Merge branch 'master' into pr-470

A user with disabled = true could still bind on the config backend, since
configHandler.FindUser and LDAPOpsHelper.Bind never checked Disabled while the
SQL backends drop such users at lookup. Enforce it in Bind so every backend
behaves the same.

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-24.04
     strategy:
       matrix:
-        go-version: [1.25.x]
+        go-version: [1.21.x]
     steps:
       - name: Install Go
         uses: actions/setup-go@v4

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  "v2": "2.5.2"
+  "v2": "2.5.0"
 }

go.work

@@ -1,3 +1,5 @@
-go 1.25.0
+go 1.21.0
+
+toolchain go1.21.5
 
 use ./v2

release-please-config.json

@@ -5,7 +5,7 @@
       "package-name": "GLAuth",
       "pull-request-title-pattern": "ci: release ${version}",
       "extra-files": [
-        "internal/version/const.go"
+        "v2/internal/version/const.go"
       ]
     }
   },

v2/CHANGELOG.md

@@ -1,20 +1,5 @@
 # Changelog
 
-## [2.5.2](https://github.com/glauth/glauth/compare/GLAuth-v2.5.1...GLAuth-v2.5.2) (2026-07-25)
-
-
-### Features
-
-* check plugin compatibility at release time ([700745e](https://github.com/glauth/glauth/commit/700745e640c5371361a58ef3c90245a4637c5224))
-
-## [2.5.1](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.1) (2026-07-18)
-
-
-### Bug Fixes
-
-* reject disabled users on all backends in Bind ([#470](https://github.com/glauth/glauth/issues/470)) ([fb65713](https://github.com/glauth/glauth/commit/fb65713fbdfd626cb033675fb42724a5fb3d06ff))
-* team atlanta arbitrary password ([#471](https://github.com/glauth/glauth/issues/471)) ([cb121cd](https://github.com/glauth/glauth/commit/cb121cdc2c9b831abdf7831835ec30ead2536a7a))
-
 ## [2.5.0](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.0) (2026-04-19)
 
 

v2/Makefile

@@ -2,7 +2,7 @@
 
 MAKEFLAGS += --no-print-directory
 
-VERSION=$(shell if [ -x bin/linuxamd64/glauth ]; then bin/linuxamd64/glauth --version; else bin/glauth-linux-amd64 --version; fi)
+VERSION=$(shell bin/linuxamd64/glauth --version)
 
 GIT_COMMIT=$(shell git rev-list -1 HEAD )
 BUILD_TIME=$(shell date -u +%Y%m%d_%H%M%SZ)
@@ -119,39 +119,6 @@ format:
 devrun:
 	go run ${BUILD_FILES} -c sample-simple.cfg
 
-#testplugin: @ start GLAuth with a dynamically loaded plugin and stop it cleanly
-GLAUTH_BIN?=bin/glauth-linux-amd64
-PLUGIN_BIN?=bin/sqlite-linux-amd64.so
-PLUGIN_CONFIG?=pkg/plugins/glauth-sqlite/sample-database.cfg
-PLUGIN_LDAP_PORT?=13893
-PLUGIN_API_PORT?=15555
-
-testplugin:
-	@set -e; \
-	test -x "$(GLAUTH_BIN)"; \
-	test -r "$(PLUGIN_BIN)"; \
-	test -f "$(PLUGIN_CONFIG)"; \
-	tmpdir=$$(mktemp -d); \
-	trap 'rm -rf "$$tmpdir"' EXIT; \
-	sed \
-		-e 's#^[[:space:]]*plugin = .*#  plugin = "$(abspath $(PLUGIN_BIN))"#' \
-		-e "s#^[[:space:]]*database = .*#  database = \"$$tmpdir/gl.db\"#" \
-		-e 's#listen = "0.0.0.0:3893"#listen = "127.0.0.1:$(PLUGIN_LDAP_PORT)"#' \
-		-e 's#listen = "0.0.0.0:5555"#listen = "127.0.0.1:$(PLUGIN_API_PORT)"#' \
-		"$(PLUGIN_CONFIG)" > "$$tmpdir/config.cfg"; \
-	"$(GLAUTH_BIN)" -c "$$tmpdir/config.cfg" > "$$tmpdir/glauth.log" 2>&1 & \
-	pid=$$!; \
-	sleep 2; \
-	if ! kill -0 "$$pid" 2>/dev/null; then \
-		set +e; wait "$$pid"; status=$$?; set -e; \
-		cat "$$tmpdir/glauth.log"; \
-		exit $$status; \
-	fi; \
-	kill -TERM "$$pid"; \
-	set +e; wait "$$pid"; status=$$?; set -e; \
-	cat "$$tmpdir/glauth.log"; \
-	exit $$status
-
 mkbindir:
 	@echo "create directory bin/$(GOOS)$(GOARCH)"
 	@mkdir -p bin/$(GOOS)$(GOARCH)
@@ -301,7 +268,7 @@ _checkdockerauth:
 builddockermain:
 	$(if $(TAG),,$(error ❌ Must set TAG))
 	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
-	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 docker/assets/linux/riscv64 && \
+	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \
 	cp -f bin/glauth-linux-amd64 docker/assets/linux/amd64/glauth && \
 	cp -f bin/glauth-linux-arm64 docker/assets/linux/arm64/glauth && \
 	cp -f bin/glauth-linux-arm-7 docker/assets/linux/arm/v7/glauth && \
@@ -312,7 +279,7 @@ builddockermain:
 builddockerplugins:
 	$(if $(TAG),,$(error ❌ Must set TAG))
 	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
-	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 docker/assets/linux/riscv64 && \
+	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \
 	cp -f bin/sqlite-linux-amd64.so docker/assets/linux/amd64/sqlite.so && \
 	cp -f bin/sqlite-linux-arm64.so docker/assets/linux/arm64/sqlite.so && \
 	cp -f bin/sqlite-linux-arm-7.so docker/assets/linux/arm/v7/sqlite.so && \
@@ -330,7 +297,7 @@ builddockerplugins:
 
