refactor: table-drive batteryOfTests to cut duplication

The twelve battery cases were near-identical closures: the same ldapsearch
argument prefix, the same got/want compare, the same t.Fatalf shape. Collapse
them into table rows holding only what differs (args, want, message) and run
them through one loop.

Shared argument builders (bind/svc/otp) remove the repeated
-LLL/-H/-D/-w/-x prefix; the two getSecond cases set a line field instead of
duplicating the assertion block.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GdP1CLtdwAtAeXuS4hph6g

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-24.04
     strategy:
       matrix:
-        go-version: [1.21.x]
+        go-version: [1.25.x]
     steps:
       - name: Install Go
         uses: actions/setup-go@v4

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  "v2": "2.5.0"
+  "v2": "2.5.2"
 }

README.md

@@ -21,7 +21,7 @@ Use it to centralize account management across your Linux servers, your OSX mach
 
 ### Contributing
 - Please base all Pull Requests on [dev](https://github.com/glauth/glauth/tree/dev), not master.
-- Format your code autonmatically using `gofmt -d ./` before committing
+- Format your code automatically using `gofmt -d ./` before committing
 
 ### Quickstart
 This quickstart is a great way to try out GLAuth in a non-production environment.  *Be warned that you should take the extra steps to setup SSL (TLS) for production use!*

go.work

@@ -1,5 +1,3 @@
-go 1.21.0
-
-toolchain go1.21.5
+go 1.25.0
 
 use ./v2

release-please-config.json

@@ -5,7 +5,7 @@
       "package-name": "GLAuth",
       "pull-request-title-pattern": "ci: release ${version}",
       "extra-files": [
-        "v2/internal/version/const.go"
+        "internal/version/const.go"
       ]
     }
   },

v2/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [2.5.2](https://github.com/glauth/glauth/compare/GLAuth-v2.5.1...GLAuth-v2.5.2) (2026-07-25)
+
+
+### Features
+
+* check plugin compatibility at release time ([700745e](https://github.com/glauth/glauth/commit/700745e640c5371361a58ef3c90245a4637c5224))
+
+## [2.5.1](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.1) (2026-07-18)
+
+
+### Bug Fixes
+
+* reject disabled users on all backends in Bind ([#470](https://github.com/glauth/glauth/issues/470)) ([fb65713](https://github.com/glauth/glauth/commit/fb65713fbdfd626cb033675fb42724a5fb3d06ff))
+* team atlanta arbitrary password ([#471](https://github.com/glauth/glauth/issues/471)) ([cb121cd](https://github.com/glauth/glauth/commit/cb121cdc2c9b831abdf7831835ec30ead2536a7a))
+
 ## [2.5.0](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.0) (2026-04-19)
 
 

v2/Makefile

@@ -2,7 +2,7 @@
 
 MAKEFLAGS += --no-print-directory
 
-VERSION=$(shell bin/linuxamd64/glauth --version)
+VERSION=$(shell if [ -x bin/linuxamd64/glauth ]; then bin/linuxamd64/glauth --version; else bin/glauth-linux-amd64 --version; fi)
 
 GIT_COMMIT=$(shell git rev-list -1 HEAD )
 BUILD_TIME=$(shell date -u +%Y%m%d_%H%M%SZ)
@@ -58,10 +58,9 @@ mocks:
 vet:
 	-go vet ./...
 .PHONY: vet
-#test: @ runs the integration test on linuxamd64 (eventually allow the binary to be set)
+#test: @ runs package, root integration, and shell integration tests
 test: mocks vet
-	# also run unit tests for packages, skip glauth_test.go for now
-	go test -v -cover -coverprofile coverage.out ./pkg/... ./internal/...
+	go test -v -cover -coverprofile coverage.out ./pkg/... ./internal/... .
 	$(MAKE) runtest
 #all: @ run build process for all binaries
 all: setup binaries verify
@@ -120,6 +119,39 @@ format:
 devrun:
 	go run ${BUILD_FILES} -c sample-simple.cfg
 
