN string + Homedir string } type configGroup struct { Name string