chore: bump plugin submodules to updated dependencies

go-sqlite3 1.14.52, mysql 1.10.1, lib/pq 1.12.3, msteinert/pam v2.1.0.
The pam plugin moves to the v2 major (import path only; the API it
uses is unchanged) and its logr and glauth/ldap entries now match the
core module. Corrects the module path in the mysql, postgres and pam
manifests, which all declared glauth-sqlite.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP

.devcontainer/devcontainer.json

@@ -0,0 +1,54 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/go
+{
+	"name": "glauth",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/go:0-1.19-bullseye",
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	"features": {
+		"docker-in-docker": {
+			"version": "latest",
+			"moby": true
+		},
+		"ghcr.io/rocker-org/devcontainer-features/apt-packages:1": {
+			"packages": "oathtool,ldap-utils"
+		}
+	},
+
+	// Configure tool-specific properties.
+	"customizations": {
+		// Configure properties specific to VS Code.
+		"vscode": {
+			"settings": {},
+			"extensions": [
+				"golang.go",
+				"ms-azuretools.vscode-docker"
+			]
+		}
+	},
+
+	"containerEnv": {
+		"REPO": "glauth"
+	},
+
+	"capAdd": ["SYS_PTRACE"],
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [9000],
+
+	// Use 'portsAttributes' to set default properties for specific forwarded ports. 
+	// More info: https://containers.dev/implementors/json_reference/#port-attributes
+	"portsAttributes": {
+		"3893": {
+			"label": "LDAP",
+			"onAutoForward": "notify"
+		},
+		"5555": {
+			"label": "Web UI",
+			"onAutoForward": "openBrowser"
+		}
+	},
+
+	"postCreateCommand": "cd v2 && make setup"
+}

.github/dependabot.yaml

@@ -0,0 +1,24 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# \todo Eliminate duplication when/if Dependabot supports YAML anchors
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    labels:
+      - dependencies
+      - actions
+    schedule:
+      day: sunday
+      interval: weekly
+  - package-ecosystem: gomod
+    directory: /v2
+    labels:
+      - dependencies
+      - go
+    schedule:
+      interval: weekly
+      day: friday

.github/pull_request_template.md

@@ -14,9 +14,9 @@ new functionality, consider adding tests covering your feature.
 
 ## CI
 Each push to a branch connected to a PR will be run through GLAuth's 
-CI system. Please use these to your advantage. In particular, the Travis 
+CI system. Please use these to your advantage. In particular, the Github Actions 
 integration tests rely on the LDAP queries returning with a set result, 
-so if your changes will change the output, Travis will likely fail.
+so if your changes will change the output, CI will likely fail.
 
 To update, run `make fast && make updatetest && make test`. This will 
 delete the output snapshots provided and make new ones. You can then 

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches:
+     - master
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        go-version: [1.25.x]
+    steps:
+      - name: Install Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: ${{ matrix.go-version }}
+      - name: Updating packages database
+        run: sudo apt-get -qq update
+      - name: Install CLI Dependencies
+        run: sudo apt-get install -y ldap-utils oathtool libpam0g-dev
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Fetch Go dependencies
+        working-directory: ./v2
+        run: go get -t -v ./...
+      - name: Fail if a .go file hasn't been formatted with 'go fmt'
+        working-directory: ./v2
+        run: diff -u <(echo -n) <(gofmt -d ./)
+      - name: Full compile test
+        working-directory: ./v2
+        run: make fast
+      - name: Output hashes to the build log
+        working-directory: ./v2
+        run: cat bin/*/glauth.sha256
+      - name: Integration test with compiled binary
+        working-directory: ./v2
+        run: make test

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "46 1 * * 3"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/codesee-arch-diagram.yml

@@ -0,0 +1,22 @@
+# This workflow was added by CodeSee. Learn more at https://codesee.io/
+# This is v2.0 of this workflow file
+on:
+  push:
+    branches:
+      - master
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+name: CodeSee
+
+permissions: read-all
+
+jobs:
+  codesee:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    name: Analyze the repo with CodeSee
+    steps:
+      - uses: Codesee-io/codesee-action@v2
+        with:
+          codesee-token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}

.github/workflows/docker.yml

@@ -1,41 +0,0 @@
-name: docker
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-  release:
-    types:
-      - created
-      - edited
-
-jobs:
-  build-push:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-    env:
-      BUILDX_VERSION: v0.4.1
-      DOCKER_CLI_EXPERIMENTAL: enabled
-    steps:
-      - uses: actions/checkout@v2
-      - name: set up multiarch builder
-        run: |
-          set -ex
-          curl -sSL https://get.docker.com | bash
-          mkdir -p ~/.docker/cli-plugins
-          curl -sSLo ~/.docker/cli-plugins/buildx https://github.com/docker/buildx/releases/download/$BUILDX_VERSION/buildx-$BUILDX_VERSION.linux-amd64
-          chmod +x ~/.docker/cli-plugins/buildx
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
-          docker buildx create --name multiarch
-          docker buildx use multiarch
-          docker buildx inspect --bootstrap
-          curl -sSL https://gist.githubusercontent.com/ArturKlauser/0f0293c62f5626df0261ac994d8a46af/raw/33ef25b8a93f15310f0a4013deca3f8d20fc00a7/check-qemu-binfmt.sh | bash
-      - name: log in github registry
-        run: docker login --username "${{ github.actor }}" --password "${{ secrets.GITHUB_TOKEN }}" docker.pkg.github.com
-      - name: build multiarch images
-        run: docker buildx build -t docker.pkg.github.com/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):$(echo ${{ github.ref }} | tr / -) --platform linux/amd64,linux/arm64,linux/arm/v7 .
-      - name: push multiarch images
-        if: github.event.release.tag_name
-        run: docker buildx build --push -t docker.pkg.github.com/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]'):${{ github.event.release.tag_name }} --platform linux/amd64,linux/arm64,linux/arm/v7 .

.github/workflows/release-please.yml

@@ -0,0 +1,20 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: google-github-actions/release-please-action@v4
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.gitignore

@@ -1,20 +1,42 @@
-# Ignore default config file for testing
-glauth.cfg
-
-# Ignore the built binary during testing
-glauth
-
-# Ignore generated certs in this folder
-certs/
-
-# Built binaries
-bin
-
-pkg/assets/bindata.go
-
 .*.swp
+v2/certs/
+v2/bin
+v2/docker/assets/linux
+v2/gl.db
+v2/buildlogs
+.idea/
+.vscode/
+.DS_Store
 
-# Ignoring travis CLI tool logs
-*travis.log
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
 
-certs/
+### Go Patch ###
+/vendor/
+/Godeps/
+
+# Various
+go.work.sum
+
+# gomocks auto-generated
+**/mock_*.go
+
+# Secrets & credentials
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+*.env
+.env.*
+!.env.example
+*.tfvars
+credentials.json
+secrets.yaml
+secrets.yml
+
+# Local GLAuth config that may contain bind passwords / secrets
+config/*.cfg
+!config/sample-simple.cfg
+!config/sample-*.cfg
+*.local.cfg

.gitmodules

@@ -0,0 +1,12 @@
+[submodule "v2/pkg/plugins/glauth-sqlite"]
+	path = v2/pkg/plugins/glauth-sqlite
+	url = git@github.com:glauth/glauth-sqlite
+[submodule "v2/pkg/plugins/glauth-mysql"]
+	path = v2/pkg/plugins/glauth-mysql
+	url = git@github.com:glauth/glauth-mysql
+[submodule "v2/pkg/plugins/glauth-postgres"]
+	path = v2/pkg/plugins/glauth-postgres
+	url = git@github.com:glauth/glauth-postgres
+[submodule "v2/pkg/plugins/glauth-pam"]
+	path = v2/pkg/plugins/glauth-pam
+	url = git@github.com:glauth/glauth-pam

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  "v2": "2.5.2"
+}

.travis.yml

@@ -1,81 +0,0 @@
-os: linux
-dist: xenial
-language: go
-
-# USE THIS alongside makefile tag detection: $TRAVIS_TAG
-
-# if you change the version here, also update the travis deploy condition
-go: 
- - 1.13.x      # older version
- - 1.14.x      # last version
- - 1.15.x      # current version
-
-# Speed up git clones
-git:
-  depth: 1
-
-
-# Anything in before_script that returns a nonzero exit code will
-# flunk the build and immediately stop. It's sorta like having
-# set -e enabled in bash. 
-before_script:
-  - travis_retry sudo apt-get -qq update && sudo apt-get install -y ldap-utils oathtool  # need this for integration tests
-  - travis_retry sudo apt-get -qq update && sudo apt-get install -y go-bindata           # need this for makefile
-  - GO_FILES=$(find . -iname '*.go' -type f | grep -v /vendor/)             # All the .go files, excluding vendor/
-  #- travis_retry go get github.com/golang/lint/golint                                   # Linter
-  #- travis_retry go get honnef.co/go/tools/cmd/megacheck                                # Badass static analyzer/linter
-  # - travis_retry go get github.com/fzipp/gocyclo                                       # Not sure what this is
-
-
-# Run bindata for assets
-  - make bindata
-
-# Fetch dependencies
-  - travis_retry go get -t -v ./...
-
-
-script:
-  - env                                       # Dump the env to make debugging easier
-  - diff -u <(echo -n) <(gofmt -d ./)         # Fail if a .go file hasn't been formatted with 'go fmt'
-  # - go vet ./...        "                     # go vet is the official Go static analyzer
-
-  # - go test -v -race ./...                   # Run all the tests with the race detector enabled
-  # - megacheck ./...                          # "go vet on steroids" + linter
-  # - gocyclo -over 19 $GO_FILES               # forbid code with huge functions
-  # - golint -set_exit_status $(go list ./...) # one last linter
-
-
-
-  # Unit tests
-  # - tbd - use 'go test' here when we have unit tests written. example command below. This will generate output for codecov
-  # - go test -race -coverprofile=coverage.txt -covermode=atomic
-
-  # Full compile test
-  # - go build -o ./glauth glauth.go bindata.go ldapbackend.go webapi.go configbackend.go
-  - make all
-
-  # Output hashes to the build log
-  - cat bin/*.sha256
-
-  # Integration test with compiled binary
-  - make test
-
-
-
-# after_success:
-#  - bash <(curl -s https://codecov.io/bash)
-
-deploy:
-  provider: releases
-  token:
-    secure: lPI5FftcQB1eHihN9daeFOT97vZcfq2w0hRb6amC6U4P+K7Ih23R9NmWhDuvGM9CPLaAqgOKiHWIUnP4q9EeBeAUMgg6FI2syr/0nDYz5cHqZMMPWFgeDvn+HqfMdFIVeiKT80+uGY/JNsMI8lsJ0eILEp0GpyIZkoAewCEyxJ/fcLM5htGnQIQ8mQ+2ZXflvPofv6/RPHgu3ryC0icJFVMREIivp2QIZBpFnawnI+OE8ZzxD5R05gfg3IJtYtc/4diX4RPyqVTCqljU/x7/g9KgNsnaLGEz37pBUS0IQcq4ITX/cm4y5LLWPV6JugxjyTq1SXKJnHEgfEFk5/hPM7Q1DMZJ5tGpb2B4aSMwB6YHwvVW83ih96Vw8ZgIrxWT9LyF4n9AHakLhDIiJieDXa3dvG7U5oTxlSP/RJkXlMZEJ3lS/1RZ9vvQ0EOEMAO6ePQzSZ4EM/UShFalBI+fqDtzqxFGeeCWw6lwiKLF2GF7enT8+wLsWOMI43JM5uPAq2g0KFMtJEEcK08IFraObvK5bcFH7snCDtsAaLyjdkVIIBteNtfDsXQ8PMi4bQpLr5kpY68dkyuxDr4IpL1GKqlpe2LbjkzsGrq5wifcHMFmUkEfY/6/ELFc9fL+1ZnMAe7YiW41AvX+hrgVmc3M8zp1kVvy2oERV4LfV1vfaEU=
-  file_glob: true 
-  file: bin/*
-  draft: true
-  name: "DRAFT RELEASE: $TRAVIS_TAG"
-  cleanup: true
-  on:
-    branch: master
-    tags: true
-    condition: $TRAVIS_GO_VERSION =~ ^1\.15
-    repo: glauth/glauth

CONTRIBUTING.md

@@ -0,0 +1,54 @@
+# Contributing to GLAuth
+
+Thanks for your interest in improving GLAuth! This guide covers how to set up your environment, submit changes, and work with the maintainers. Starting with GLAuth 2.4.0, we reworked and optimized the build workflow, and this contribution process reflects that.
+
+## Getting Started
+
+1. Fork the repository and clone your fork locally.
+2. Review the [Building](https://glauth.github.io/docs/building.html) docs to compile GLAuth from source.
+3. Review the [Testing](https://glauth.github.io/docs/testing.html) docs to run the test suite before submitting changes.
+4. Create a topic branch for your work off of `master`.
+
+## Reporting Issues
+
+- Open an issue on the [GLAuth issue tracker](https://github.com/glauth/glauth/issues) for bugs and feature requests.
+- Include your GLAuth version, configuration (with secrets redacted), and clear steps to reproduce.
+
+## Preparing to Commit
+
+Format your code automatically using `gofmt -d ./` before committing. If you forget this step, a subsequent pull request may fail.
+
+## Writing Commit Messages
+
+Commit messages must be semantically correct. We follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/).
+
+A commit message contains a prefix, followed by a short explanation. It may also contain "footer" annotations, but these are not mandatory (though appreciated).
+
+Please don't bundle multiple unrelated items in the same commit (e.g., a new feature and a bug fix).
+
+### Commit Prefix
+
+A prefix is written imperatively, for example:
+
+```
+feat(plugins)!: Change the plugins API to allow NoSQL databases.
+```
+
+This is a new feature (`feat`), optionally scoped to an area of GLAuth (`(plugins)`), with `!` warning of a breaking change.
+
+A more innocuous change:
+
+```
+chore: Add more comments in all modules.
+```
+
+Available prefixes: `feat`, `fix`, `chore`, `build`, `ci`, `perf`, `refactor`, `test`, `style`.
+
+### Commit Footer Annotations
+
+For example:
+
+```
+Reviewed-by: John Romero <john@romero.com>
+Tested-by: Joel Spolsky <joel@joelonsoftware.com>
+BREAKING-CHANGE: I broke the plugin