+#testplugin: @ start GLAuth with a dynamically loaded plugin and stop it cleanly
+GLAUTH_BIN?=bin/glauth-linux-amd64
+PLUGIN_BIN?=bin/sqlite-linux-amd64.so
+PLUGIN_CONFIG?=pkg/plugins/glauth-sqlite/sample-database.cfg
+PLUGIN_LDAP_PORT?=13893
+PLUGIN_API_PORT?=15555
+
+testplugin:
+	@set -e; \
+	test -x "$(GLAUTH_BIN)"; \
+	test -r "$(PLUGIN_BIN)"; \
+	test -f "$(PLUGIN_CONFIG)"; \
+	tmpdir=$$(mktemp -d); \
+	trap 'rm -rf "$$tmpdir"' EXIT; \
+	sed \
+		-e 's#^[[:space:]]*plugin = .*#  plugin = "$(abspath $(PLUGIN_BIN))"#' \
+		-e "s#^[[:space:]]*database = .*#  database = \"$$tmpdir/gl.db\"#" \
+		-e 's#listen = "0.0.0.0:3893"#listen = "127.0.0.1:$(PLUGIN_LDAP_PORT)"#' \
+		-e 's#listen = "0.0.0.0:5555"#listen = "127.0.0.1:$(PLUGIN_API_PORT)"#' \
+		"$(PLUGIN_CONFIG)" > "$$tmpdir/config.cfg"; \
+	"$(GLAUTH_BIN)" -c "$$tmpdir/config.cfg" > "$$tmpdir/glauth.log" 2>&1 & \
+	pid=$$!; \
+	sleep 2; \
+	if ! kill -0 "$$pid" 2>/dev/null; then \
+		set +e; wait "$$pid"; status=$$?; set -e; \
+		cat "$$tmpdir/glauth.log"; \
+		exit $$status; \
+	fi; \
+	kill -TERM "$$pid"; \
+	set +e; wait "$$pid"; status=$$?; set -e; \
+	cat "$$tmpdir/glauth.log"; \
+	exit $$status
+
 mkbindir:
 	@echo "create directory bin/$(GOOS)$(GOARCH)"
 	@mkdir -p bin/$(GOOS)$(GOARCH)
@@ -269,7 +301,7 @@ _checkdockerauth:
 builddockermain:
 	$(if $(TAG),,$(error ❌ Must set TAG))
 	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
-	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \
+	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 docker/assets/linux/riscv64 && \
 	cp -f bin/glauth-linux-amd64 docker/assets/linux/amd64/glauth && \
 	cp -f bin/glauth-linux-arm64 docker/assets/linux/arm64/glauth && \
 	cp -f bin/glauth-linux-arm-7 docker/assets/linux/arm/v7/glauth && \
@@ -280,7 +312,7 @@ builddockermain:
 builddockerplugins:
 	$(if $(TAG),,$(error ❌ Must set TAG))
 	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
-	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \
+	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 docker/assets/linux/riscv64 && \
 	cp -f bin/sqlite-linux-amd64.so docker/assets/linux/amd64/sqlite.so && \
 	cp -f bin/sqlite-linux-arm64.so docker/assets/linux/arm64/sqlite.so && \
 	cp -f bin/sqlite-linux-arm-7.so docker/assets/linux/arm/v7/sqlite.so && \
@@ -298,7 +330,7 @@ builddockerplugins:
 
 builddocker: _checkdockerauth builddockermain builddockerplugins
 
-buildeverything: prepbuild forget-embed _buildmain _buildplugins remember-embed _buildmainembeds builddocker
+buildeverything: prepbuild forget-embed _buildplugins _buildmain testplugin remember-embed _buildmainembeds builddocker
 
 #testdocker: @ run integration test using docker
 testdocker:
@@ -344,4 +376,4 @@ testdocker:
 	prepbuild run test fast binaries setup getdeps runtest updatetest format devrun \
 	linux386 linuxamd64 linuxarm linuxarm64 linuxriscv64 darwinamd64 darwinarm64 win386 winamd64 verify \
 	pull-plugin pull-base-plugins forget-plugin forget-plugins buildmain buildplugin build \
-	buildplugins builddockermain builddockerplugins builddocker testdocker buildeverything
+	buildplugins builddockermain builddockerplugins builddocker testdocker testplugin buildeverything

v2/glauth_test.go

@@ -1,11 +1,20 @@
 package main
 
 import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
 	"os"
 	"os/exec"
+	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/glauth/ldap"
+	"github.com/pquerna/otp/totp"
 )
 
 type testEnv struct {
@@ -23,10 +32,31 @@ type testEnv struct {
 	checkemployeetype     string
 }
 
+func glauthBinary() string {
+	if binary := os.Getenv("GLAUTH_TEST_BINARY"); binary != "" {
+		return binary
+	}
+
+	qualified := filepath.Join("bin", runtime.GOOS+runtime.GOARCH, "glauth")
+	if _, err := os.Stat(qualified); err == nil {
+		return qualified
+	}
+
+	distribution := filepath.Join("bin", "glauth-"+runtime.GOOS+"-"+runtime.GOARCH)
+	if runtime.GOOS == "windows" {
+		distribution += ".exe"
+	}
+	if _, err := os.Stat(distribution); err == nil {
+		return distribution
+	}
+
+	return "bin/glauth"
+}
+
 func TestProperBuild(t *testing.T) {
-	info, err := os.Stat("bin/glauth")
+	info, err := os.Stat(glauthBinary())
 	if err != nil {
-		t.Error(err)
+		t.Fatal(err)
 	}
 	mode := uint32(info.Mode())
 	if mode&0b001001001 == 0 {
@@ -34,147 +64,229 @@ func TestProperBuild(t *testing.T) {
 	}
 }
 