 builddocker: _checkdockerauth builddockermain builddockerplugins
 
-buildeverything: prepbuild forget-embed _buildplugins _buildmain testplugin remember-embed _buildmainembeds builddocker
+buildeverything: prepbuild forget-embed _buildmain _buildplugins remember-embed _buildmainembeds builddocker
 
 #testdocker: @ run integration test using docker
 testdocker:
@@ -376,4 +343,4 @@ testdocker:
 	prepbuild run test fast binaries setup getdeps runtest updatetest format devrun \
 	linux386 linuxamd64 linuxarm linuxarm64 linuxriscv64 darwinamd64 darwinarm64 win386 winamd64 verify \
 	pull-plugin pull-base-plugins forget-plugin forget-plugins buildmain buildplugin build \
-	buildplugins builddockermain builddockerplugins builddocker testdocker testplugin buildeverything
+	buildplugins builddockermain builddockerplugins builddocker testdocker buildeverything

v2/glauth_test.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"bytes"
-	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -12,9 +10,6 @@ import (
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/glauth/ldap"
-	"github.com/pquerna/otp/totp"
 )
 
 type testEnv struct {
@@ -41,15 +36,6 @@ func glauthBinary() string {
 	if _, err := os.Stat(qualified); err == nil {
 		return qualified
 	}
-
-	distribution := filepath.Join("bin", "glauth-"+runtime.GOOS+"-"+runtime.GOARCH)
-	if runtime.GOOS == "windows" {
-		distribution += ".exe"
-	}
-	if _, err := os.Stat(distribution); err == nil {
-		return distribution
-	}
-
 	return "bin/glauth"
 }
 
@@ -102,11 +88,11 @@ func TestConfigBackendRejectsPasswordlessUserBinds(t *testing.T) {
     action = "search"
     object = "*"
 `, port)
-	if err := os.WriteFile(configPath, []byte(config), 0o600); err != nil {
+	if err := os.WriteFile(configPath, []byte(config), 0600); err != nil {
 		t.Fatal(err)
 	}
 
-	svc := startSvc(t, fmt.Sprintf("127.0.0.1:%d", port), glauthBinary(), "-c", configPath)
+	svc := startSvc(SD, glauthBinary(), "-c", configPath)
 	defer stopSvc(svc)
 
 	bindDN := "cn=nopass,dc=glauth,dc=com"
@@ -119,7 +105,7 @@ func TestConfigBackendRejectsPasswordlessUserBinds(t *testing.T) {
 		{name: "empty password", password: "", want: "exit status 53"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			got := runAndSelect(t, getFirst, "ldapsearch", "-LLL", "-H", fmt.Sprintf("ldap://127.0.0.1:%d", port), "-D", bindDN, "-w", tc.password, "-x", "-b", "dc=glauth,dc=com", "(cn=nopass)")
+			got := doRunGetFirst(0, "ldapsearch", "-LLL", "-H", fmt.Sprintf("ldap://127.0.0.1:%d", port), "-D", bindDN, "-w", tc.password, "-x", "-b", "dc=glauth,dc=com", "(cn=nopass)")
 			if got != tc.want {
 				t.Fatalf("bind result = %q, want %q", got, tc.want)
 			}
@@ -154,139 +140,153 @@ func ldapOnlyConfig(t *testing.T, source string) string {
 