Dockerfile

@@ -1,66 +0,0 @@
-#################
-# Build Step
-#################
-
-FROM golang:alpine as build
-MAINTAINER Ben Yanke <ben@benyanke.com>
-
-# Setup work env
-RUN mkdir /app /tmp/gocode
-ADD . /app/
-WORKDIR /app
-
-
-# Required envs for GO
-ENV GOPATH=/tmp/gocode
-ENV GOOS=linux
-ENV GOARCH=amd64
-ENV CGO_ENABLED=0
-
-# Only needed for alpine builds
-RUN apk add --no-cache git make go-bindata
-
-# Run go-bindata to embed data for API
-RUN go-bindata -pkg=assets -o=pkg/assets/bindata.go assets
-RUN gofmt -w pkg/assets/bindata.go
-
-# Install deps
-RUN go get -d -v ./...
-
-# Build and copy final result
-RUN uname -a
-RUN if [ $(uname -m) == x86_64 ]; then make linux64 && cp ./bin/glauth64 /app/glauth; fi
-RUN if [ $(uname -m) == aarch64 ]; then make linuxarm64 && cp ./bin/glauth-arm64 /app/glauth; fi
-RUN if [ $(uname -m) == armv7l ]; then make linuxarm32 && cp ./bin/glauth-arm32 /app/glauth; fi
-
-# Check glauth works
-RUN /app/glauth --version
-
-#################
-# Run Step
-#################
-
-FROM alpine as run
-MAINTAINER Ben Yanke <ben@benyanke.com>
-
-# Copies a sample config to be used if a volume isn't mounted with user's config
-ADD sample-simple.cfg /app/config/config.cfg
-
-# Copy binary from build container
-COPY --from=build /app/glauth /app/glauth
-
-# Copy docker specific scripts from build container
-COPY --from=build /app/scripts/docker/start.sh /app/docker/
-COPY --from=build /app/scripts/docker/default-config.cfg /app/docker/
-
-# Install ldapsearch for container health checks, then ensure ldapsearch is installed
-RUN apk update && apk add --no-cache dumb-init openldap-clients && which ldapsearch && rm -rf /var/cache/apk/*
-
-# Install init
-
-# Expose web and LDAP ports
-EXPOSE 389 636 5555
-
-ENTRYPOINT ["/usr/bin/dumb-init", "--"]
-CMD ["/bin/sh", "/app/docker/start.sh"]
-

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018 Ned McClain & Ben Yanke
+Copyright (c) 2018 Ned McClain & Ben Yanke & Chris Ravenscroft
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -1,100 +0,0 @@
-VERSION=$(shell bin/glauth64 --version)
-
-GIT_COMMIT=$(shell git rev-list -1 HEAD )
-BUILD_TIME=$(shell date -u +%Y%m%d_%H%M%SZ)
-GIT_CLEAN=$(shell git status | grep -E "working (tree|directory) clean" | wc -l | sed 's/^[ ]*//')
-
-# Last git tag
-LAST_GIT_TAG=$(shell git describe --abbrev=0 --tags 2> /dev/null)
-
-# this=1 if the current commit is the tagged commit (ie, if this is a release build)
-GIT_IS_TAG_COMMIT=$(shell git describe --abbrev=0 --tags > /dev/null 2> /dev/null && echo "1" || echo "0")
-
-# Used when a tag isn't available
-GIT_BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
-
-# Build variables
-BUILD_VARS=-s -w -X main.GitCommit=${GIT_COMMIT} -X main.GitBranch=${GIT_BRANCH} -X main.BuildTime=${BUILD_TIME} -X main.GitClean=${GIT_CLEAN} -X main.LastGitTag=${LAST_GIT_TAG} -X main.GitTagIsCommit=${GIT_IS_TAG_COMMIT}
-BUILD_FILES=glauth.go
-TRIM_FLAGS=-gcflags "all=-trimpath=${PWD}" -asmflags "all=-trimpath=${PWD}"
-
-# Plugins
-include pkg/plugins/Makefile
-
-#####################
-# High level commands
-#####################
-
-# Build and run - used for development
-run: setup devrun cleanup
-
-# Run the integration test on linux64 (eventually allow the binary to be set)
-test: runtest
-
-# Run build process for all binaries
-all: setup binaries verify cleanup
-
-# Run build process for only linux64
-fast: setup linux64 verify cleanup
-
-# list of binary formats to build
-binaries: linux32 linux64 linuxarm32 linuxarm64 darwin64 win32 win64
-
-# Setup commands to always run
-setup: bindata getdeps format
-
-#####################
-# Subcommands
-#####################
-
-# Run integration test
-runtest:
-	./scripts/travis/integration-test.sh cleanup
-
-# Get all dependencies
-getdeps:
-	go get -d ./...
-
-updatetest:
-	./scripts/travis/integration-test.sh
-
-bindata:
-	go get -u github.com/jteeuwen/go-bindata/... && ${GOPATH}/bin/go-bindata -pkg=assets -o=pkg/assets/bindata.go assets && gofmt -w pkg/assets/bindata.go
-
-
-cleanup:
-	rm pkg/assets/bindata.go
-
-format:
-	go fmt
-
-devrun:
-	go run ${BUILD_FILES} -c sample-simple.cfg
-
-linux32:
-	GOOS=linux GOARCH=386 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauth32 ${BUILD_FILES} && cd bin && sha256sum glauth32 > glauth32.sha256
-
-linux64:
-	GOOS=linux GOARCH=amd64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauth64 ${BUILD_FILES} && cd bin && sha256sum glauth64 > glauth64.sha256
-
-linuxarm32:
-	GOOS=linux GOARCH=arm go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauth-arm32 ${BUILD_FILES} && cd bin && sha256sum glauth-arm32 > glauth-arm32.sha256
-
-linuxarm64:
-	GOOS=linux GOARCH=arm64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauth-arm64 ${BUILD_FILES} && cd bin && sha256sum glauth-arm64 > glauth-arm64.sha256
-
-darwin64:
-	GOOS=darwin GOARCH=amd64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauthOSX ${BUILD_FILES} && cd bin && sha256sum glauthOSX > glauthOSX.sha256
-
-darwinarm64:
-	GOOS=darwin GOARCH=arm64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauthOSX-arm64 ${BUILD_FILES} && cd bin && sha256sum glauthOSX-arm64 > glauthOSX-arm64.sha256
-
-win32:
-	GOOS=windows GOARCH=386 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauth-win32 ${BUILD_FILES} && cd bin && sha256sum glauth-win32 > glauth-win32.sha256
-
-win64:
-	GOOS=windows GOARCH=amd64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/glauth-win64 ${BUILD_FILES} && cd bin && sha256sum glauth-win64 > glauth-win64.sha256
-
-
-verify:
-	cd bin && sha256sum *.sha256 -c && cd ../;

README.md

@@ -1,17 +1,14 @@
-# GLAuth: LDAP authentication server for developers
-Go-lang LDAP Authentication (GLAuth) is a secure, easy-to-use, LDAP server w/ configurable backends.
 
-[![Gitter](https://badges.gitter.im/glauth/community.svg)](https://gitter.im/glauth/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
-[![Matrix](https://img.shields.io/badge/chat-%2fjoin%20%23glauth_community:gitter.im-green)](hey)
+# GLAuth: LDAP authentication server for developers
+[![Official GLAuth Website](https://img.shields.io/badge/Official%20GLAuth%20Website-glauth.github.io-brightgreen?style=plastic)](https://glauth.github.io/)
+[![kittens dns](https://img.shields.io/badge/kittens%20dns-github-blue?style=plastic)](https://github.com/fusion/kittendns)
+[![wing vpn](https://img.shields.io/badge/wing%20vpn-github-orange?style=plastic)](https://github.com/fusion/wing-vpn)
+
+Go-lang LDAP Authentication (GLAuth) is a secure, easy-to-use, LDAP server w/ configurable backends.
 
 ![GitHub all releases](https://img.shields.io/github/downloads/glauth/glauth/total)
 ![Docker pulls](https://badgen.net/docker/pulls/glauth/glauth)
-
-![Travis (.com) branch](https://img.shields.io/travis/com/glauth/glauth/dev)
-![Docker Automated build](https://img.shields.io/docker/automated/glauth/glauth)
-
-![GitHub last commit (branch)](https://img.shields.io/github/last-commit/glauth/glauth/dev)
-![Code Climate maintainability](https://img.shields.io/codeclimate/maintainability-percentage/glauth/glauth)
+![GitHub last commit (branch)](https://img.shields.io/github/last-commit/glauth/glauth/master)
 
 * Centrally manage accounts across your infrastructure
 * Centrally manage SSH keys, Linux accounts, and passwords for cloud servers.
@@ -24,13 +21,13 @@ Use it to centralize account management across your Linux servers, your OSX mach
 
 ### Contributing
 - Please base all Pull Requests on [dev](https://github.com/glauth/glauth/tree/dev), not master.
-- Format your code autonmatically using `gofmt -d ./` before committing
+- Format your code automatically using `gofmt -d ./` before committing
 
 ### Quickstart
 This quickstart is a great way to try out GLAuth in a non-production environment.  *Be warned that you should take the extra steps to setup SSL (TLS) for production use!*
 
 1. Download a precompiled binary from the [releases](https://github.com/glauth/glauth/releases) page.
-2. Download the [example config file](https://github.com/glauth/glauth/blob/master/sample-simple.cfg).
+2. Download the [example config file](https://github.com/glauth/glauth/blob/master/v2/sample-simple.cfg).
 3. Start the GLAuth server, referencing the path to the desired config file with `-c`.
    - `./glauth64 -c sample-simple.cfg`
 4. Test with traditional LDAP tools
@@ -40,15 +37,15 @@ This quickstart is a great way to try out GLAuth in a non-production environment
 
 Note - makefile uses git data to inject build-time variables. For best results, run in the context of the git repo.
 
-*make all* - run build binaries for platforms
+### Documentation
 
-*make fast* - run build for only linux 64 bit
+<h4 align="center">:point_right: The latest version of GLauth's documentation is available at https://glauth.github.io/ :point_left:</h4>
 
-*make run* - wrapper for the 'go run' command, setting up the needed tooling
+<hr>
 
-*make plugins* - build additional (SQL) plugin backends
+### Quickstart
 
-*make test* - run the integration test on linux64 binary
+Get started in three short [steps](https://glauth.github.io/docs/quickstart.html)
 
 ### Usage:
 ```
@@ -97,214 +94,19 @@ Here's a sample config wth hardcoded users and groups:
   name = "superheros"
   gidnumber = 5501
 ```
-To create the password SHA hash, use this command: `echo -n "mysecret" | openssl dgst -sha256`
 
-Instead of a local configuration file, GLAuth can fetch its configuration from S3.  This is an easy way to ensure redundant GLAuth servers are always in-sync.
-```unix
-glauth -c s3://bucketname/glauth.cfg
-```
-In order to use S3, you must set your AWS credentials.  Either:
-
-1. set the -K and -S command-line flags  **OR**
-2. set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.
-
-More configuration options are documented here: https://github.com/glauth/glauth/blob/master/sample-simple.cfg
-
-### Chaining backends
-
-This can be used, for instance, to inject support for Two Factor Authentication for backends that do not support the feature natively:
-
-```
-[[backends]]
-  datastore = "ldap"
-  servers = ["ldap:s//localhost:390"]
-
-[[backends]]
-  datastore = "config"
-
-...
-
-[[users]]
-  name = "hackers"
-  otpsecret = "................"
-```
-
-
-### Required Fields
- * Name
-   * The user's username
- * ou
-   * ID of the user's primary group
- * uidnumber
-   * The user's unix user id
- * sshPublicKey
-   * Specify an array of public keys
-
-### Optional Fields
- * otherGroups
-   * Array of IDs of groups the user is a member of.
-   * Example: [5501, 5002]
-   * default = blank
- * givenname
-   * First name
-   * Example: John
-   * default = blank
- * sn
-   * Last name
-   * Example: Doe
-   * default = blank
- * disabled
-   * Specify if account is active.
-   * Set to 'true' (without quotes) to make the LDAP entry add 'AccountStatus = inactive'
-   * default = false (active)
- * mail
-   * Specify an email
-   * example: jdoe@example.com
-   * default = blank
- * loginshell
-   * Specify a different login shell for the user
-   * Example: /bin/sh, or /sbin/nologin
-   * default = /bin/bash
- * homedirectory
-   * Specify an overridden home directory for the user
-   * Example: /home/itadmin
-   * default = /home/[username]
- * otpsecret
-   * Specify OTP secret used to validate OTP passcode
-   * Example: 3hnvnk4ycv44glzigd6s25j4dougs3rk
-   * default = blank
- * passappbcrypt
-   * Specify an array of app passwords which can also succesfully bind - these bypass the OTP check. Hash the same way as password.
-   * Example: ["c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa","4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88"]
-   * default = blank
- * passappsha256
-   * Specify an array of app passwords which can also succesfully bind - these bypass the OTP check. Hash the same way as password.
-   * Example: ["c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa","4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88"]
-   * default = blank
- * yubikey
-   * Specify Yubikey ID for maching Yubikey OTP against the user
-   * Example: cccjgjgkhcbb
-   * default = blank
-
-### OpenSSH keys:
-GLAuth can store a user's SSH authorized keys.  Add one or more keys per user as shown above, then setup the goklp helper: https://github.com/appliedtrust/goklp
-
-### Strong Passwords
-If you are currently using sha256 passwords (`passsha256` or `passappsha256`) moving to strong, salted paswords is recommended. Simply switch to `passbcrypt` and/or `passappbcrypt` password types. Currently (2021) 2<sup>12</sup> is a reasonably good value, depending our your server's CPU.
-
-### Two Factor Authentication
-GLAuth can be configured to accept OTP tokens as appended to a users password. Support is added for both **TOTP tokens** (often known by it's most prominent implementation, "Google Authenticator") and **Yubikey OTP tokens**.
-
-When using 2FA, append the 2FA code to the end of the password when authenticating. For example, if your password is "monkey" and your otp is "123456", enter "monkey123456" as your password.
-
-#### TOTP Configuration
-To enable TOTP authentication on a user, you can use a tool [like this](https://freeotp.github.io/qrcode.html) to generate a QR code (pick 'Timeout' and optionally let it generate a random secret for you), which can be scanned and used with the [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en) app. To enable TOTP authentication, configure the `otpsecret` for the user with the TOTP secret.
-
-#### App Passwords
-Additionally, you can specify an array of password hashes using the `passappsha256` for app passwords. These are not OTP validated, and are hashed in the same way as a password. This allows you to generate a long random string to be used in software which requires the ability to authenticate.
-
-However, app passwords can be used without OTP as well.
-
-#### Yubikey Configuration
-For Yubikey OTP token authentication, first [configure your Yubikey](https://www.yubico.com/products/services-software/personalization-tools/yubikey-otp/). After this, make sure to [request a `Client ID` and `Secret key` pair](https://upgrade.yubico.com/getapikey/).
-
-Now configure the `yubikeyclientid` and `yubikeysecret` fields in the general section in the configuration file.
-
-To enable Yubikey OTP authentication for a user, you must specify their Yubikey ID on the users `yubikey` field. The Yubikey ID is the first 12 characters of the Yubikey OTP, as explained in the below chart.
-
-![Yubikey OTP](https://developers.yubico.com/OTP/otp_details.png)
-
-When a user has been configured with either one of the OTP options, the OTP authentication is required for the user. If both are configured, either one will work.
+More configuration options are documented [here](https://glauth.github.io/docs/file.html) and in this [sample file](https://github.com/glauth/glauth/blob/master/v2/sample-simple.cfg)
 