+func TestConfigBackendRejectsPasswordlessUserBinds(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := listener.Addr().(*net.TCPAddr).Port
+	listener.Close()
+
+	configPath := filepath.Join(t.TempDir(), "passwordless.cfg")
+	config := fmt.Sprintf(`debug = false
+
+[ldap]
+  enabled = true
+  listen = "127.0.0.1:%d"
+  tls = false
+
+[ldaps]
+  enabled = false
+
+[backend]
+  datastore = "config"
+  baseDN = "dc=glauth,dc=com"
+
+[behaviors]
+  LimitFailedBinds = false
+
+[[groups]]
+  name = "svc"
+  gidnumber = 5501
+
+[[users]]
+  name = "nopass"
+  uidnumber = 5001
+  primarygroup = 5501
+    [[users.capabilities]]
+    action = "search"
+    object = "*"
+`, port)
+	if err := os.WriteFile(configPath, []byte(config), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	svc := startSvc(t, fmt.Sprintf("127.0.0.1:%d", port), glauthBinary(), "-c", configPath)
+	defer stopSvc(svc)
+
+	bindDN := "cn=nopass,dc=glauth,dc=com"
+	for _, tc := range []struct {
+		name     string
+		password string
+		want     string
+	}{
+		{name: "arbitrary password", password: "definitely-wrong", want: "exit status 49"},
+		{name: "empty password", password: "", want: "exit status 53"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := runAndSelect(t, getFirst, "ldapsearch", "-LLL", "-H", fmt.Sprintf("ldap://127.0.0.1:%d", port), "-D", bindDN, "-w", tc.password, "-x", "-b", "dc=glauth,dc=com", "(cn=nopass)")
+			if got != tc.want {
+				t.Fatalf("bind result = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func ldapOnlyConfig(t *testing.T, source string) string {
+	t.Helper()
+	data, err := os.ReadFile(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	contents := string(data)
+	sectionMarker := "\n[ldaps]\n"
+	markerStart := strings.Index(contents, sectionMarker)
+	if markerStart < 0 {
+		t.Fatalf("%s has no [ldaps] section", source)
+	}
+	start := markerStart + 1
+	relEnd := strings.Index(contents[start+len("[ldaps]"):], "\n[")
+	if relEnd < 0 {
+		t.Fatalf("%s has no section after [ldaps]", source)
+	}
+	end := start + len("[ldaps]") + relEnd
+	section := contents[start:end]
+	sectionWithoutLDAPS := strings.Replace(section, "enabled = true", "enabled = false", 1)
+	if section == sectionWithoutLDAPS {
+		t.Fatalf("%s [ldaps] section does not enable LDAPS", source)
+	}
+
+	contents = contents[:start] + sectionWithoutLDAPS + contents[end:]
+	path := filepath.Join(t.TempDir(), filepath.Base(source))
+	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
 func batteryOfTests(t *testing.T, env *testEnv) {
+	// We aren't checking that "github.com/pquerna/otp/totp" creates correct values.
+	// That's what their own tests are for.
+	// We are checking that the totp code gets through glauth code successfully
+	otpvalue, err := totp.GenerateCode("3hnvnk4ycv44glzigd6s25j4dougs3rk", time.Now())
+	if err != nil {
+		t.Fatal("Failed to generate totp code:", err)
+	}
+
+	const addr = "ldap://127.0.0.1:3893"
+	bind := func(dn, password string, rest ...string) []string {
+		return append([]string{"-LLL", "-H", addr, "-D", dn, "-w", password, "-x"}, rest...)
+	}
+	svc := func(rest ...string) []string { return bind(env.svcdn, "mysecret", rest...) }
+	otp := func(password string) []string {
+		return bind(env.otpdn, password, "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
+	}
+
+	const (
+		inSuperheros = "should find them in the 'superheros' group"
+		listFromUser = "should get a list starting with the 'hackers' user"
+		badCreds     = "should get 'Invalid credentials(49)'"
+	)
+
 	tests := []struct {
-		Name  string
-		Path  string
-		Check func(t testing.TB)
+		name string
+		skip bool
+		args []string
+		line func(string) string
+		want string
+		msg  string
 	}{
 		{
-			Name: "searching for the 'hackers' user",
-			Check: func(t testing.TB) {
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-				if got, want := out, env.expectedaccount; got != want {
-					t.Fatalf("should find them in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hackers' user",
+			args: svc("-bdc=glauth,dc=com", "cn=hackers"),
+			want: env.expectedaccount,
+			msg:  inSuperheros,
 		},
 		{
-			Name: "searching for the 'hackers' user without binding with a group",
-			Check: func(t testing.TB) {
-				if env.svcdnnogroup == "" {
-					t.SkipNow()
-				}
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdnnogroup, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-				if got, want := out, env.expectedaccount; got != want {
-					t.Fatalf("should find them in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hackers' user without binding with a group",
+			skip: env.svcdnnogroup == "",
+			args: bind(env.svcdnnogroup, "mysecret", "-bdc=glauth,dc=com", "cn=hackers"),
+			want: env.expectedaccount,
+			msg:  inSuperheros,
 		},
 		{
-			Name: "searching for the 'hackers' user after binding using the account's UPN",
-			Check: func(t testing.TB) {
-				if !env.checkbindUPN {
-					t.SkipNow()
-				}
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", "serviceuser@example.com", "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-				if got, want := out, env.expectedaccount; got != want {
-					t.Fatalf("should find them in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hackers' user after binding using the account's UPN",
+			skip: !env.checkbindUPN,
+			args: bind("serviceuser@example.com", "mysecret", "-bdc=glauth,dc=com", "cn=hackers"),
+			want: env.expectedaccount,
+			msg:  inSuperheros,
 		},
 		{
-			Name: "querying the root SDE",
-			Check: func(t testing.TB) {