 	contents = contents[:start] + sectionWithoutLDAPS + contents[end:]
 	path := filepath.Join(t.TempDir(), filepath.Base(source))
-	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+	if err := os.WriteFile(path, []byte(contents), 0600); err != nil {
 		t.Fatal(err)
 	}
 	return path
 }
 
 func batteryOfTests(t *testing.T, env *testEnv) {
-	// We aren't checking that "github.com/pquerna/otp/totp" creates correct values.
-	// That's what their own tests are for.
-	// We are checking that the totp code gets through glauth code successfully
-	otpvalue, err := totp.GenerateCode("3hnvnk4ycv44glzigd6s25j4dougs3rk", time.Now())
-	if err != nil {
-		t.Fatal("Failed to generate totp code:", err)
-	}
-
-	const addr = "ldap://127.0.0.1:3893"
-	bind := func(dn, password string, rest ...string) []string {
-		return append([]string{"-LLL", "-H", addr, "-D", dn, "-w", password, "-x"}, rest...)
-	}
-	svc := func(rest ...string) []string { return bind(env.svcdn, "mysecret", rest...) }
-	otp := func(password string) []string {
-		return bind(env.otpdn, password, "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
-	}
-
-	const (
-		inSuperheros = "should find them in the 'superheros' group"
-		listFromUser = "should get a list starting with the 'hackers' user"
-		badCreds     = "should get 'Invalid credentials(49)'"
-	)
-
 	tests := []struct {
-		name string
-		skip bool
-		args []string
-		line func(string) string
-		want string
-		msg  string
+		Name  string
+		Path  string
+		Check func(t testing.TB)
 	}{
 		{
-			name: "searching for the 'hackers' user",
-			args: svc("-bdc=glauth,dc=com", "cn=hackers"),
-			want: env.expectedaccount,
-			msg:  inSuperheros,
+			Name: "searching for the 'hackers' user",
+			Check: func(t testing.TB) {
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
+				if got, want := out, env.expectedaccount; got != want {
+					t.Fatalf("should find them in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for the 'hackers' user without binding with a group",
-			skip: env.svcdnnogroup == "",
-			args: bind(env.svcdnnogroup, "mysecret", "-bdc=glauth,dc=com", "cn=hackers"),
-			want: env.expectedaccount,
-			msg:  inSuperheros,
+			Name: "searching for the 'hackers' user without binding with a group",
+			Check: func(t testing.TB) {
+				if env.svcdnnogroup == "" {
+					t.SkipNow()
+				}
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdnnogroup, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
+				if got, want := out, env.expectedaccount; got != want {
+					t.Fatalf("should find them in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for the 'hackers' user after binding using the account's UPN",
-			skip: !env.checkbindUPN,
-			args: bind("serviceuser@example.com", "mysecret", "-bdc=glauth,dc=com", "cn=hackers"),
-			want: env.expectedaccount,
-			msg:  inSuperheros,
+			Name: "searching for the 'hackers' user after binding using the account's UPN",
+			Check: func(t testing.TB) {
+				if !env.checkbindUPN {
+					t.SkipNow()
+				}
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", "serviceuser@example.com", "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
+				if got, want := out, env.expectedaccount; got != want {
+					t.Fatalf("should find them in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "querying the root SDE",
-			args: svc("-s", "base", "(objectclass=*)"),
-			line: getSecond,
-			want: env.expectedinfo,
-			msg:  "should get some meta information",
+			Name: "querying the root SDE",
+			Check: func(t testing.TB) {
+				out := doRunGetSecond(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-s", "base", "(objectclass=*)")
+				if got, want := out, env.expectedinfo; got != want {
+					t.Fatalf("should get some meta information\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "querying the root SDE anonymously without authorizing in config file",
-			skip: !env.checkanonymousrootDSE,
-			args: []string{"-LLL", "-H", addr, "-x", "-s", "base", "(objectclass=*)"},
-			want: "exit status 50",
-			msg:  "should get error 50",
+			Name: "querying the root SDE anonymously without authorizing in config file",
+			Check: func(t testing.TB) {
+				if !env.checkanonymousrootDSE {
+					t.SkipNow()
+				}
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-x", "-s", "base", "(objectclass=*)")
+				if got, want := out, "exit status 50"; got != want {
+					t.Fatalf("should get error 50\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "enumerating posix groups",