 ### Backends:
-For advanced users, GLAuth supports pluggable backends.  Currently, it can use a local file, S3 or an existing LDAP infrastructure.  In the future, we hope to have backends that support Mongo, SQL, and other datastores.
+
+For advanced users, GLAuth supports pluggable backends.  Currently, it can use a local file, S3 or an existing LDAP infrastructure.  Through the use of optional plugins, you can connect SQL databases, PAM, and other datastores.
+
 ```toml
 [backend]
   datastore = "ldap"
   servers = [ "ldaps://server1:636", "ldaps://server2:636" ]
 ```
 
-### Production:
-Any of the architectures above will work for production.  Just remember:
-
- * Always use legit SSL certs for production!
-
-# Other Architectures
-A small note about other architectures: while I expect the code is, for the most part, system-independent, there is not a good (and free) CI system which can be easily used to continuously test releases on ARM, BSD, Linux-32bit, and Windows. As such, all of the non-linux-64bit packages are provided as is. The extent of testing on these packages consists solely of cross-compiling for these architectures from a linux 64 bit system.
-
-We will accept PRs which fix bugs on these platforms, but be aware these binaries will not be tested regularly, and instead are provided for the convenience of those who feel comfortable with this.
-
-### Building:
-You'll need go-bindata to build GLAuth. Then use the Makefile.
-```unix
-go get github.com/jteeuwen/go-bindata/...
-make all
-```
-
-# Logging
-- using logr with increasing verbosity
-  - 0 you always want to see this
-  - 1 common logging that you might *possibly* want to turn off (error)
-  - 2 warn
-  - 3 notice
-  - 4 info
-  - 6 debug
-  - 8 trace
-  - 10 I would like to performance test your log collection stack
-- errors really are errors that cannot be handled or returned
-  - returning a proper LDAP error code is handling an error
-
-# Testing
-
-Of course, a core set of tests is being run by Travis CI. However, when developing new features/refactoring, a more comprehensive regression testing suite is needed.
-
-You can run `go test` to execute the tests found in `glauth_test.go` -- better, if it is installed, you can run [goconvey](https://github.com/smartystreets/goconvey)
-
-Since some tests cover TOTP, you will first need to install `oathtool` in your environment.
-
-In order to test GLAuth against an LDAP backend, you will need docker. Run this command:
-```
-docker run \
-    --rm \
-    -d \
-    -p 389:389 \
-    --name openldap-service \
-    --hostname ldap-service \
-    --env LDAP_ORGANISATION="GLauth" \
-    --env LDAP_DOMAIN="glauth.com" \
-    --env LDAP_ADMIN_PASSWORD="password" \
-    --env LDAP_CONFIG_PASSWORD="password" \
-    --env LDAP_BASE_DN="dc=glauth,dc=com" \
-    -v $PWD/misc/openldap/config:/etc/ldap/slapd.d \
-    -v $PWD/misc/openldap/db:/var/lib/ldap \
-    osixia/openldap:latest
-```
-
-Refer to [this page](https://github.com/glauth/glauth/wiki/Quick-openldap-setup-to-test-LDAP-backend) for a somewhat more in-depth overview of testing with OpenLDAP.
-
-# Compatibility
-
-While our stated goal for GLAuth is to provide the simplest possible authentication server, we keep finding an increasing number of client appliances that are asking fairly "existential" questions of the server. We have been working on providing answers these clients will find satisfactory.
-
-### Root DSE
-
-RFC 4512: "An LDAP server SHALL provide information about itself and other information that is specific to each server.  This is represented as a group of attributes located in the root DSE"
-
-Test: `ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -s base "(objectclass=*)"`
-
-### Subschema Discovery
-
-RFC 4512: "To read schema attributes from the subschema (sub)entry, clients MUST issue a Search operation [RFC4511] where baseObject is the DN of the subschema (sub)entry..."
-
-Test: `ldapsearch -LLL -o ldif-wrap=no -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bcn=schema -s base`
-
-By default, this query will return a very minimal schema (~5 objects) -- you can ask GLAuth to return more comprehensive schemas by unpacking, in the `schema/` directory, the OpenLDAP or FreeIPA schema archives found in the `assets/` directory.
-
-### LDAP Backend: "1.1" attribute
-
-RFC 4511: "A list containing only the OID "1.1" indicates that no attributes are to be returned."
-
-## Stargazers over time
+# Stargazers over time
 
 [![Stargazers over time](https://starchart.cc/glauth/glauth.svg)](https://starchart.cc/glauth/glauth)
-