-				out := doRunGetSecond(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-s", "base", "(objectclass=*)")
-				if got, want := out, env.expectedinfo; got != want {
-					t.Fatalf("should get some meta information\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "querying the root SDE",
+			args: svc("-s", "base", "(objectclass=*)"),
+			line: getSecond,
+			want: env.expectedinfo,
+			msg:  "should get some meta information",
 		},
 		{
-			Name: "querying the root SDE anonymously without authorizing in config file",
-			Check: func(t testing.TB) {
-				if !env.checkanonymousrootDSE {
-					t.SkipNow()
-				}
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-x", "-s", "base", "(objectclass=*)")
-				if got, want := out, "exit status 50"; got != want {
-					t.Fatalf("should get error 50\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "querying the root SDE anonymously without authorizing in config file",
+			skip: !env.checkanonymousrootDSE,
+			args: []string{"-LLL", "-H", addr, "-x", "-s", "base", "(objectclass=*)"},
+			want: "exit status 50",
+			msg:  "should get error 50",
 		},
 		{
-			Name: "enumerating posix groups",
-			Check: func(t testing.TB) {
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(objectclass=posixgroup)")
-				if got, want := out, env.expectedgroup; got != want {
-					t.Fatalf("should get a list starting with the 'superheros' group\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "enumerating posix groups",
+			args: svc("-bdc=glauth,dc=com", "(objectclass=posixgroup)"),
+			want: env.expectedgroup,
+			msg:  "should get a list starting with the 'superheros' group",
 		},
 		{
-			Name: "searching for members of the 'superheros' group",
-			Check: func(t testing.TB) {
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com)")
-				if got, want := out, env.expectedfirstaccount; got != want {
-					t.Fatalf("should get a list starting with the 'hackers' user\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for members of the 'superheros' group",
+			args: svc("-bdc=glauth,dc=com", "(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com)"),
+			want: env.expectedfirstaccount,
+			msg:  listFromUser,
 		},
 		{
-			Name: "performing a complex search for members of 'superheros' group",
-			Check: func(t testing.TB) {
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(&(objectClass=*)(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com))")
-				if got, want := out, env.expectedfirstaccount; got != want {
-					t.Fatalf("should get a list starting with the 'hackers' user\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "performing a complex search for members of 'superheros' group",
+			args: svc("-bdc=glauth,dc=com", "(&(objectClass=*)(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com))"),
+			want: env.expectedfirstaccount,
+			msg:  listFromUser,
 		},
 		{
-			Name: "searching for the 'hacker' user using a TOTP-enabled account",
-			Check: func(t testing.TB) {
-				if !env.checkTOTP {
-					t.SkipNow()
-				}
-				otpvalue := doRunGetFirst(RD, "oathtool", "--totp", "-b", "-d", "6", "3hnvnk4ycv44glzigd6s25j4dougs3rk")
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret"+otpvalue, "-x", "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
-				if got, want := out, env.scopedaccount; got != want {
-					t.Fatalf("should find them in in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hacker' user using a TOTP-enabled account",
+			skip: !env.checkTOTP,
+			args: otp("mysecret" + otpvalue),
+			want: env.scopedaccount,
+			msg:  inSuperheros,
 		},
 		{
-			Name: "searching for the 'hacker' user using a TOTP-enabled account and no value",
-			Check: func(t testing.TB) {
-				if !env.checkTOTP {
-					t.SkipNow()
-				}
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret", "-x", "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
-				if got, want := out, "exit status 49"; got != want {
-					t.Fatalf("should get 'Invalid credentials(49)'\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hacker' user using a TOTP-enabled account and no value",
+			skip: !env.checkTOTP,
+			args: otp("mysecret"),
+			want: "exit status 49",
+			msg:  badCreds,
 		},
 		{
-			Name: "searching for the 'hacker' user using a TOTP-enabled account and the wrong value",
-			Check: func(t testing.TB) {
-				if !env.checkTOTP {
-					t.SkipNow()
-				}
-				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret123456", "-x", "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
-				if got, want := out, "exit status 49"; got != want {
-					t.Fatalf("should get 'Invalid credentials(49)'\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hacker' user using a TOTP-enabled account and the wrong value",
+			skip: !env.checkTOTP,
+			args: otp("mysecret123456"),
+			want: "exit status 49",
+			msg:  badCreds,
 		},
 		{
-			Name: "searching for the 'hacker' user",
-			Check: func(t testing.TB) {
-				if env.checkemployeetype == "" {
-					t.SkipNow()
-				}
-				out := doRunGetSecond(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", env.checkemployeetype, "employeetype")
-				if got, want := out, "employeetype: Intern"; got != want {
-					t.Fatalf("type should be 'Intern'\ngot:  %s\nwant: %s", got, want)
-				}
-			},
+			name: "searching for the 'hacker' user",
+			skip: env.checkemployeetype == "",
+			args: svc("-bdc=glauth,dc=com", env.checkemployeetype, "employeetype"),
+			line: getSecond,
+			want: "employeetype: Intern",
+			msg:  "type should be 'Intern'",
 		},
 	}
 