-			args: svc("-bdc=glauth,dc=com", "(objectclass=posixgroup)"),
-			want: env.expectedgroup,
-			msg:  "should get a list starting with the 'superheros' group",
+			Name: "enumerating posix groups",
+			Check: func(t testing.TB) {
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(objectclass=posixgroup)")
+				if got, want := out, env.expectedgroup; got != want {
+					t.Fatalf("should get a list starting with the 'superheros' group\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for members of the 'superheros' group",
-			args: svc("-bdc=glauth,dc=com", "(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com)"),
-			want: env.expectedfirstaccount,
-			msg:  listFromUser,
+			Name: "searching for members of the 'superheros' group",
+			Check: func(t testing.TB) {
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com)")
+				if got, want := out, env.expectedfirstaccount; got != want {
+					t.Fatalf("should get a list starting with the 'hackers' user\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "performing a complex search for members of 'superheros' group",
-			args: svc("-bdc=glauth,dc=com", "(&(objectClass=*)(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com))"),
-			want: env.expectedfirstaccount,
-			msg:  listFromUser,
+			Name: "performing a complex search for members of 'superheros' group",
+			Check: func(t testing.TB) {
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(&(objectClass=*)(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com))")
+				if got, want := out, env.expectedfirstaccount; got != want {
+					t.Fatalf("should get a list starting with the 'hackers' user\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for the 'hacker' user using a TOTP-enabled account",
-			skip: !env.checkTOTP,
-			args: otp("mysecret" + otpvalue),
-			want: env.scopedaccount,
-			msg:  inSuperheros,
+			Name: "searching for the 'hacker' user using a TOTP-enabled account",
+			Check: func(t testing.TB) {
+				if !env.checkTOTP {
+					t.SkipNow()
+				}
+				otpvalue := doRunGetFirst(RD, "oathtool", "--totp", "-b", "-d", "6", "3hnvnk4ycv44glzigd6s25j4dougs3rk")
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret"+otpvalue, "-x", "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
+				if got, want := out, env.scopedaccount; got != want {
+					t.Fatalf("should find them in in the 'superheros' group\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for the 'hacker' user using a TOTP-enabled account and no value",
-			skip: !env.checkTOTP,
-			args: otp("mysecret"),
-			want: "exit status 49",
-			msg:  badCreds,
+			Name: "searching for the 'hacker' user using a TOTP-enabled account and no value",
+			Check: func(t testing.TB) {
+				if !env.checkTOTP {
+					t.SkipNow()
+				}
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret", "-x", "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
+				if got, want := out, "exit status 49"; got != want {
+					t.Fatalf("should get 'Invalid credentials(49)'\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for the 'hacker' user using a TOTP-enabled account and the wrong value",
-			skip: !env.checkTOTP,
-			args: otp("mysecret123456"),
-			want: "exit status 49",
-			msg:  badCreds,
+			Name: "searching for the 'hacker' user using a TOTP-enabled account and the wrong value",
+			Check: func(t testing.TB) {
+				if !env.checkTOTP {
+					t.SkipNow()
+				}
+				out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret123456", "-x", "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
+				if got, want := out, "exit status 49"; got != want {
+					t.Fatalf("should get 'Invalid credentials(49)'\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 		{
-			name: "searching for the 'hacker' user",
-			skip: env.checkemployeetype == "",
-			args: svc("-bdc=glauth,dc=com", env.checkemployeetype, "employeetype"),
-			line: getSecond,
-			want: "employeetype: Intern",
-			msg:  "type should be 'Intern'",
+			Name: "searching for the 'hacker' user",
+			Check: func(t testing.TB) {
+				if env.checkemployeetype == "" {
+					t.SkipNow()
+				}
+				out := doRunGetSecond(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", env.checkemployeetype, "employeetype")
+				if got, want := out, "employeetype: Intern"; got != want {
+					t.Fatalf("type should be 'Intern'\ngot:  %s\nwant: %s", got, want)
+				}
+			},
 		},
 	}
 