bindata.go

@@ -1,283 +0,0 @@
-// Code generated by go-bindata.
-// sources:
-// assets/glauth.css
-// assets/glauth.js
-// assets/index.html
-// DO NOT EDIT!
-
-package main
-
-import (
-	"bytes"
-	"compress/gzip"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-func bindataRead(data []byte, name string) ([]byte, error) {
-	gz, err := gzip.NewReader(bytes.NewBuffer(data))
-	if err != nil {
-		return nil, fmt.Errorf("Read %q: %v", name, err)
-	}
-
-	var buf bytes.Buffer
-	_, err = io.Copy(&buf, gz)
-	clErr := gz.Close()
-
-	if err != nil {
-		return nil, fmt.Errorf("Read %q: %v", name, err)
-	}
-	if clErr != nil {
-		return nil, err
-	}
-
-	return buf.Bytes(), nil
-}
-
-type asset struct {
-	bytes []byte
-	info  os.FileInfo
-}
-
-type bindataFileInfo struct {
-	name    string
-	size    int64
-	mode    os.FileMode
-	modTime time.Time
-}
-
-func (fi bindataFileInfo) Name() string {
-	return fi.name
-}
-func (fi bindataFileInfo) Size() int64 {
-	return fi.size
-}
-func (fi bindataFileInfo) Mode() os.FileMode {
-	return fi.mode
-}
-func (fi bindataFileInfo) ModTime() time.Time {
-	return fi.modTime
-}
-func (fi bindataFileInfo) IsDir() bool {
-	return false
-}
-func (fi bindataFileInfo) Sys() interface{} {
-	return nil
-}
-
-var _assetsGlauthCss = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x8c\x8f\x41\x6e\xc3\x20\x10\x45\xf7\x9c\x62\x24\xaf\x63\xd9\x0e\x4e\xc1\x39\x0d\x03\x63\x9b\xd6\x01\x04\xa4\xad\x5a\xf5\xee\x95\x1d\x39\x2a\xc9\xa6\xeb\xff\xfe\x7f\x33\xac\x7e\xbd\x5e\xd0\xe7\xe8\x1d\x7c\x33\x00\xed\x17\x1f\x07\xa8\x74\x73\x94\x1d\x9e\x19\x00\x2a\xfd\x36\x45\x7f\x75\xe6\xb0\x87\xa4\xc7\x66\x6c\xcf\xec\x87\xb1\x2a\x65\x95\x53\x50\x8e\x96\xa2\x7f\xe4\x5c\xf6\xf4\x84\xd4\x17\xca\xd1\xea\x07\x54\x0a\x83\x7f\xd0\x22\x95\xd8\x4b\x3c\xad\x87\x04\x65\x8c\x75\xd3\x00\x22\x7c\xae\x74\x95\x28\xbe\x53\xfc\x2f\xce\xe6\x6e\x25\x77\xb0\x93\xa2\x41\x79\xb3\x66\x65\x17\xc8\x73\x31\xf4\x32\x0a\x2d\xcc\xe6\xb9\xc5\x66\x8b\xef\xab\x7c\x5d\x7d\xfe\x17\x60\xf4\x2e\x1f\x92\xfd\xa2\x01\xda\x5d\xbd\x4f\xd4\x3e\x14\x12\x41\x9c\x2b\x73\x6f\x7d\x90\x9d\xe6\x3c\x00\xfa\xa5\x30\xd7\x3e\xd4\x68\x9d\x29\xba\xed\x49\x35\xa2\x7f\xc4\x12\xa9\xa8\xcb\x4f\x5a\x85\x5a\xea\xed\x8e\xdf\x00\x00\x00\xff\xff\x91\x33\xcc\x6e\xee\x01\x00\x00")
-
-func assetsGlauthCssBytes() ([]byte, error) {
-	return bindataRead(
-		_assetsGlauthCss,
-		"assets/glauth.css",
-	)
-}
-
-func assetsGlauthCss() (*asset, error) {
-	bytes, err := assetsGlauthCssBytes()
-	if err != nil {
-		return nil, err
-	}
-
-	info := bindataFileInfo{name: "assets/glauth.css", size: 494, mode: os.FileMode(436), modTime: time.Unix(1524616076, 0)}
-	a := &asset{bytes: bytes, info: info}
-	return a, nil
-}
-
-var _assetsGlauthJs = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x54\xd1\x8a\xdb\x30\x10\x7c\xf7\x57\x6c\xdd\xc0\xc9\x34\x95\x43\x5f\x43\xfa\x76\x70\x29\xf4\x0a\x6d\x7e\x40\xb1\xd6\x89\xa8\x2c\x99\xf5\xc6\x69\x39\xfc\xef\x45\x96\x9d\xf8\x72\x77\x70\xc5\x2f\x49\xd8\x9d\x99\x8c\x35\x63\xb5\x8a\xc0\x38\x46\x6a\x95\x85\x0d\x7c\x59\xad\x56\xeb\x24\x59\x88\xf2\xe4\x0a\x36\xde\x89\x0c\x9e\x12\x80\x53\xad\x15\xe3\x77\x64\x32\x45\x23\xb2\x75\x02\x90\xe7\x71\xb8\x53\xc6\x86\x49\x97\xad\x93\x24\xc8\xb1\x32\x76\xab\x61\x03\x41\x69\xd4\xb9\x55\xe8\x55\x03\xba\x8a\x13\xd8\xc0\x42\x1e\x90\xbf\xfd\xfa\xf1\x28\x20\xcd\x35\xee\x4f\x87\xbc\x55\xd4\xa4\x4b\xb8\x98\xd1\x91\x17\x99\x8c\x55\x6d\x15\x23\x6c\xe0\x41\x39\x6d\x71\xaf\xa8\x91\x85\xaf\x6a\x63\x51\xc0\x42\xa4\x1f\x1b\x56\xdc\xd4\xca\xa1\xfd\x3c\xa2\xd3\x4c\x1e\xb9\xb2\x22\x83\xfe\x29\xa2\x54\x98\x84\xdf\x9b\x8b\xa8\xd0\xc3\xfa\xb9\xcc\xc8\x0e\x1f\x13\xfe\x7b\xad\xcc\x77\x31\xc3\x00\x52\x8b\x34\xd3\x42\xd4\x78\x61\xa2\xcb\x12\x00\x59\x86\x26\xdc\x14\xe7\xad\x03\x4c\xef\x89\x3c\x7d\x48\x27\x74\x65\xcf\xea\x6f\xf3\x52\xa0\x41\xde\x99\x0a\xfd\x89\xc5\xb3\x12\x2d\xc7\xde\x0e\x1a\xeb\xa4\xbb\xad\x5b\xec\xe6\xa5\x6b\xa1\x99\xb7\x45\x0b\xb3\x3c\x85\x4f\x63\x6d\x5f\x6b\x9b\x96\xa5\xa7\x7b\x55\x1c\xaf\xe6\x70\xdc\x01\x98\x12\x04\xca\xad\x86\xaf\x83\xc6\x75\x05\xd7\x97\x21\x20\xd6\xc3\xb8\xeb\xbf\xbb\xff\xcb\x2f\x28\xcd\x08\xaf\xcf\x4a\x1e\x8d\x46\x91\xc9\x9a\xb0\x46\xa7\x77\x7e\xd0\x4d\x33\x59\x2a\x8d\x5b\x27\xc2\x05\xf0\xae\x48\x07\xda\xec\x30\x43\x44\xaf\x25\x99\x4c\xce\x81\xf0\x60\x1a\x46\x7a\x40\x5b\x23\x89\xbb\xc0\xfb\x89\x56\xb1\x69\xf1\x6e\x12\x58\xe1\x1d\xe3\x1f\x5e\xc2\xde\xfa\xe2\x77\xfc\xcb\x90\xce\xd9\x38\xed\xcf\xb2\xf2\x15\x3a\x1e\x9d\xe4\x39\x21\x9f\xc8\x41\x1c\x8f\xe4\x4c\x96\xe4\xab\x47\x7f\x16\xc3\xd1\xbd\x85\xf2\x54\x29\x8e\xa0\x0e\x6d\x83\x4f\x53\xf4\x00\xeb\x97\xc3\xd5\xf8\x2f\x00\x00\xff\xff\x1d\x12\x43\xad\x6a\x05\x00\x00")
-
-func assetsGlauthJsBytes() ([]byte, error) {
-	return bindataRead(
-		_assetsGlauthJs,
-		"assets/glauth.js",
-	)
-}
-
-func assetsGlauthJs() (*asset, error) {
-	bytes, err := assetsGlauthJsBytes()
-	if err != nil {
-		return nil, err
-	}
-
-	info := bindataFileInfo{name: "assets/glauth.js", size: 1386, mode: os.FileMode(436), modTime: time.Unix(1526347681, 0)}
-	a := &asset{bytes: bytes, info: info}
-	return a, nil
-}
-
-var _assetsIndexHtml = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xb4\x57\x6d\x6f\xdb\x36\x10\xfe\x9e\x5f\x71\xd1\xbe\x4e\x62\xed\xae\x5b\x17\xc8\x06\xba\x34\x5b\x03\xb4\x6b\x90\x76\xd8\x86\xa2\x28\x68\xf1\x6c\xd1\xa1\x48\x85\x77\x72\x62\x08\xfa\xef\x03\x2d\xbf\xc9\x73\x12\xc7\xd8\xbe\xd8\x22\xf9\xdc\xcb\xf3\xf0\x8e\xa2\xd2\xd3\xb7\x1f\xcf\x3f\xff\x7d\x75\x01\x39\x17\x66\x78\x92\x86\x3f\x30\xd2\x4e\x06\x11\xda\x68\x78\x02\x90\xe6\x28\x55\x78\x00\x48\x0b\x64\x09\x59\x2e\x3d\x21\x0f\xa2\x8a\xc7\xf1\xeb\x68\x7b\x29\x67\x2e\x63\xbc\xad\xf4\x6c\x10\xfd\x15\xff\xf1\x26\x3e\x77\x45\x29\x59\x8f\x0c\x46\x90\x39\xcb\x68\x79\x10\x5d\x5e\x0c\x50\x4d\xb0\x63\x69\x65\x81\x83\x68\xa6\xf1\xae\x74\x9e\xb7\xc0\x77\x5a\x71\x3e\x50\x38\xd3\x19\xc6\x8b\xc1\xf7\xa0\xad\x66\x2d\x4d\x4c\x99\x34\x38\xe8\xed\x71\xa4\x90\x32\xaf\x4b\xd6\xce\x6e\xf9\xda\x03\x94\x15\xe7\xce\x77\x31\x2d\x88\x35\x1b\x1c\xfe\xf6\xfe\x4d\xc5\x39\x7c\x62\xc9\x15\xa5\xa2\x9d\x5c\x22\x8c\xb6\x37\xe0\xd1\x0c\x22\xe2\xb9\x41\xca\x11\x39\x82\xdc\xe3\x78\x10\x05\x25\xe8\x4c\x88\x42\xde\x67\xca\x26\x23\xe7\x98\xd8\xcb\x32\x0c\x32\x57\x88\xf5\x84\x78\x99\xf4\x93\x17\x22\x23\xda\xcc\x25\x85\xb6\x49\x46\xb4\xca\xf7\x7f\x0b\x14\x73\x8e\x05\x3e\x27\x9c\x24\x42\x26\x31\x31\x41\xb8\xa5\x51\x6b\x75\x1a\xc7\xf0\xee\xf3\x87\xf7\xaf\x80\x72\x5d\x80\xb4\x0a\xae\x91\x4a\x67\x55\x32\x25\xb8\xbc\x78\x0d\x54\x95\x61\x73\xc1\x8d\x97\x40\x34\x58\xa0\x65\x5a\x80\x0b\x54\x5a\xc2\x6d\x85\x5e\x23\x41\x1c\x0f\xd7\x6e\xbf\xe8\x31\x18\x86\xcb\x0b\xf8\xf9\x6b\x3b\x0b\x90\xb6\xfb\x0b\xe4\xb3\x8d\x06\x8e\x28\x59\xea\x10\xa8\x87\x5a\x7e\x45\xb9\x9e\x89\x97\xc9\x4f\x49\x7f\x33\x5e\x10\x9e\x52\x34\x4c\x45\xeb\xe6\x39\x5e\x7d\x4b\x4a\xf4\x92\x1f\x92\xfe\x6a\xf4\x80\xc7\xf4\xf4\x0b\x5a\xa5\xc7\x5f\x5b\x3a\xa9\x68\x7b\x29\x3c\x8e\x9c\x9a\x83\x77\x26\x14\xab\xcb\xaa\xa0\xc3\x5a\x4a\xa5\x67\x90\x19\x49\x34\x88\x42\x5d\x4a\x6d\xd1\xc3\x62\xab\x62\xca\xdd\x5d\x26\x09\xa3\xa5\x6d\x21\xb5\x5d\xd9\x2d\x37\xe1\x83\xd4\x16\xa6\x55\x31\x72\xec\x9d\x85\xb1\xf3\x20\xa1\xf4\xba\x90\x7e\x0e\x85\xf4\x37\xc8\xda\x4e\xa0\x40\x22\x39\x41\x70\x1e\x32\x69\x0c\xb0\x03\x99\x85\x86\x59\x6b\xdf\xcd\x64\xed\x31\x5a\xad\xae\x11\x5a\x85\x52\x91\x4c\xa5\xb4\x68\xa2\x95\xc5\x62\x04\x8b\xdf\x58\xe1\x58\x56\x86\xa1\xac\x8c\x89\xbd\x9e\xe4\xdc\x75\x23\x94\x9e\x6d\x26\xd2\xbc\xb7\xec\xbc\x54\xe4\xbd\xad\xf9\x72\xf8\x39\xd7\x04\xec\x9c\x01\x4d\xa0\x2d\x28\x9c\xa1\x71\x65\xd0\x0f\x62\xb0\x8e\xe1\xb6\xd2\x8c\xe0\x51\xaa\xf9\x82\x7c\xe9\x9d\xaa\x16\xcc\x4e\x53\x51\x6e\xb4\x6a\x43\xee\x61\xea\xdd\xdd\x56\x72\xdd\xdd\x30\xf1\x3d\xc5\xbd\x3e\x84\x27\x2a\xe2\x1f\xbb\x2c\xf2\xfe\x70\xa1\x43\x2a\xf2\xfe\xc3\x2a\x45\x4f\x48\xba\xa3\x45\x27\xcf\x67\xe7\x33\x92\xd9\x0d\x5a\x05\x84\x7e\x86\xfe\x91\xcc\xda\xf5\xa3\x72\xfb\x77\xa2\xed\x73\x5b\x8f\x62\x53\xc3\xa1\xb2\x4e\xb6\x1b\xad\x5b\x39\x31\x63\x51\x1a\xc9\x18\x01\xcf\x4b\x1c\x44\x8c\xf7\x2c\xee\xe3\x5c\x5a\x65\x70\x24\x3d\x6d\x10\xfb\x37\xa8\x75\x13\x7a\xab\x93\x76\x08\x58\x4a\xbb\x42\x15\xc8\x5e\x67\xd1\xb0\xf4\xee\x7e\x9e\x04\xda\xda\xd9\xb3\x54\x04\xcc\x10\xea\xba\x33\xdf\x34\xe9\xc8\xef\xa5\xbc\xe9\xf5\xfd\x9c\x8e\xa1\xf3\x70\x9e\xdf\xc6\x7e\xf1\x8e\x52\xc9\x48\x5b\xf5\xcd\xe3\x2d\xed\xa6\xbc\x07\xd2\xc9\xfe\x60\xe7\x54\x65\x19\x12\xe1\x53\x11\xd6\xb8\xe3\xc2\xa0\xf7\xce\x3f\x15\xa3\x05\x3d\x3b\x00\xa1\xf4\x59\xfe\x84\x4c\x5b\xa0\x63\x03\x1c\x20\xd5\x2e\xf2\xd8\x50\x4f\xc9\xd5\x81\x3d\x3b\x48\x66\xdc\xa3\x2c\xda\xf5\x2d\xb7\x8f\x95\x7f\x7b\x98\x1c\xd3\x00\x75\xfd\x1d\xca\x2c\x87\x36\xfa\xf2\xf4\x4a\x96\x0e\x9b\xe6\xe4\xd1\x86\xae\xeb\x4f\x59\x78\x4d\x36\xcd\x99\x10\x75\xfd\xce\x11\x87\x6b\x5e\xd3\x9c\xd5\xf5\x95\xf3\xdc\x34\x1b\x7a\x57\xda\x4e\x9a\x06\xea\xba\xbd\xdb\x35\x0d\x6c\x09\x56\xd7\x22\x64\xb1\x8c\xf7\x08\x53\x96\xfa\xa8\x63\x2b\xe5\x70\x48\x6d\x8e\x95\x15\x6d\xce\x75\x87\x25\xfb\x15\xc7\xdd\x03\x8d\xd5\x6a\xc5\x95\x50\xd7\x1f\xcb\xa6\x09\x02\x84\xff\x54\xb0\x3a\x0c\xfd\x8b\xb6\xea\xed\xef\xcf\xb1\xf8\xb4\x28\xb2\x6b\xbc\x4d\x7e\xd5\x86\xd1\x3f\x61\x1b\x4c\xae\x91\x2a\xc3\xe7\x4e\xe1\x01\xe0\x95\xff\x60\x42\x07\xe0\xcf\x8d\x46\xcb\x97\x57\x07\x40\x95\x64\xbc\x46\x23\x59\xcf\x10\xfe\xcc\xd1\xee\xda\xa4\x82\xfd\xf6\x96\x6c\xd7\x40\x77\xcb\x1e\xa8\x88\xce\xbd\x51\x4e\xe5\x7d\x32\x71\x6e\x62\x50\x96\x9a\x16\x97\xc7\x30\x27\x8c\x1e\x91\x98\x86\x9b\xee\x5c\xf4\x92\x5e\x2f\xe9\x2d\x47\x0f\xdd\x22\xf7\x79\x3f\xf4\xbe\x3f\xdd\xfd\xae\x38\xd0\x7f\xa6\xec\x94\x42\xd3\x57\x6a\x6c\xa4\xc7\x9d\xf4\x37\xb5\x9d\x4c\x49\xf4\x93\x17\xc9\x8b\xed\xb9\xff\x2e\x50\xe1\xc2\xd5\xae\x0d\xf2\x3a\x79\xb9\x1c\xc7\x77\x9a\xf3\xd8\xb8\xf0\x01\x78\x50\xb4\xee\x77\xcb\x2e\x38\x15\xed\xd6\xa6\xa2\xfd\x0c\xfe\x27\x00\x00\xff\xff\x08\x9c\x44\x70\x17\x0f\x00\x00")
-
-func assetsIndexHtmlBytes() ([]byte, error) {
-	return bindataRead(
-		_assetsIndexHtml,
-		"assets/index.html",
-	)
-}
-
-func assetsIndexHtml() (*asset, error) {
-	bytes, err := assetsIndexHtmlBytes()
-	if err != nil {
-		return nil, err
-	}
-
-	info := bindataFileInfo{name: "assets/index.html", size: 3863, mode: os.FileMode(436), modTime: time.Unix(1524616076, 0)}
-	a := &asset{bytes: bytes, info: info}
-	return a, nil
-}
-
-// Asset loads and returns the asset for the given name.
-// It returns an error if the asset could not be found or
-// could not be loaded.
-func Asset(name string) ([]byte, error) {
-	cannonicalName := strings.Replace(name, "\\", "/", -1)
-	if f, ok := _bindata[cannonicalName]; ok {
-		a, err := f()
-		if err != nil {
-			return nil, fmt.Errorf("Asset %s can't read by error: %v", name, err)
-		}
-		return a.bytes, nil
-	}
-	return nil, fmt.Errorf("Asset %s not found", name)
-}
-
-// MustAsset is like Asset but panics when Asset would return an error.
-// It simplifies safe initialization of global variables.
-func MustAsset(name string) []byte {
-	a, err := Asset(name)
-	if err != nil {
-		panic("asset: Asset(" + name + "): " + err.Error())
-	}
-
-	return a
-}
-
-// AssetInfo loads and returns the asset info for the given name.
-// It returns an error if the asset could not be found or
-// could not be loaded.
-func AssetInfo(name string) (os.FileInfo, error) {
-	cannonicalName := strings.Replace(name, "\\", "/", -1)
-	if f, ok := _bindata[cannonicalName]; ok {
-		a, err := f()
-		if err != nil {
-			return nil, fmt.Errorf("AssetInfo %s can't read by error: %v", name, err)
-		}
-		return a.info, nil
-	}
-	return nil, fmt.Errorf("AssetInfo %s not found", name)
-}
-
-// AssetNames returns the names of the assets.
-func AssetNames() []string {
-	names := make([]string, 0, len(_bindata))
-	for name := range _bindata {
-		names = append(names, name)
-	}
-	return names
-}
-
-// _bindata is a table, holding each asset generator, mapped to its name.
-var _bindata = map[string]func() (*asset, error){
-	"assets/glauth.css": assetsGlauthCss,
-	"assets/glauth.js":  assetsGlauthJs,
-	"assets/index.html": assetsIndexHtml,
-}
-
-// AssetDir returns the file names below a certain
-// directory embedded in the file by go-bindata.
-// For example if you run go-bindata on data/... and data contains the
-// following hierarchy:
-//     data/
-//       foo.txt
-//       img/
-//         a.png
-//         b.png
-// then AssetDir("data") would return []string{"foo.txt", "img"}
-// AssetDir("data/img") would return []string{"a.png", "b.png"}
-// AssetDir("foo.txt") and AssetDir("notexist") would return an error
-// AssetDir("") will return []string{"data"}.
-func AssetDir(name string) ([]string, error) {
-	node := _bintree
-	if len(name) != 0 {
-		cannonicalName := strings.Replace(name, "\\", "/", -1)
-		pathList := strings.Split(cannonicalName, "/")
-		for _, p := range pathList {
-			node = node.Children[p]
-			if node == nil {
-				return nil, fmt.Errorf("Asset %s not found", name)
-			}
-		}
-	}
-	if node.Func != nil {
-		return nil, fmt.Errorf("Asset %s not found", name)
-	}
-	rv := make([]string, 0, len(node.Children))
-	for childName := range node.Children {
-		rv = append(rv, childName)
-	}
-	return rv, nil
-}
-
-type bintree struct {
-	Func     func() (*asset, error)
-	Children map[string]*bintree
-}
-
-var _bintree = &bintree{nil, map[string]*bintree{
-	"assets": {nil, map[string]*bintree{
-		"glauth.css": {assetsGlauthCss, map[string]*bintree{}},
-		"glauth.js":  {assetsGlauthJs, map[string]*bintree{}},
-		"index.html": {assetsIndexHtml, map[string]*bintree{}},
-	}},
-}}
-
-// RestoreAsset restores an asset under the given directory
-func RestoreAsset(dir, name string) error {
-	data, err := Asset(name)
-	if err != nil {
-		return err
-	}
-	info, err := AssetInfo(name)
-	if err != nil {
-		return err
-	}
-	err = os.MkdirAll(_filePath(dir, filepath.Dir(name)), os.FileMode(0755))
-	if err != nil {
-		return err
-	}
-	err = ioutil.WriteFile(_filePath(dir, name), data, info.Mode())
-	if err != nil {
-		return err
-	}
-	err = os.Chtimes(_filePath(dir, name), info.ModTime(), info.ModTime())
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-// RestoreAssets restores an asset under the given directory recursively
-func RestoreAssets(dir, name string) error {
-	children, err := AssetDir(name)
-	// File
-	if err != nil {
-		return RestoreAsset(dir, name)
-	}
-	// Dir
-	for _, child := range children {
-		err = RestoreAssets(dir, filepath.Join(name, child))
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func _filePath(dir, name string) string {
-	cannonicalName := strings.Replace(name, "\\", "/", -1)
-	return filepath.Join(append([]string{dir}, strings.Split(cannonicalName, "/")...)...)
-}