 	for _, tc := range tests {
-		t.Run(tc.Name, func(t *testing.T) {
-			tc.Check(t)
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.skip {
+				t.SkipNow()
+			}
+			line := tc.line
+			if line == nil {
+				line = getFirst
+			}
+			if got := runAndSelect(t, line, "ldapsearch", tc.args...); got != tc.want {
+				t.Fatalf("%s\ngot:  %s\nwant: %s", tc.msg, got, tc.want)
+			}
 		})
 	}
 }
@@ -195,14 +307,15 @@ func TestSampleSimple(t *testing.T) {
 		checkemployeetype:     "cn=hackers",
 	}
 
-	svc := startSvc(SD, "bin/glauth", "-c", "sample-simple.cfg")
+	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", ldapOnlyConfig(t, "sample-simple.cfg"))
 	batteryOfTests(t, &env)
 	stopSvc(svc)
 }
 
 func TestSQLitePlugin(t *testing.T) {
-	matchingLibrary := doRunGetFirst(RD, "ls", "bin/sqlite.so")
-	if matchingLibrary != "bin/sqlite.so" {
+	_, err := os.Stat("bin/sqlite.so")
+	if err != nil {
+		t.Log("Unable to find sqlite plugin")
 		t.SkipNow()
 	}
 
@@ -221,14 +334,20 @@ func TestSQLitePlugin(t *testing.T) {
 		checkemployeetype:     "",
 	}
 
-	svc := startSvc(SD, "bin/glauth", "-c", "pkg/plugins/glauth-sqlite/sample-database.cfg")
+	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", "pkg/plugins/glauth-sqlite/sample-database.cfg")
 	batteryOfTests(t, &env)
 	stopSvc(svc)
 }
 
 func TestLdapInjection(t *testing.T) {
-	matchingContainers := doRunGetFirst(RD, "sh", "-c", "docker ps | grep ldap-service | wc -l")
+	out, err := doRun("sh", "-c", "docker ps | grep ldap-service | wc -l")
+	if err != nil {
+		t.Log("Unable to find docker container:", out)
+		t.SkipNow()
+	}
+	matchingContainers := getFirst(out)
 	if matchingContainers != "1" {
+		t.Log("Unable to find docker container:", out)
 		t.SkipNow()
 	}
 
@@ -247,52 +366,89 @@ func TestLdapInjection(t *testing.T) {
 		checkemployeetype:     "",
 	}
 