 	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if tc.skip {
-				t.SkipNow()
-			}
-			line := tc.line
-			if line == nil {
-				line = getFirst
-			}
-			if got := runAndSelect(t, line, "ldapsearch", tc.args...); got != tc.want {
-				t.Fatalf("%s\ngot:  %s\nwant: %s", tc.msg, got, tc.want)
-			}
+		t.Run(tc.Name, func(t *testing.T) {
+			tc.Check(t)
 		})
 	}
 }
@@ -307,15 +307,14 @@ func TestSampleSimple(t *testing.T) {
 		checkemployeetype:     "cn=hackers",
 	}
 
-	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", ldapOnlyConfig(t, "sample-simple.cfg"))
+	svc := startSvc(SD, glauthBinary(), "-c", ldapOnlyConfig(t, "sample-simple.cfg"))
 	batteryOfTests(t, &env)
 	stopSvc(svc)
 }
 
 func TestSQLitePlugin(t *testing.T) {
-	_, err := os.Stat("bin/sqlite.so")
-	if err != nil {
-		t.Log("Unable to find sqlite plugin")
+	matchingLibrary := doRunGetFirst(RD, "ls", "bin/sqlite.so")
+	if matchingLibrary != "bin/sqlite.so" {
 		t.SkipNow()
 	}
 
@@ -334,20 +333,14 @@ func TestSQLitePlugin(t *testing.T) {
 		checkemployeetype:     "",
 	}
 
-	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", "pkg/plugins/glauth-sqlite/sample-database.cfg")
+	svc := startSvc(SD, glauthBinary(), "-c", "pkg/plugins/glauth-sqlite/sample-database.cfg")
 	batteryOfTests(t, &env)
 	stopSvc(svc)
 }
 
 func TestLdapInjection(t *testing.T) {
-	out, err := doRun("sh", "-c", "docker ps | grep ldap-service | wc -l")
-	if err != nil {
-		t.Log("Unable to find docker container:", out)
-		t.SkipNow()
-	}
-	matchingContainers := getFirst(out)
+	matchingContainers := doRunGetFirst(RD, "sh", "-c", "docker ps | grep ldap-service | wc -l")
 	if matchingContainers != "1" {
-		t.Log("Unable to find docker container:", out)
 		t.SkipNow()
 	}
 
@@ -366,89 +359,52 @@ func TestLdapInjection(t *testing.T) {
 		checkemployeetype:     "",
 	}
 
-	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", "sample-ldap-injection.cfg")
+	svc := startSvc(SD, glauthBinary(), "-c", "sample-ldap-injection.cfg")
 	batteryOfTests(t, &env)
 	stopSvc(svc)
 }
 
 // -----=============================================================================----
-func waitForPort(host string, timeout time.Duration) error {
-	start := time.Now()
-	for {
-		conn, err := ldap.Dial("tcp", host)
-		if err == nil {
-			err = conn.Bind("_", "_")
-			if err == nil {
-				conn.Close()
-				return fmt.Errorf("Successfully authenticated to glauth. This should not happen")
-			}
-			e := &ldap.Error{}
-			if errors.As(err, &e) && e.ResultCode == 49 {
-				conn.Close()
-				return nil
-			}
-			conn.Close()
-			// We have an error, it's probably a connection error or an error saying that ldap isn't setup yet
-			// try again
-		}
-		if time.Since(start) > timeout {
-			return fmt.Errorf("timeout waiting for port %s: %w", host, err)
-		}
-		time.Sleep(50 * time.Millisecond)
-	}
-}
 
-func startSvc(t *testing.T, addr string, name string, arg ...string) *exec.Cmd {
+const SD = 3 // Start Delay
+const RD = 2 // Response Delay
+
+func startSvc(delay time.Duration, name string, arg ...string) *exec.Cmd {
 	cmd := exec.Command(name, arg...)
-	cmd.Stderr = t.Output()
-	cmd.Stdout = t.Output()
-	if err := cmd.Start(); err != nil {
-		t.Fatal("Failed to start glauth:", err)
+	cmd.Start()
+	if delay != 0 {
+		time.Sleep(time.Second * delay)
 	}
-	if err := waitForPort(addr, time.Second*2); err != nil {
-		t.Fatal("Failed to wait for glauth to start:", err)
-	}
-	// the port is listening but the ldap server may not be accepting connections yet
-	// TODO: make glauth listen as the last part of the initialization that way as soon as it listens it can process connections
 	return cmd
 }
 
 func stopSvc(svc *exec.Cmd) {
 	svc.Process.Kill()
-	svc.Process.Wait()
 }
 
-func getFirst(output string) string {
-	out := strings.SplitN(output, "\n", 2)
-	if len(out) < 1 {
+func doRunGetFirst(delay time.Duration, name string, arg ...string) string {
+	out := strings.SplitN(doRun(delay, name, arg...), "\n", 2)
+	if out == nil || len(out) < 1 {
 		return "*fail*"
 	}
 	return out[0]
 }
 