glauth.go

@@ -1,511 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/GeertJohan/yubigo"
-	"github.com/davecgh/go-spew/spew"
-	docopt "github.com/docopt/docopt-go"
-	"github.com/fsnotify/fsnotify"
-	"github.com/glauth/glauth/pkg/config"
-	"github.com/glauth/glauth/pkg/frontend"
-	gologgingr "github.com/glauth/glauth/pkg/gologgingr"
-	"github.com/glauth/glauth/pkg/server"
-	"github.com/glauth/glauth/pkg/stats"
-	"github.com/go-logr/logr"
-	"github.com/hydronica/toml"
-	"github.com/jinzhu/copier"
-	logging "github.com/op/go-logging"
-	"gopkg.in/amz.v3/aws"
-	"gopkg.in/amz.v3/s3"
-	// "github.com/davecgh/go-spew/spew"
-)
-
-// Set with buildtime vars
-var LastGitTag string
-var BuildTime string
-var GitCommit string
-var GitClean string
-var GitBranch string
-var GitTagIsCommit string
-
-const programName = "glauth"
-
-var usage = `glauth: securely expose your LDAP for external auth
-
-Usage:
-  glauth [options] -c <file|s3 url>
-  glauth -h --help
-  glauth --version
-
-Options:
-  -c, --config <file>       Config file.
-  -K <aws_key_id>           AWS Key ID.
-  -S <aws_secret_key>       AWS Secret Key.
-  -r <aws_region>           AWS Region [default: us-east-1].
-  --ldap <address>          Listen address for the LDAP server.
-  --ldaps <address>         Listen address for the LDAPS server.
-  --ldaps-cert <cert-file>  Path to cert file for the LDAPS server.
-  --ldaps-key <key-file>    Path to key file for the LDAPS server.
-  -h, --help                Show this screen.
-  --version                 Show version.
-`
-
-var (
-	log      logr.Logger
-	args     map[string]interface{}
-	stderr   *logging.LogBackend
-	yubiAuth *yubigo.YubiAuth
-
-	activeConfig = &config.Config{}
-)
-
-// Reads builtime vars and returns a full string containing info about
-// the currently running version of the software. Primarily used by the
-// --version flag at runtime.
-func getVersionString() string {
-
-	var versionstr string
-
-	versionstr = "GLauth"
-
-	// Notate the git context of the build
-	switch {
-	// If a release, use the tag
-	case GitClean == "1" && GitTagIsCommit == "1":
-		versionstr += " " + LastGitTag + "\n\n"
-
-	// If this branch had a tag before, mention the branch and the tag to give a rough idea of the base version
-	case len(GitBranch) > 1 && len(LastGitTag) > 1:
-		versionstr += "\nNon-release build from branch " + GitBranch + ", based on tag " + LastGitTag + "\n\n"
-
-	// If no previous tag specified, just mention the branch
-	case len(GitBranch) > 1:
-		versionstr += "\nNon-release build from branch " + GitBranch + "\n\n"
-
-	// Fallback message, if all else fails
-	default:
-		versionstr += "\nNon-release build\n\n"
-	}
-
-	// Include build time
-	if len(BuildTime) > 1 {
-		versionstr += "Build time: " + BuildTime + "\n"
-	}
-
-	// Add commit hash
-	if GitClean == "1" && len(GitCommit) > 1 {
-		versionstr += "Commit: " + GitCommit + "\n"
-	}
-
-	return versionstr
-
-}
-
-func main() {
-	stderr = initLogging()
-	log.V(6).Info("AP start")
-
-	if err := parseArgs(); err != nil {
-		log.Error(err, "Could not parse command-line arguments")
-		os.Exit(1)
-	}
-	if err := doConfig(); err != nil {
-		log.Error(err, "Configuration file error")
-		os.Exit(1)
-	}
-
-	startService()
-}
-
-func startService() {
-	// stats
-	stats.General.Set("version", stats.Stringer(LastGitTag))
-
-	// web API
-	if activeConfig.API.Enabled {
-		log.V(6).Info("Web API enabled")
-		go frontend.RunAPI(
-			frontend.Logger(log),
-			frontend.Config(&activeConfig.API),
-		)
-	}
-
-	startConfigWatcher()
-
-	s, err := server.NewServer(
-		server.Logger(log),
-		server.Config(activeConfig),
-	)
-	if err != nil {
-		log.Error(err, "Could not create server")
-		os.Exit(1)
-	}
-
-	if activeConfig.LDAP.Enabled {
-		// Don't block if also starting a LDAPS server afterwards
-		shouldBlock := !activeConfig.LDAPS.Enabled
-
-		if shouldBlock {
-			if err := s.ListenAndServe(); err != nil {
-				log.Error(err, "Could not start LDAP server")
-				os.Exit(1)
-			}
-		} else {
-			go func() {
-				if err := s.ListenAndServe(); err != nil {
-					log.Error(err, "Could not start LDAP server")
-					os.Exit(1)
-				}
-			}()
-		}
-	}
-
-	if activeConfig.LDAPS.Enabled {
-		// Always block here
-		if err := s.ListenAndServeTLS(); err != nil {
-			log.Error(err, "Could not start LDAPS server")
-			os.Exit(1)
-		}
-	}
-
-	log.V(0).Info("AP exit")
-	os.Exit(1)
-}
-
-func startConfigWatcher() {
-	configFileLocation := getConfigLocation()
-	if !activeConfig.WatchConfig || strings.HasPrefix(configFileLocation, "s3://") {
-		return
-	}
-
-	watcher, err := fsnotify.NewWatcher()
-	if err != nil {
-		log.Error(err, "Could not start config-watcher")
-		return
-	}
-
-	ticker := time.NewTicker(1 * time.Second)
-	go func() {
-		isChanged, isRemoved := false, false
-		for {
-			select {
-			case event := <-watcher.Events:
-				log.V(6).Info("watcher got event", "e", event.Op.String())
-				if event.Op&fsnotify.Write == fsnotify.Write {
-					isChanged = true
-				} else if event.Op&fsnotify.Remove == fsnotify.Remove { // vim edit file with rename/remove
-					isChanged, isRemoved = true, true
-				}
-			case err := <-watcher.Errors:
-				log.Error(err, "Error!")
-			case <-ticker.C:
-				// wakeup, try finding removed config
-			}
-			if _, err := os.Stat(configFileLocation); !os.IsNotExist(err) && (isRemoved || isChanged) {
-				if isRemoved {
-					log.V(6).Info("rewatching config", "file", configFileLocation)
-					watcher.Add(configFileLocation) // overwrite
-					isChanged, isRemoved = true, false
-				}
-				if isChanged {
-					if err := doConfig(); err != nil {
-						log.V(2).Info("Could not reload config. Holding on to old config", "error", err.Error())
-					} else {
-						log.V(3).Info("Config was reloaded")
-					}
-					isChanged = false
-				}
-			}
-		}
-	}()
-
-	watcher.Add(configFileLocation)
-}
-
-func parseArgs() error {
-	var err error
-
-	if args, err = docopt.Parse(usage, nil, true, getVersionString(), false); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func getConfigLocation() string {
-	return args["--config"].(string)
-}
-
-func parseConfigFile(configFileLocation string) (*config.Config, error) {
-	cfg := config.Config{}
-	// setup defaults
-	cfg.LDAP.Enabled = false
-	cfg.LDAPS.Enabled = true
-
-	// parse the config file
-	if strings.HasPrefix(configFileLocation, "s3://") {
-		if _, present := aws.Regions[args["-r"].(string)]; present == false {
-			return &cfg, fmt.Errorf("Invalid AWS region: %s", args["-r"])
-		}
-		region := aws.Regions[args["-r"].(string)]
-		auth, err := aws.EnvAuth()
-		if err != nil {
-			if args["-K"] == nil || args["-S"] == nil {
-				return &cfg, fmt.Errorf("AWS credentials not found: must use -K and -S flags, or set these env vars:\n\texport AWS_ACCESS_KEY_ID=\"AAA...\"\n\texport AWS_SECRET_ACCESS_KEY=\"BBBB...\"\n")
-			}
-			auth = aws.Auth{
-				AccessKey: args["-K"].(string),
-				SecretKey: args["-S"].(string),
-			}
-		}
-		// parse S3 url
-		s3url := strings.TrimPrefix(configFileLocation, "s3://")
-		parts := strings.SplitN(s3url, "/", 2)
-		if len(parts) != 2 {
-			return &cfg, fmt.Errorf("Invalid S3 URL: %s", s3url)
-		}
-		b, err := s3.New(auth, region).Bucket(parts[0])
-		if err != nil {
-			return &cfg, err
-		}
-		tomlData, err := b.Get(parts[1])
-		if err != nil {
-			return &cfg, err
-		}
-		if _, err := toml.Decode(string(tomlData), &cfg); err != nil {
-			return &cfg, err
-		}
-	} else { // local config file
-		if _, err := toml.DecodeFile(configFileLocation, &cfg); err != nil {
-			return &cfg, err
-		}
-	}
-
-	// Backward Compability
-	if cfg.Backend.Datastore != "" {
-		if cfg.Backends != nil {
-			return &cfg, fmt.Errorf("You cannot specify both [Backend] and [[Backends]] directives in the same configuration ")
-		} else {
-			cfg.Backends = append(cfg.Backends, cfg.Backend)
-		}
-	}
-	spew.Dump(cfg.Backends)
-
-	// Patch with default values where not specified
-	for i := range cfg.Backends {
-		if cfg.Backends[i].NameFormat == "" {
-			cfg.Backends[i].NameFormat = "cn"
-		}
-		if cfg.Backends[i].GroupFormat == "" {
-			cfg.Backends[i].GroupFormat = "ou"
-		}
-		if cfg.Backends[i].SSHKeyAttr == "" {
-			cfg.Backends[i].SSHKeyAttr = "sshPublicKey"
-		}
-	}
-	//
-
-	return &cfg, nil
-}
-
-func handleArgs(cfg config.Config) (*config.Config, error) {
-	// LDAP flags
-	if ldap, ok := args["--ldap"].(string); ok && ldap != "" {
-		cfg.LDAP.Enabled = true
-		cfg.LDAP.Listen = ldap
-	}
-
-	// LDAPS flags
-	if ldaps, ok := args["--ldaps"].(string); ok && ldaps != "" {
-		cfg.LDAPS.Enabled = true
-		cfg.LDAPS.Listen = ldaps
-	}
-	if ldapsCert, ok := args["--ldaps-cert"].(string); ok && ldapsCert != "" {
-		cfg.LDAPS.Cert = ldapsCert
-	}
-	if ldapsKey, ok := args["--ldaps-key"].(string); ok && ldapsKey != "" {
-		cfg.LDAPS.Key = ldapsKey
-	}
-
-	return &cfg, nil
-}
-
-func handleLegacyConfig(cfg config.Config) (*config.Config, error) {
-	if len(cfg.Frontend.Listen) > 0 && (len(cfg.LDAP.Listen) > 0 || len(cfg.LDAPS.Listen) > 0) {
-		// Both old server-config and new - dont allow
-		return &cfg, fmt.Errorf("Both old and new server-config in use - please remove old format ([frontend]) and migrate to new format ([ldap], [ldaps])")
-	}
-
-	if len(cfg.Frontend.Listen) > 0 {
-		// We're going with old format - parse it into new
-		log.V(2).Info("Config [frontend] is deprecated - please move to [ldap] and [ldaps] as-per documentation")
-
-		cfg.LDAP.Enabled = !cfg.Frontend.TLS
-		cfg.LDAPS.Enabled = cfg.Frontend.TLS
-
-		if cfg.Frontend.TLS {
-			cfg.LDAPS.Listen = cfg.Frontend.Listen
-		} else {
-			cfg.LDAP.Listen = cfg.Frontend.Listen
-		}
-
-		if len(cfg.Frontend.Cert) > 0 {
-			cfg.LDAPS.Cert = cfg.Frontend.Cert
-		}
-		if len(cfg.Frontend.Key) > 0 {
-			cfg.LDAPS.Key = cfg.Frontend.Key
-		}
-	}
-	return &cfg, nil
-}
-func validateConfig(cfg config.Config) (*config.Config, error) {
-
-	if !cfg.LDAP.Enabled && !cfg.LDAPS.Enabled {
-		return &cfg, fmt.Errorf("No server configuration found: please provide either LDAP or LDAPS configuration")
-	}
-
-	if cfg.LDAPS.Enabled {
-		// LDAPS enabled - verify requirements (cert, key, listen)
-		if len(cfg.LDAPS.Cert) == 0 || len(cfg.LDAPS.Key) == 0 {
-			return &cfg, fmt.Errorf("LDAPS was enabled but no certificate or key were specified: please disable LDAPS or use the 'cert' and 'key' options")
-		}
-
-		if len(cfg.LDAPS.Listen) == 0 {
-			return &cfg, fmt.Errorf("No LDAPS bind address was specified: please disable LDAPS or use the 'listen' option")
-		}
-	}
-
-	if cfg.LDAP.Enabled {
-		// LDAP enabled - verify listen
-		if len(cfg.LDAP.Listen) == 0 {
-			return &cfg, fmt.Errorf("No LDAP bind address was specified: please disable LDAP or use the 'listen' option")
-		}
-	}
-
-	//spew.Dump(cfg)
-	for i := range cfg.Backends {
-		switch cfg.Backends[i].Datastore {
-		case "":
-			cfg.Backends[i].Datastore = "config"
-		case "config":
-		case "ldap":
-		case "owncloud":
-		case "plugin":
-		default:
-			return &cfg, fmt.Errorf("invalid backend %s - must be 'config', 'ldap', 'owncloud' or 'plugin'", cfg.Backends[i].Datastore)
-		}
-	}
-
-	// TODO: remove after deprecating UnixID on User and Group
-	for _, user := range cfg.Users {
-		if user.UnixID != 0 {
-			user.UIDNumber = user.UnixID
-			log.V(2).Info(fmt.Sprintf("User '%s': 'unixid' is deprecated - please move to 'uidnumber' as per documentation", user.Name))
-		}
-	}
-	for _, group := range cfg.Groups {
-		if group.UnixID != 0 {
-			group.GIDNumber = group.UnixID
-			log.V(2).Info(fmt.Sprintf("Group '%s': 'unixid' is deprecated - please move to 'gidnumber' as per documentation", group.Name))
-		}
-	}
-
-	return &cfg, nil
-}
-
-// doConfig reads the cli flags and config file
-func doConfig() error {
-	// Parse config-file into config{} struct
-	cfg, err := parseConfigFile(getConfigLocation())
-	if err != nil {
-		return err
-	}
-
-	// Handle parsed flags
-	cfg, err = handleArgs(*cfg)
-	if err != nil {
-		return err
-	}
-
-	// Handle parsing of legacy [frontend] section into [ldap] and/or [ldaps] sections
-	cfg, err = handleLegacyConfig(*cfg)
-	if err != nil {
-		return err
-	}
-
-	cfg, err = validateConfig(*cfg)
-	if err != nil {
-		return err
-	}
-
-	// Before greenlighting new config entirely, lets make sure the yubiauth works - in case they changed
-	if activeConfig.YubikeyClientID != cfg.YubikeyClientID || activeConfig.YubikeySecret != cfg.YubikeySecret {
-		if len(cfg.YubikeyClientID) > 0 && len(cfg.YubikeySecret) > 0 {
-			_yubiAuth, err := yubigo.NewYubiAuth(cfg.YubikeyClientID, cfg.YubikeySecret)
-			if err != nil {
-				return err
-			}
-
-			// No errors, override
-			yubiAuth = _yubiAuth
-		}
-	}
-
-	// All config is validated and alright, copy to ativeConfig
-	if err := copier.Copy(activeConfig, cfg); err != nil {
-		return err
-	}
-
-	// Handle logging settings for new config
-	// - we do this last to make sure we only respect a fully validated config
-	stderr = initLogging()
-
-	if activeConfig.Debug {
-		logging.SetLevel(logging.DEBUG, programName)
-		log.V(6).Info("Debugging enabled")
-	}
-	if activeConfig.Syslog {
-		enableSyslog(stderr)
-	}
-
-	return nil
-}
-
-// initLogging sets up logging to stderr
-func initLogging() *logging.LogBackend {
-
-	l := logging.MustGetLogger(programName)
-	l.ExtraCalldepth = 2 // add extra call depth for the logr wrapper
-
-	log = gologgingr.New(
-		gologgingr.Logger(l),
-	)
-	gologgingr.SetVerbosity(10) // do not filter by verbosity. glauth uses the go-logging lib to filter the levels
-
-	format := "%{color}%{time:15:04:05.000000} %{shortfunc} ▶ %{level:.4s} %{id:03x}%{color:reset} %{message}"
-	logBackend := logging.NewLogBackend(os.Stderr, "", 0)
-
-	logging.SetBackend(logBackend)
-	logging.SetLevel(logging.NOTICE, programName)
-	logging.SetFormatter(logging.MustStringFormatter(format))
-	return logBackend
-}
-
-// enableSyslog turns on syslog and turns off color
-func enableSyslog(stderrBackend *logging.LogBackend) {
-	format := "%{time:15:04:05.000000} %{shortfunc} ▶ %{level:.4s} %{id:03x} %{message}"
-	logging.SetFormatter(logging.MustStringFormatter(format))
-	syslogBackend, err := logging.NewSyslogBackend("")
-	if err != nil {
-		log.Error(err, "Could not create new syslog backend")
-		os.Exit(1)
-	}
-
-	logging.SetBackend(stderrBackend, syslogBackend)
-
-	log.V(6).Info("Syslog enabled")
-}