-	svc := startSvc(SD, "bin/glauth", "-c", "sample-ldap-injection.cfg")
+	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", "sample-ldap-injection.cfg")
 	batteryOfTests(t, &env)
 	stopSvc(svc)
 }
 
 // -----=============================================================================----
-
-const SD = 3 // Start Delay
-const RD = 2 // Response Delay
-
-func startSvc(delay time.Duration, name string, arg ...string) *exec.Cmd {
-	cmd := exec.Command(name, arg...)
-	cmd.Start()
-	if delay != 0 {
-		time.Sleep(time.Second * delay)
+func waitForPort(host string, timeout time.Duration) error {
+	start := time.Now()
+	for {
+		conn, err := ldap.Dial("tcp", host)
+		if err == nil {
+			err = conn.Bind("_", "_")
+			if err == nil {
+				conn.Close()
+				return fmt.Errorf("Successfully authenticated to glauth. This should not happen")
+			}
+			e := &ldap.Error{}
+			if errors.As(err, &e) && e.ResultCode == 49 {
+				conn.Close()
+				return nil
+			}
+			conn.Close()
+			// We have an error, it's probably a connection error or an error saying that ldap isn't setup yet
+			// try again
+		}
+		if time.Since(start) > timeout {
+			return fmt.Errorf("timeout waiting for port %s: %w", host, err)
+		}
+		time.Sleep(50 * time.Millisecond)
 	}
+}
+
+func startSvc(t *testing.T, addr string, name string, arg ...string) *exec.Cmd {
+	cmd := exec.Command(name, arg...)
+	cmd.Stderr = t.Output()
+	cmd.Stdout = t.Output()
+	if err := cmd.Start(); err != nil {
+		t.Fatal("Failed to start glauth:", err)
+	}
+	if err := waitForPort(addr, time.Second*2); err != nil {
+		t.Fatal("Failed to wait for glauth to start:", err)
+	}
+	// the port is listening but the ldap server may not be accepting connections yet
+	// TODO: make glauth listen as the last part of the initialization that way as soon as it listens it can process connections
 	return cmd
 }
 
 func stopSvc(svc *exec.Cmd) {
 	svc.Process.Kill()
+	svc.Process.Wait()
 }
 
-func doRunGetFirst(delay time.Duration, name string, arg ...string) string {
-	out := strings.SplitN(doRun(delay, name, arg...), "\n", 2)
-	if out == nil || len(out) < 1 {
+func getFirst(output string) string {
+	out := strings.SplitN(output, "\n", 2)
+	if len(out) < 1 {
 		return "*fail*"
 	}
 	return out[0]
 }
 
-func doRunGetSecond(delay time.Duration, name string, arg ...string) string {
-	out := strings.SplitN(doRun(delay, name, arg...), "\n", 3)
-	if out == nil || len(out) < 2 {
+func getSecond(output string) string {
+	out := strings.SplitN(output, "\n", 3)
+	if len(out) < 2 {
 		return "*fail*"
 	}
 	return out[1]
 }
 
-func doRun(delay time.Duration, name string, arg ...string) string {
-	out, err := exec.Command(name, arg...).Output()
+func doRun(name string, arg ...string) (string, error) {
+	out, err := exec.Command(name, arg...).CombinedOutput()
 	if err != nil {
+		return string(bytes.TrimSpace(out)), err
+	}
+
+	return string(bytes.TrimSpace(out)), nil
+}
+
+func runAndSelect(t testing.TB, pick func(string) string, name string, arg ...string) string {
+	t.Helper()
+	out, err := doRun(name, arg...)
+	if err != nil {
+		t.Log(out)
 		return err.Error()
 	}
-	if delay != 0 {
-		time.Sleep(time.Second * delay)
-	}
-	return strings.TrimSpace(string(out))
+	return pick(out)
 }

v2/go.mod

@@ -1,6 +1,6 @@
 module github.com/glauth/glauth/v2
 
-go 1.21
+go 1.25
 
 require (
 	github.com/BurntSushi/toml v1.3.2

v2/go.sum

@@ -15,6 +15,8 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=

v2/internal/version/const.go

@@ -2,4 +2,4 @@ package version
 
 // Version is the tag of the latest release, it gets changed by the ci
 // process when a release is happening
-const Version = "v2.5.0" // x-release-please-version
+const Version = "v2.5.2" // x-release-please-version

v2/pkg/handler/ldap.go

@@ -121,6 +121,8 @@ func (h ldapHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (result ld
 
 		validotp := false
 
+		// Local records augment proxy authentication with OTP/YubiKey checks;
+		// password authentication remains delegated to the upstream LDAP server.
 		// Find the user
 		// We are going to go through all backends and ask
 		// until we find our user or die of boredom.