-func getSecond(output string) string {
-	out := strings.SplitN(output, "\n", 3)
-	if len(out) < 2 {
+func doRunGetSecond(delay time.Duration, name string, arg ...string) string {
+	out := strings.SplitN(doRun(delay, name, arg...), "\n", 3)
+	if out == nil || len(out) < 2 {
 		return "*fail*"
 	}
 	return out[1]
 }
 
-func doRun(name string, arg ...string) (string, error) {
-	out, err := exec.Command(name, arg...).CombinedOutput()
+func doRun(delay time.Duration, name string, arg ...string) string {
+	out, err := exec.Command(name, arg...).Output()
 	if err != nil {
-		return string(bytes.TrimSpace(out)), err
-	}
-
-	return string(bytes.TrimSpace(out)), nil
-}
-
-func runAndSelect(t testing.TB, pick func(string) string, name string, arg ...string) string {
-	t.Helper()
-	out, err := doRun(name, arg...)
-	if err != nil {
-		t.Log(out)
 		return err.Error()
 	}
-	return pick(out)
+	if delay != 0 {
+		time.Sleep(time.Second * delay)
+	}
+	return strings.TrimSpace(string(out))
 }

v2/go.mod

@@ -1,6 +1,6 @@
 module github.com/glauth/glauth/v2
 
-go 1.25
+go 1.21
 
 require (
 	github.com/BurntSushi/toml v1.3.2

v2/go.sum

@@ -15,8 +15,6 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=

v2/internal/version/const.go

@@ -2,4 +2,4 @@ package version
 
 // Version is the tag of the latest release, it gets changed by the ci
 // process when a release is happening
-const Version = "v2.5.2" // x-release-please-version
+const Version = "v2.5.0" // x-release-please-version

v2/scripts/ci/integration-test.sh

@@ -24,22 +24,6 @@ echo "Fixing CI_BUILD_DIR"
 
 # This script requires that "$CI_BUILD_DIR" is set to the repo root
 
-GOOS="$(go env GOOS)"
-GOARCH="$(go env GOARCH)"
-if [[ "$GOARCH" = "arm" ]]; then
-	DIST_ARCH="arm-$(go env GOARM)"
-else
-	DIST_ARCH="$GOARCH"
-fi
-GLAUTH_BINARY="$CI_BUILD_DIR/bin/$GOOS$GOARCH/glauth"
-if [[ ! -x "$GLAUTH_BINARY" ]]; then
-	GLAUTH_BINARY="$CI_BUILD_DIR/bin/glauth-$GOOS-$DIST_ARCH"
-fi
-if [[ ! -x "$GLAUTH_BINARY" ]]; then
-	echo "Unable to find a runnable GLAuth binary: $GLAUTH_BINARY"
-	exit 1
-fi
-
 # Ensure ldap utils are installed (for example - when running this outside of CI)
 if [[ ! `which ldapsearch` ]]; then
 	sudo apt-get -qq update && sudo apt-get -qq install -y ldap-utils || exit 1;
@@ -49,11 +33,11 @@ fi
 echo "";
 echo ""
 echo "Version string of tested binary:"
-"$GLAUTH_BINARY" --version
+"$CI_BUILD_DIR/bin/$(go env GOOS)$(go env GOARCH)/glauth" --version
 echo ""
 
 # Start in background, capture PID
-"$GLAUTH_BINARY" -c "$CI_BUILD_DIR/scripts/ci/test-config.cfg" &> /dev/null &
+"$CI_BUILD_DIR/bin/$(go env GOOS)$(go env GOARCH)/glauth" -c "$CI_BUILD_DIR/scripts/ci/test-config.cfg" &> /dev/null &
 
 # Use this instead to see glauth logs while running
 # "$CI_BUILD_DIR/bin/$(go env GOOS)$(go env GOARCH)/glauth" -c "$CI_BUILD_DIR/scripts/ci/test-config.cfg" &