glauth_test.go

@@ -1,223 +0,0 @@
-package main
-
-import (
-	"os/exec"
-	"strings"
-	"testing"
-	"time"
-
-	. "github.com/smartystreets/goconvey/convey"
-)
-
-type testEnv struct {
-	checkanonymousrootDSE bool
-	checkTOTP             bool
-	checkbindUPN          bool
-	svcdn                 string
-	svcdnnogroup          string
-	otpdn                 string
-	expectedinfo          string
-	expectedaccount       string
-	expectedfirstaccount  string
-	expectedgroup         string
-}
-
-func TestIntegerStuff(t *testing.T) {
-
-	Convey("Testing sample-simple local file-based LDAP server", t, func() {
-		svc := startSvc(SD, "bin/glauth", "-c", "sample-simple.cfg")
-		batteryOfTests(
-			t,
-			svc, testEnv{
-				checkanonymousrootDSE: true,
-				checkTOTP:             true,
-				checkbindUPN:          true,
-				expectedinfo:          "supportedLDAPVersion: 3",
-				svcdn:                 "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com",
-				svcdnnogroup:          "cn=serviceuser,dc=glauth,dc=com",
-				otpdn:                 "cn=otpuser,ou=superheros,dc=glauth,dc=com",
-				expectedaccount:       "dn: cn=hackers,ou=superheros,dc=glauth,dc=com",
-				expectedfirstaccount:  "dn: cn=hackers,ou=superheros,dc=glauth,dc=com",
-				expectedgroup:         "dn: cn=superheros,ou=groups,dc=glauth,dc=com",
-			})
-		stopSvc(svc)
-	})
-
-	matchingLibrary := doRunGetFirst(RD, "ls", "bin/sqlite.so")
-	if matchingLibrary == "bin/sqlite.so" {
-		Convey("Testing sample-database LDAP server", t, func() {
-			svc := startSvc(SD, "bin/glauth", "-c", "pkg/plugins/sample-database.cfg")
-			batteryOfTests(
-				t,
-				svc, testEnv{
-					checkanonymousrootDSE: true,
-					checkTOTP:             false,
-					checkbindUPN:          true,
-					expectedinfo:          "supportedLDAPVersion: 3",
-					svcdn:                 "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com",
-					svcdnnogroup:          "cn=serviceuser,dc=glauth,dc=com",
-					otpdn:                 "cn=otpuser,ou=superheros,dc=glauth,dc=com",
-					expectedaccount:       "dn: cn=hackers,ou=superheros,dc=glauth,dc=com",
-					expectedfirstaccount:  "dn: cn=hackers,ou=superheros,dc=glauth,dc=com",
-					expectedgroup:         "dn: cn=superheros,ou=groups,dc=glauth,dc=com",
-				})
-			stopSvc(svc)
-		})
-	}
-
-	matchingContainers := doRunGetFirst(RD, "sh", "-c", "docker ps | grep openldap-service | wc -l")
-	if matchingContainers == "1" {
-		Convey("Testing sample-simple local LDAP server", t, func() {
-			svc := startSvc(SD, "bin/glauth", "-c", "sample-ldap-injection.cfg")
-			batteryOfTests(
-				t,
-				svc, testEnv{
-					checkanonymousrootDSE: false,
-					checkTOTP:             true,
-					checkbindUPN:          false,
-					expectedinfo:          "objectClass: top",
-					svcdn:                 "cn=serviceuser,cn=svcaccts,ou=users,dc=glauth,dc=com",
-					svcdnnogroup:          "", // ignore
-					otpdn:                 "cn=otpuser,cn=superheros,ou=users,dc=glauth,dc=com",
-					expectedaccount:       "dn: cn=hackers,cn=superheros,ou=users,dc=glauth,dc=com",
-					expectedfirstaccount:  "dn: cn=johndoe,cn=superheros,ou=users,dc=glauth,dc=com",
-					expectedgroup:         "dn: cn=superheros,ou=users,dc=glauth,dc=com",
-				})
-			stopSvc(svc)
-		})
-	}
-}
-
-func batteryOfTests(t *testing.T, svc *exec.Cmd, env testEnv) {
-	Convey("When searching for the 'hackers' user", func() {
-		out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-		Convey("We should find them in the 'superheros' group", func() {
-			So(out, ShouldEqual, env.expectedaccount)
-		})
-	})
-
-	if env.svcdnnogroup != "" {
-		Convey("When searching for the 'hackers' user without binding with a group", func() {
-			out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdnnogroup, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-			Convey("We should find them in the 'superheros' group", func() {
-				So(out, ShouldEqual, env.expectedaccount)
-			})
-		})
-	}
-
-	if env.checkbindUPN {
-		Convey("When searching for the 'hackers' user after binding using the account's UPN", func() {
-			out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", "serviceuser@example.com", "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-			Convey("We should find them in the 'superheros' group", func() {
-				So(out, ShouldEqual, env.expectedaccount)
-			})
-		})
-	}
-
-	Convey("When querying the root SDE", func() {
-		out := doRunGetSecond(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-s", "base", "(objectclass=*)")
-		Convey("We should get some meta information", func() {
-			So(out, ShouldEqual, env.expectedinfo)
-		})
-	})
-
-	if env.checkanonymousrootDSE {
-		Convey("When querying the root SDE anonymously without authorizing in config file", func() {
-			out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-x", "-s", "base", "(objectclass=*)")
-			Convey("We should get error 50", func() {
-				So(out, ShouldEqual, "exit status 50")
-			})
-		})
-	}
-
-	Convey("When enumerating posix groups", func() {
-		out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(objectclass=posixgroup)")
-		Convey("We should get a list starting with the 'superheros' group", func() {
-			So(out, ShouldEqual, env.expectedgroup)
-		})
-	})
-
-	Convey("When searching for members of the 'superheros' group", func() {
-		out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(memberOf=cn=superheros,ou=groups,dc=glauth,dc=com)")
-		Convey("We should get a list starting with the 'hackers' user", func() {
-			So(out, ShouldEqual, env.expectedfirstaccount)
-		})
-	})
-
-	Convey("When performing a complex search for members of 'superheros' group", func() {
-		out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.svcdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "(&(objectClass=*)(memberOf=cn=superheros,ou=groups,dc=glauth,dc=com))")
-		Convey("We should get a list starting with the 'hackers' user", func() {
-			So(out, ShouldEqual, env.expectedfirstaccount)
-		})
-	})
-
-	if env.checkTOTP {
-		Convey("When searching for the 'hacker' user using a TOTP-enabled account", func() {
-			otpvalue := doRunGetFirst(RD, "oathtool", "--totp", "-b", "-d", "6", "3hnvnk4ycv44glzigd6s25j4dougs3rk")
-			out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret"+otpvalue, "-x", "-bdc=glauth,dc=com", "cn=hackers")
-			Convey("We should find them in in the 'superheros' group", func() {
-				So(out, ShouldEqual, env.expectedaccount)
-			})
-		})
-
-		Convey("When searching for the 'hacker' user using a TOTP-enabled account and no value", func() {
-			out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-			Convey("We should get 'Invalid credentials(49)'", func() {
-				So(out, ShouldEqual, "exit status 49")
-			})
-		})
-
-		Convey("When searching for the 'hacker' user using a TOTP-enabled account and the wrong value", func() {
-			out := doRunGetFirst(RD, "ldapsearch", "-LLL", "-H", "ldap://localhost:3893", "-D", env.otpdn, "-w", "mysecret123456", "-x", "-bdc=glauth,dc=com", "cn=hackers")
-			Convey("We should get 'Invalid credentials(49)'", func() {
-				So(out, ShouldEqual, "exit status 49")
-			})
-		})
-	}
-
-}
-
-// -----=============================================================================----
-
-const SD = 3 // Start Delay
-const RD = 2 // Response Delay
-
-func startSvc(delay time.Duration, name string, arg ...string) *exec.Cmd {
-	cmd := exec.Command(name, arg...)
-	cmd.Start()
-	if delay != 0 {
-		time.Sleep(time.Second * delay)
-	}
-	return cmd
-}
-
-func stopSvc(svc *exec.Cmd) {
-	svc.Process.Kill()
-}
-
-func doRunGetFirst(delay time.Duration, name string, arg ...string) string {
-	out := strings.SplitN(doRun(delay, name, arg...), "\n", 2)
-	if out == nil || len(out) < 1 {
-		return "*fail*"
-	}
-	return out[0]
-}
-
-func doRunGetSecond(delay time.Duration, name string, arg ...string) string {
-	out := strings.SplitN(doRun(delay, name, arg...), "\n", 3)
-	if out == nil || len(out) < 2 {
-		return "*fail*"
-	}
-	return out[1]
-}
-
-func doRun(delay time.Duration, name string, arg ...string) string {
-	out, err := exec.Command(name, arg...).Output()
-	if err != nil {
-		return err.Error()
-	}
-	if delay != 0 {
-		time.Sleep(time.Second * delay)
-	}
-	return strings.TrimSpace(string(out))
-}

go.mod

@@ -1,28 +0,0 @@
-module github.com/glauth/glauth
-
-go 1.15
-
-require (
-	github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e
-	github.com/boombuler/barcode v1.0.1
-	github.com/davecgh/go-spew v1.1.1
-	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
-	github.com/fsnotify/fsnotify v1.4.9
-	github.com/go-logr/logr v0.4.0
-	github.com/go-sql-driver/mysql v1.5.0
-	github.com/hydronica/toml v0.4.2
-	github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a
-	github.com/jteeuwen/go-bindata v3.0.7+incompatible
-	github.com/kr/pretty v0.2.1
-	github.com/lib/pq v1.10.0
-	github.com/mattn/go-sqlite3 v1.14.6
-	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484
-	github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba
-	github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
-	github.com/pquerna/otp v1.3.0
-	github.com/smartystreets/goconvey v1.6.4 // indirect
-	github.com/yaegashi/msgraph.go v0.1.1-0.20200221123608-2d438cf2a7cc
-	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 // indirect
-	gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b
-	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
-)