v2/pkg/handler/ldapopshelper.go

@@ -65,6 +65,10 @@ func NewLDAPOpsHelper(tracer trace.Tracer) LDAPOpsHelper {
 	return helper
 }
 
+func isUnauthenticatedSimpleBind(bindDN, bindSimplePw string) bool {
+	return bindDN != "" && bindSimplePw == ""
+}
+
 func (l LDAPOpsHelper) Bind(ctx context.Context, h LDAPOpsHandler, bindDN, bindSimplePw string, conn net.Conn) (resultCode ldap.LDAPResultCode, err error) {
 	ctx, span := l.tracer.Start(ctx, "handler.LDAPOpsHelper.Bind")
 	defer span.End()
@@ -86,6 +90,13 @@ func (l LDAPOpsHelper) Bind(ctx context.Context, h LDAPOpsHandler, bindDN, bindS
 		return ldap.LDAPResultSuccess, nil
 	}
 
+	// A non-empty DN with an empty password is LDAP's unauthenticated bind
+	// mechanism. It must not establish the named user's authorization state.
+	if isUnauthenticatedSimpleBind(bindDN, bindSimplePw) {
+		h.GetLog().Info().Str("binddn", bindDN).Str("src", conn.RemoteAddr().String()).Msg("unauthenticated bind rejected")
+		return ldap.LDAPResultUnwillingToPerform, nil
+	}
+
 	user, ldapcode := l.findUser(ctx, h, bindDN, true /* checkGroup */)
 	if ldapcode != ldap.LDAPResultSuccess {
 		return ldapcode, nil
@@ -181,6 +192,15 @@ func (l LDAPOpsHelper) Bind(ctx context.Context, h LDAPOpsHandler, bindDN, bindS
 		return ldap.LDAPResultInvalidCredentials, nil
 	}
 
+	// Reaching this point without a configured primary password verifier must
+	// not be treated as successful authentication. App-password matches and
+	// custom authentication return above when they succeed.
+	if user.PassBcrypt == "" && user.PassSHA256 == "" {
+		h.GetLog().Info().Str("binddn", bindDN).Str("src", conn.RemoteAddr().String()).Msg("invalid credentials")
+		l.maybePutInTimeout(ctx, h, conn, true)
+		return ldap.LDAPResultInvalidCredentials, nil
+	}
+
 	// Now, check the pasword hash
 	if user.PassBcrypt != "" {
 		decoded, err := hex.DecodeString(user.PassBcrypt)

v2/pkg/handler/ldapopshelper_test.go

@@ -0,0 +1,141 @@
+package handler
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"net"
+	"testing"
+
+	"github.com/GeertJohan/yubigo"
+	"github.com/rs/zerolog"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/glauth/glauth/v2/pkg/config"
+	"github.com/glauth/ldap"
+)
+
+type bindTestHandler struct {
+	backend config.Backend
+	cfg     config.Config
+	log     zerolog.Logger
+	user    config.User
+}
+
+func (h *bindTestHandler) GetBackend() config.Backend { return h.backend }
+func (h *bindTestHandler) GetLog() *zerolog.Logger    { return &h.log }
+func (h *bindTestHandler) GetCfg() *config.Config     { return &h.cfg }
+func (h *bindTestHandler) GetYubikeyAuth() *yubigo.YubiAuth {
+	return nil
+}
+
+func (h *bindTestHandler) FindUser(_ context.Context, userName string, _ bool) (bool, config.User, error) {
+	if userName == h.user.Name {
+		return true, h.user, nil
+	}
+	return false, config.User{}, nil
+}
+
+func (h *bindTestHandler) FindGroup(context.Context, string) (bool, config.Group, error) {
+	return false, config.Group{}, nil
+}
+
+func (h *bindTestHandler) FindPosixAccounts(context.Context, string) ([]*ldap.Entry, error) {
+	return nil, nil
+}
+
+func (h *bindTestHandler) FindPosixGroups(context.Context, string) ([]*ldap.Entry, error) {
+	return nil, nil
+}
+
+func sha256Password(password string) string {
+	hash := sha256.Sum256([]byte(password))
+	return hex.EncodeToString(hash[:])
+}
+
+func TestLDAPOpsHelperBindRejectsUnauthenticatedAndPasswordlessBinds(t *testing.T) {
+	tests := []struct {
+		name       string
+		password   string
+		user       config.User
+		wantResult ldap.LDAPResultCode
+	}{
+		{
+			name:       "named empty password is unauthenticated bind",
+			password:   "",
+			wantResult: ldap.LDAPResultUnwillingToPerform,
+		},
+		{
+			name:       "arbitrary password without verifier",
+			password:   "definitely-wrong",
+			wantResult: ldap.LDAPResultInvalidCredentials,
+		},
+		{
+			name: "failed app password does not fall through",
+			user: config.User{
+				Name:          "nopass",
+				PassAppSHA256: []string{sha256Password("expected")},
+			},
+			password:   "definitely-wrong",
+			wantResult: ldap.LDAPResultInvalidCredentials,
+		},
+		{
+			name: "matching primary password succeeds",
+			user: config.User{
+				Name:       "nopass",
+				PassSHA256: sha256Password("correct"),
+			},
+			password:   "correct",
+			wantResult: ldap.LDAPResultSuccess,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			user := tt.user
+			if user.Name == "" {
+				user.Name = "nopass"
+			}
+			h := &bindTestHandler{
+				backend: config.Backend{
+					BaseDN:             "dc=glauth,dc=com",
+					NameFormatAsArray:  []string{"cn"},
+					GroupFormatAsArray: []string{"ou"},
+				},
+				user: user,
+				log:  zerolog.Nop(),
+			}
+			conn, peer := net.Pipe()
+			defer conn.Close()
+			defer peer.Close()
+
+			helper := NewLDAPOpsHelper(trace.NewNoopTracerProvider().Tracer("bind-test"))
+			got, err := helper.Bind(context.Background(), h, "cn=nopass,dc=glauth,dc=com", tt.password, conn)
+			if err != nil {
+				t.Fatalf("Bind returned error: %v", err)
+			}
+			if got != tt.wantResult {
+				t.Fatalf("Bind result = %v, want %v", got, tt.wantResult)
+			}
+		})
+	}
+}
+
+func TestLDAPOpsHelperBindAllowsAnonymousBind(t *testing.T) {
+	h := &bindTestHandler{
+		backend: config.Backend{BaseDN: "dc=glauth,dc=com"},
+		log:     zerolog.Nop(),
+	}
+	conn, peer := net.Pipe()
+	defer conn.Close()
+	defer peer.Close()
+
+	helper := NewLDAPOpsHelper(trace.NewNoopTracerProvider().Tracer("bind-test"))
+	got, err := helper.Bind(context.Background(), h, "", "", conn)
+	if err != nil {
+		t.Fatalf("Bind returned error: %v", err)
+	}
+	if got != ldap.LDAPResultSuccess {
+		t.Fatalf("Bind result = %v, want %v", got, ldap.LDAPResultSuccess)
+	}
+}

v2/scripts/ci/integration-test.sh

@@ -24,6 +24,22 @@ echo "Fixing CI_BUILD_DIR"
 
 # This script requires that "$CI_BUILD_DIR" is set to the repo root
 
+GOOS="$(go env GOOS)"
+GOARCH="$(go env GOARCH)"
+if [[ "$GOARCH" = "arm" ]]; then
+	DIST_ARCH="arm-$(go env GOARM)"
+else
+	DIST_ARCH="$GOARCH"
+fi
+GLAUTH_BINARY="$CI_BUILD_DIR/bin/$GOOS$GOARCH/glauth"
+if [[ ! -x "$GLAUTH_BINARY" ]]; then
+	GLAUTH_BINARY="$CI_BUILD_DIR/bin/glauth-$GOOS-$DIST_ARCH"
+fi
+if [[ ! -x "$GLAUTH_BINARY" ]]; then
+	echo "Unable to find a runnable GLAuth binary: $GLAUTH_BINARY"
+	exit 1
+fi
+
 # Ensure ldap utils are installed (for example - when running this outside of CI)
 if [[ ! `which ldapsearch` ]]; then
 	sudo apt-get -qq update && sudo apt-get -qq install -y ldap-utils || exit 1;
@@ -33,11 +49,11 @@ fi
 echo "";
 echo ""
 echo "Version string of tested binary:"
-"$CI_BUILD_DIR/bin/$(go env GOOS)$(go env GOARCH)/glauth" --version
+"$GLAUTH_BINARY" --version
 echo ""
 
 # Start in background, capture PID
-"$CI_BUILD_DIR/bin/$(go env GOOS)$(go env GOARCH)/glauth" -c "$CI_BUILD_DIR/scripts/ci/test-config.cfg" &> /dev/null &
+"$GLAUTH_BINARY" -c "$CI_BUILD_DIR/scripts/ci/test-config.cfg" &> /dev/null &
 
 # Use this instead to see glauth logs while running
 # "$CI_BUILD_DIR/bin/$(go env GOOS)$(go env GOARCH)/glauth" -c "$CI_BUILD_DIR/scripts/ci/test-config.cfg" &