go.sum

@@ -1,88 +0,0 @@
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e h1:Bqtt5C+uVk+vH/t5dmB47uDCTwxw16EYHqvJnmY2aQc=
-github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e/go.mod h1:njRCDrl+1RQ/A/+KVU8Ho2EWAxUSkohOWczdW3dzDG0=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
-github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
-github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
-github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc=
-github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-sql-driver/mysql v1.5.0 h1:ozyZYNQW3x3HtqT1jira07DN2PArx2v7/mN66gGcHOs=
-github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/hydronica/toml v0.4.2 h1:BY+iAvyl2u1BlfgkJQzqc1UXDGLWfpMmOWuqJrwAVDU=
-github.com/hydronica/toml v0.4.2/go.mod h1:c7QhbYq3Wp9SlOWuG7MAieKUyXP2P/hXhy/YqWfbS/4=
-github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a h1:zPPuIq2jAWWPTrGt70eK/BSch+gFAGrNzecsoENgu2o=
-github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a/go.mod h1:yL958EeXv8Ylng6IfnvG4oflryUi3vgA3xPs9hmII1s=
-github.com/jteeuwen/go-bindata v3.0.7+incompatible h1:91Uy4d9SYVr1kyTJ15wJsog+esAZZl7JmEfTkwmhJts=
-github.com/jteeuwen/go-bindata v3.0.7+incompatible/go.mod h1:JVvhzYOiGBnFSYRyV00iY8q7/0PThjIYav1p9h5dmKs=
-github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lib/pq v1.10.0 h1:Zx5DJFEYQXio93kgXnQ09fXNiUKsqv4OUEu2UtGcB1E=
-github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/mattn/go-sqlite3 v1.14.6 h1:dNPt6NO46WmLVt2DLNpwczCmdV5boIZ6g/tlDrlRUbg=
-github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 h1:D9EvfGQvlkKaDr2CRKN++7HbSXbefUNDrPq60T+g24s=
-github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484/go.mod h1:O1EljZ+oHprtxDDPHiMWVo/5dBT6PlvWX5PSwj80aBA=
-github.com/nmcclain/ldap v0.0.0-20191021200707-3b3b69a7e9e3 h1:NNis9uuNpG5h97Dvxxo53Scg02qBg+3Nfabg6zjFGu8=
-github.com/nmcclain/ldap v0.0.0-20191021200707-3b3b69a7e9e3/go.mod h1:YtrVB1/v9Td9SyjXpjYVmbdKgj9B0nPTBsdGUxy0i8U=
-github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba h1:DO8NFYdcRv1dnyAINJIBm6Bw2XibtLvQniNFGzf2W8E=
-github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba/go.mod h1:4S0XndRL8HNOaQBfdViJ2F/GPCgL524xlXRuXFH12/U=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 h1:lDH9UUVJtmYCjyT0CI4q8xvlXPxeZ0gYCVvWbmPlp88=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pquerna/otp v1.3.0 h1:oJV/SkzR33anKXwQU3Of42rL4wbrffP4uvUf1SvS5Xs=
-github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/yaegashi/msgraph.go v0.1.1-0.20200221123608-2d438cf2a7cc h1:ejaC8rvIvCWmsaFrvmGOxhBuMxxhBB1xRshuM98XQ7M=
-github.com/yaegashi/msgraph.go v0.1.1-0.20200221123608-2d438cf2a7cc/go.mod h1:tso14hwzqX4VbnWTNsxiL0DvMb2OwbGISFA7jDibdWc=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9 h1:L2auWcuQIvxz9xSEqzESnV/QN/gNRXNApHi3fYwl2w0=
-golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384 h1:TFlARGu6Czu1z7q93HTxcP1P+/ZFC/IKythI5RzrnRg=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b h1:tdSyAzD5FHJmZAZ13d5WexAo7YJkiyGphhzFfInMnDw=
-gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b/go.mod h1:cE0dCGx2UfBTjLFlzEx4EXJUmoX6BXBoX9GjKOvqha4=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

go.work

@@ -0,0 +1,3 @@
+go 1.25.0
+
+use ./v2

pkg/config/config.go

@@ -1,107 +0,0 @@
-package config
-
-import "time"
-
-// config file
-type Backend struct {
-	BaseDN        string
-	Datastore     string
-	Insecure      bool     // For LDAP and owncloud backend only
-	Servers       []string // For LDAP and owncloud backend only
-	NameFormat    string
-	GroupFormat   string
-	SSHKeyAttr    string
-	UseGraphAPI   bool   // For ownCloud backend only
-	Plugin        string // Path to plugin library, for plugin backend only
-	PluginHandler string // Name of plugin's main handler function
-	Database      string // For Database backends only
-	AnonymousDSE  bool   // For Config and Database backends only
-}
-type Helper struct {
-	Enabled       bool
-	BaseDN        string
-	Datastore     string
-	Plugin        string // Path to plugin library, for plugin backend only
-	PluginHandler string // Name of plugin's main handler function
-	Database      string // For MySQL backend only TODO REname to match plugin
-}
-type Frontend struct {
-	AllowedBaseDNs []string // For LDAP backend only
-	Listen         string
-	Cert           string
-	Key            string
-	TLS            bool
-}
-type LDAP struct {
-	Enabled bool
-	Listen  string
-}
-type LDAPS struct {
-	Enabled bool
-	Listen  string
-	Cert    string
-	Key     string
-}
-type API struct {
-	Cert        string
-	Enabled     bool
-	Key         string
-	Listen      string
-	SecretToken string
-	TLS         bool
-}
-type Behaviors struct {
-	LimitFailedBinds      bool
-	NumberOfFailedBinds   int
-	PeriodOfFailedBinds   time.Duration
-	BlockFailedBindsFor   time.Duration
-	PruneSourceTableEvery time.Duration
-	PruneSourcesOlderThan time.Duration
-}
-type User struct {
-	Name          string
-	OtherGroups   []int
-	PassSHA256    string
-	PassBcrypt    string
-	PassAppSHA256 []string
-	PassAppBcrypt []string
-	PrimaryGroup  int
-	SSHKeys       []string
-	OTPSecret     string
-	Yubikey       string
-	Disabled      bool
-	UnixID        int // TODO: remove after deprecating UnixID on User and Group
-	UIDNumber     int
-	Mail          string
-	LoginShell    string
-	GivenName     string
-	SN            string
-	Homedir       string
-}
-type Group struct {
-	Name          string
-	UnixID        int // TODO: remove after deprecating UnixID on User and Group
-	GIDNumber     int
-	IncludeGroups []int
-}
-type Config struct {
-	API                API
-	Backend            Backend // Deprecated
-	Backends           []Backend
-	Helper             Helper
-	Behaviors          Behaviors
-	Debug              bool
-	WatchConfig        bool
-	YubikeyClientID    string
-	YubikeySecret      string
-	Frontend           Frontend
-	LDAP               LDAP
-	LDAPS              LDAPS
-	Groups             []Group
-	Syslog             bool
-	Users              []User
-	ConfigFile         string
-	AwsAccessKeyId     string
-	AwsSecretAccessKey string
-	AwsRegion          string
-}

pkg/frontend/webapi.go

@@ -1,70 +0,0 @@
-package frontend
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-
-	"github.com/glauth/glauth/pkg/assets"
-	"github.com/go-logr/logr"
-)
-
-// RunAPI provides a basic REST API
-func RunAPI(opts ...Option) {
-	options := newOptions(opts...)
-	log := options.Logger
-	cfg := options.Config
-
-	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		log.V(6).Info("Web", "path", r.URL.Path)
-		if r.URL.Path != "/" {
-			log.V(6).Info("Web 404")
-			http.NotFound(w, r)
-			return
-		}
-		pageTemplate, err := assets.Asset("assets/index.html")
-		if err != nil {
-			log.Error(err, "Error with HTTP server template asset")
-			return
-		}
-		fmt.Fprintf(w, string(pageTemplate))
-	})
-	http.HandleFunc("/assets/", webStaticHandler(log))
-	if cfg.TLS {
-		log.V(3).Info("Starting HTTPS server", "address", cfg.Listen)
-		err := http.ListenAndServeTLS(cfg.Listen, cfg.Cert, cfg.Key, nil)
-		if err != nil {
-			log.Error(err, "Error starting HTTPS server")
-			return
-		}
-	} else {
-		log.V(3).Info("Starting HTTP server", "address", cfg.Listen)
-		err := http.ListenAndServe(cfg.Listen, nil)
-		if err != nil {
-			log.Error(err, "Error starting HTTP server")
-			return
-		}
-	}
-}
-
-// webStaticHandler serves embedded static web files (js&css)
-func webStaticHandler(log logr.Logger) func(http.ResponseWriter, *http.Request) {
-	return func(w http.ResponseWriter, r *http.Request) {
-		assetPath := r.URL.Path[1:]
-		staticAsset, err := assets.Asset(assetPath)
-		if err != nil {
-			log.Error(err, "Cannot access asset")
-			http.NotFound(w, r)
-			return
-		}
-		headers := w.Header()
-		if strings.HasSuffix(assetPath, ".js") {
-			headers["Content-Type"] = []string{"application/javascript"}
-		} else if strings.HasSuffix(assetPath, ".css") {
-			headers["Content-Type"] = []string{"text/css"}
-		}
-		io.Copy(w, bytes.NewReader(staticAsset))
-	}
-}

pkg/gologgingr/gologgingr.go

@@ -1,186 +0,0 @@
-// Package gologgingr implements github.com/go-logr/logr.Logger in terms of
-// github.com/op/go-logging.
-package gologgingr
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"sort"
-
-	"github.com/go-logr/logr"
-)
-
-// The global verbosity level.  See SetVerbosity().
-var globalVerbosity int = 0
-
-// SetVerbosity sets the global level against which all info logs will be
-// compared.  If this is greater than or equal to the "V" of the logger, the
-// message will be logged.  A higher value here means more logs will be written.
-// The previous verbosity value is returned.  This is not concurrent-safe -
-// callers must be sure to call it from only one goroutine.
-func SetVerbosity(v int) int {
-	old := globalVerbosity
-	globalVerbosity = v
-	return old
-}
-
-// New returns a logr.Logger which is implemented by Go's standard
-// log package, or something like it.  See New for details.
-func New(opts ...Option) logr.Logger {
-	options := newOptions(opts...)
-
-	l := logger{
-		llog:   options.Logger,
-		level:  0,
-		prefix: "",
-		values: nil,
-	}
-
-	return l
-}
-
-// LeveledLogger is the subset of the Go stdlib log.Logger API that is needed for
-// this adapter.
-type LeveledLogger interface {
-	Fatal(args ...interface{})
-	Error(args ...interface{})
-	Warning(args ...interface{})
-	Notice(args ...interface{})
-	Info(args ...interface{})
-	Debug(args ...interface{})
-}
-
-type logger struct {
-	llog   LeveledLogger
-	level  int
-	prefix string
-	values []interface{}
-	depth  int
-}
-
-func (l logger) clone() logger {
-	out := l
-	l.values = copySlice(l.values)
-	return out
-}
-
-func copySlice(in []interface{}) []interface{} {
-	out := make([]interface{}, len(in))
-	copy(out, in)
-	return out
-}
-
-// Magic string for intermediate frames that we should ignore.
-const autogeneratedFrameName = "<autogenerated>"
-
-type kvPair struct {
-	key string
-	val interface{}
-}
-
-func flatten(kvList ...interface{}) string {
-	keys := make([]string, 0, len(kvList))
-	vals := make(map[string]interface{}, len(kvList))
-	for i := 0; i < len(kvList); i += 2 {
-		k, ok := kvList[i].(string)
-		if !ok {
-			panic(fmt.Sprintf("key is not a string: %s", pretty(kvList[i])))
-		}
-		var v interface{}
-		if i+1 < len(kvList) {
-			v = kvList[i+1]
-		}
-		keys = append(keys, k)
-		vals[k] = v
-	}
-	sort.Strings(keys)
-	buf := bytes.Buffer{}
-	for i, k := range keys {
-		v := vals[k]
-		if i > 0 {
-			buf.WriteRune(' ')
-		}
-		buf.WriteString(pretty(k))
-		buf.WriteString("=")
-		buf.WriteString(pretty(v))
-	}
-	return buf.String()
-}
-
-func pretty(value interface{}) string {
-	jb, _ := json.Marshal(value)
-	return string(jb)
-}
-
-func (l logger) Info(msg string, kvList ...interface{}) {
-	if l.Enabled() {
-		lvlStr := flatten("level", l.level)
-		msgStr := flatten("msg", msg)
-		fixedStr := flatten(l.values...)
-		userStr := flatten(kvList...)
-		l.output(fmt.Sprintln(l.prefix, lvlStr, msgStr, fixedStr, userStr))
-	}
-}
-
-func (l logger) Enabled() bool {
-	return globalVerbosity >= l.level
-}
-
-func (l logger) Error(err error, msg string, kvList ...interface{}) {
-	msgStr := flatten("msg", msg)
-	var loggableErr interface{}
-	if err != nil {
-		loggableErr = err.Error()
-	}
-	errStr := flatten("error", loggableErr)
-	fixedStr := flatten(l.values...)
-	userStr := flatten(kvList...)
-	l.output(fmt.Sprintln(l.prefix, errStr, msgStr, fixedStr, userStr))
-}
-
-func (l logger) output(s string) {
-	switch l.level {
-	case 0:
-		l.llog.Error(s)
-	case 1:
-		l.llog.Error(s)
-	case 2:
-		l.llog.Warning(s)
-	case 3:
-		l.llog.Notice(s)
-	case 4:
-		l.llog.Info(s)
-	case 5:
-		l.llog.Info(s)
-	default:
-		l.llog.Debug(s)
-	}
-}
-
-func (l logger) V(level int) logr.InfoLogger {
-	new := l.clone()
-	new.level = level
-	return new
-}
-
-// WithName returns a new logr.Logger with the specified name appended.  stdr
-// uses '/' characters to separate name elements.  Callers should not pass '/'
-// in the provided name string, but this library does not actually enforce that.
-func (l logger) WithName(name string) logr.Logger {
-	new := l.clone()
-	if len(l.prefix) > 0 {
-		new.prefix = l.prefix + "/"
-	}
-	new.prefix += name
-	return new
-}
-
-func (l logger) WithValues(kvList ...interface{}) logr.Logger {
-	new := l.clone()
-	new.values = append(new.values, kvList...)
-	return new
-}
-
-var _ logr.Logger = logger{}
-var _ logr.InfoLogger = logger{}

pkg/gologgingr/options.go

@@ -1,27 +0,0 @@
-package gologgingr
-
-// Option defines a single option function.
-type Option func(o *Options)
-
-// Options defines the available options for this package.
-type Options struct {
-	Logger LeveledLogger
-}
-
-// newOptions initializes the available default options.
-func newOptions(opts ...Option) Options {
-	opt := Options{}
-
-	for _, o := range opts {
-		o(&opt)
-	}
-
-	return opt
-}
-
-// Logger provides a function to set the logger option.
-func Logger(val LeveledLogger) Option {
-	return func(o *Options) {
-		o.Logger = val
-	}
-}

pkg/handler/ldapopshelper.go

@@ -1,461 +0,0 @@
-package handler
-
-import (
-	"bufio"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/GeertJohan/yubigo"
-	"github.com/glauth/glauth/pkg/config"
-	"github.com/glauth/glauth/pkg/stats"
-	"github.com/go-logr/logr"
-	"github.com/nmcclain/ldap"
-	"github.com/pquerna/otp/totp"
-	"golang.org/x/crypto/bcrypt"
-)
-
-var configattributematcher = regexp.MustCompile(`(?i)\((?P<attribute>[a-zA-Z0-9]+)\s*=\s*(?P<value>.*)\)`)
-var emailmatcher = regexp.MustCompile("^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$")
-
-type LDAPOpsHandler interface {
-	GetBackend() config.Backend
-	GetLog() logr.Logger
-	GetCfg() *config.Config
-	GetYubikeyAuth() *yubigo.YubiAuth
-
-	FindUser(userName string, searchByUPN bool) (f bool, u config.User, err error)
-	FindGroup(groupName string) (f bool, g config.Group, err error)
-	FindPosixAccounts() (entrylist []*ldap.Entry, err error)
-	FindPosixGroups() (entrylist []*ldap.Entry, err error)
-}
-
-type failedBind struct {
-	ts time.Time
-}
-
-type sourceInfo struct {
-	lastSeen  time.Time
-	failures  chan failedBind
-	waitUntil time.Time
-}
-
-type LDAPOpsHelper struct {
-	sources     map[string]*sourceInfo
-	nextPruning time.Time
-}
-
-func NewLDAPOpsHelper() LDAPOpsHelper {
-	helper := LDAPOpsHelper{
-		sources:     make(map[string]*sourceInfo),
-		nextPruning: time.Now(),
-	}
-	return helper
-}
-
-func (l LDAPOpsHelper) Bind(h LDAPOpsHandler, bindDN, bindSimplePw string, conn net.Conn) (resultCode ldap.LDAPResultCode, err error) {
-	if l.isInTimeout(h, conn) {
-		return ldap.LDAPResultUnwillingToPerform, nil
-	}
-
-	bindDN = strings.ToLower(bindDN)
-	baseDN := strings.ToLower("," + h.GetBackend().BaseDN)
-
-	h.GetLog().V(6).Info("Bind request", "binddn", bindDN, "basedn", h.GetBackend().BaseDN, "src", conn.RemoteAddr())
-
-	stats.Frontend.Add("bind_reqs", 1)
-
-	// Special Case: bind as anonymous
-	if bindDN == "" && bindSimplePw == "" {
-		stats.Frontend.Add("bind_successes", 1)
-		h.GetLog().V(6).Info("Anonymous Bind success", "src", conn.RemoteAddr())
-		return ldap.LDAPResultSuccess, nil
-	}
-
-	var user config.User
-
-	// Special Case: bind using UPN
-	// Not using mail.ParseAddress/1 because we would allow incorrectly formatted UPNs
-	if emailmatcher.MatchString(bindDN) {
-		var foundUser bool // = false
-		foundUser, user, _ = h.FindUser(bindDN, true)
-		if !foundUser {
-			h.GetLog().V(2).Info("User not found", "userprincipalname", bindDN)
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-	} else {
-		// parse the bindDN - ensure that the bindDN ends with the BaseDN
-		if !strings.HasSuffix(bindDN, baseDN) {
-			h.GetLog().V(2).Info("BindDN not part of our BaseDN", "binddn", bindDN, "basedn", h.GetBackend().BaseDN)
-			// h.GetLog().Warning(fmt.Sprintf("Bind Error: BindDN %s not our BaseDN %s", bindDN, baseDN))
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-		parts := strings.Split(strings.TrimSuffix(bindDN, baseDN), ",")
-		groupName := ""
-		userName := ""
-		if len(parts) == 1 {
-			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
-		} else if len(parts) == 2 {
-			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
-			groupName = strings.TrimPrefix(parts[1], h.GetBackend().GroupFormat+"=")
-		} else {
-			h.GetLog().V(2).Info("BindDN should have only one or two parts", "binddn", bindDN, "numparts", len(parts))
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-
-		// find the user
-		var foundUser bool // = false
-		foundUser, user, _ = h.FindUser(userName, false)
-		if !foundUser {
-			h.GetLog().V(2).Info("User not found", "username", userName)
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-		// find the group
-		var group config.Group // = nil
-		var foundGroup bool    // = false
-		if groupName != "" {
-			foundGroup, group, _ = h.FindGroup(groupName)
-			if !foundGroup {
-				h.GetLog().V(2).Info("Group not found", "groupname", groupName)
-				return ldap.LDAPResultInvalidCredentials, nil
-			}
-		}
-		// validate group membership
-		if foundGroup {
-			if user.PrimaryGroup != group.GIDNumber {
-				h.GetLog().V(2).Info("primary group mismatch", "username", userName, "primarygroup", user.PrimaryGroup, "groupid", group.GIDNumber)
-				return ldap.LDAPResultInvalidCredentials, nil
-			}
-		}
-	}
-
-	validotp := false
-
-	if len(user.Yubikey) == 0 && len(user.OTPSecret) == 0 {
-		validotp = true
-	}
-
-	if len(user.Yubikey) > 0 && h.GetYubikeyAuth() != nil {
-		if len(bindSimplePw) > 44 {
-			otp := bindSimplePw[len(bindSimplePw)-44:]
-			yubikeyid := otp[0:12]
-			bindSimplePw = bindSimplePw[:len(bindSimplePw)-44]
-
-			if user.Yubikey == yubikeyid {
-				_, ok, _ := h.GetYubikeyAuth().Verify(otp)
-
-				if ok {
-					validotp = true
-				}
-			}
-		}
-	}
-
-	// Store the full bind password provided before possibly modifying
-	// in the otp check
-	untouchedBindSimplePw := bindSimplePw
-
-	// Test OTP if exists
-	if len(user.OTPSecret) > 0 && !validotp {
-		if len(bindSimplePw) > 6 {
-			otp := bindSimplePw[len(bindSimplePw)-6:]
-			bindSimplePw = bindSimplePw[:len(bindSimplePw)-6]
-
-			validotp = totp.Validate(otp, user.OTPSecret)
-		}
-	}
-
-	// finally, validate user's pw
-
-	// check app passwords first
-	if user.PassAppBcrypt != nil {
-		for index, appPw := range user.PassAppBcrypt {
-			decoded, err := hex.DecodeString(appPw)
-			if err != nil {
-				h.GetLog().V(6).Info("invalid app credentials", "incorrect stored hash", "(omitted)")
-			} else {
-				if bcrypt.CompareHashAndPassword(decoded, []byte(untouchedBindSimplePw)) == nil {
-					stats.Frontend.Add("bind_successes", 1)
-					h.GetLog().V(6).Info("Bind success using app pw", "index", index, "binddn", bindDN, "src", conn.RemoteAddr())
-					return ldap.LDAPResultSuccess, nil
-				}
-			}
-		}
-	}
-	if user.PassAppSHA256 != nil {
-		hashFull := sha256.New()
-		hashFull.Write([]byte(untouchedBindSimplePw))
-		for index, appPw := range user.PassAppSHA256 {
-			if appPw != hex.EncodeToString(hashFull.Sum(nil)) {
-				h.GetLog().V(6).Info("Attempt to bind app pw failed", "index", index, "binddn", bindDN, "src", conn.RemoteAddr())
-			} else {
-				stats.Frontend.Add("bind_successes", 1)
-				h.GetLog().V(6).Info("Bind success using app pw", "index", index, "binddn", bindDN, "src", conn.RemoteAddr())
-				return ldap.LDAPResultSuccess, nil
-			}
-		}
-	}
-
-	// Then ensure the OTP is valid before checking
-	if !validotp {
-		h.GetLog().V(2).Info("invalid OTP token", "binddn", bindDN, "src", conn.RemoteAddr())
-		return ldap.LDAPResultInvalidCredentials, nil
-	}
-
-	// Now, check the pasword hash
-	if user.PassBcrypt != "" {
-		decoded, err := hex.DecodeString(user.PassBcrypt)
-		if err != nil {
-			h.GetLog().V(2).Info("invalid credentials", "incorrect stored hash", "(omitted)")
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-		if bcrypt.CompareHashAndPassword(decoded, []byte(bindSimplePw)) != nil {
-			h.GetLog().V(2).Info("invalid credentials", "binddn", bindDN, "src", conn.RemoteAddr())
-			l.maybePutInTimeout(h, conn, true)
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-	}
-	if user.PassSHA256 != "" {
-		hash := sha256.New()
-		hash.Write([]byte(bindSimplePw))
-		if user.PassSHA256 != hex.EncodeToString(hash.Sum(nil)) {
-			h.GetLog().V(2).Info("invalid credentials", "binddn", bindDN, "src", conn.RemoteAddr())
-			l.maybePutInTimeout(h, conn, true)
-			return ldap.LDAPResultInvalidCredentials, nil
-		}
-	}
-
-	stats.Frontend.Add("bind_successes", 1)
-	h.GetLog().V(6).Info("Bind success", "binddn", bindDN, "src", conn.RemoteAddr())
-	return ldap.LDAPResultSuccess, nil
-}
-
-func (l LDAPOpsHelper) Search(h LDAPOpsHandler, bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (result ldap.ServerSearchResult, err error) {
-	if l.isInTimeout(h, conn) {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultUnwillingToPerform}, fmt.Errorf("Source is in a timeout")
-	}
-
-	bindDN = strings.ToLower(bindDN)
-	baseDN := strings.ToLower(h.GetBackend().BaseDN)
-	delimitedBaseDN := "," + baseDN
-	searchBaseDN := strings.ToLower(searchReq.BaseDN)
-
-	// What if this user was bound using their UPN? We still want to enforce baseDN etc so we
-	// have to rewire them to their original DN which is of course a waste of cycles.
-	// TODO Down the road we would want to perform lightweight memoization of DNs to UPNs
-	if emailmatcher.MatchString(bindDN) {
-		foundUser, userInfo, _ := h.FindUser(bindDN, true)
-		if !foundUser {
-			return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: UPN %s could not be resolved to a DN", bindDN)
-		}
-		// cn=serviceuser,ou=svcaccts,dc=glauth,dc=com
-		bindDN = fmt.Sprintf("cn=%s,%s", userInfo.Name, baseDN)
-	}
-
-	h.GetLog().V(6).Info("Search request", "binddn", bindDN, "basedn", baseDN, "searchbasedn", searchBaseDN, "src", conn.RemoteAddr(), "scope", searchReq.Scope, "filter", searchReq.Filter)
-	stats.Frontend.Add("search_reqs", 1)
-
-	anonymous := len(bindDN) < 1
-
-	// special case: querying the root DSE
-	if searchReq.Scope == 0 && (searchBaseDN == "" || searchBaseDN == baseDN) {
-		if anonymous && !h.GetBackend().AnonymousDSE {
-			return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Root DSE Search Error: Anonymous BindDN not allowed %s", bindDN)
-		}
-		h.GetLog().V(6).Info("Search request", "special case", "root DSE")
-		entries := []*ldap.Entry{}
-		attrs := []*ldap.EntryAttribute{}
-		// unfortunately, objectClass is not to be included so we will respect that
-		// attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"*"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedSASLMechanisms", Values: []string{}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedLDAPVersion", Values: []string{"3"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedControl", Values: []string{}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedCapabilities", Values: []string{}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "subschemaSubentry", Values: []string{"cn=schema"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "serverName", Values: []string{"unknown"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "namingContexts", Values: []string{baseDN}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "defaultNamingContext", Values: []string{baseDN}})
-		attrs = l.collectRequestedAttributesBack(attrs, searchReq)
-		entries = append(entries, &ldap.Entry{DN: searchBaseDN, Attributes: attrs})
-		stats.Frontend.Add("search_successes", 1)
-		h.GetLog().V(6).Info("AP: Root Search OK", "filter", searchReq.Filter)
-		return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
-	}
-
-	// validate the user is authenticated and has appropriate access
-	if anonymous {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: Anonymous BindDN not allowed %s", bindDN)
-	}
-
-	if searchBaseDN == "cn=schema" {
-		h.GetLog().V(6).Info("Search request", "special case", "schema discovery")
-		entries := []*ldap.Entry{}
-		attrs := []*ldap.EntryAttribute{}
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{"schema"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "hasSubordinates", Values: []string{"false"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "modifiersName", Values: []string{"cn=Directory Manager"}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "modifyTimeStamp", Values: []string{"Mar 8, 2021, 12:46:29 PM PST (20210308204629Z)"}})
-		// Iterate through schema attributes provided in schema/ directory
-		filenames, _ := ioutil.ReadDir("schema")
-		for _, filename := range filenames {
-			file, err := os.Open(filepath.Join("schema", filename.Name()))
-			if err != nil {
-				return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Schema Error: attribute %s cannot be read", filename)
-			}
-			defer file.Close()
-			values := []string{}
-			scanner := bufio.NewScanner(file)
-			for scanner.Scan() {
-				line := scanner.Text()
-				values = append(values, line)
-			}
-			attrs = append(attrs, &ldap.EntryAttribute{Name: filename.Name(), Values: values})
-		}
-		attrs = l.collectRequestedAttributesBack(attrs, searchReq)
-		entries = append(entries, &ldap.Entry{DN: searchBaseDN, Attributes: attrs})
-		stats.Frontend.Add("search_successes", 1)
-		h.GetLog().V(6).Info("AP: Schema Discovery OK", "filter", searchReq.Filter)
-		return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
-	}
-
-	if !strings.HasSuffix(bindDN, delimitedBaseDN) {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: BindDN %s not in our BaseDN %s", bindDN, h.GetBackend().BaseDN)
-	}
-	if !strings.HasSuffix(searchBaseDN, h.GetBackend().BaseDN) {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("Search Error: search BaseDN %s is not in our BaseDN %s", searchBaseDN, h.GetBackend().BaseDN)
-	}
-	// return all users in the config file - the LDAP library will filter results for us
-	entries := []*ldap.Entry{}
-	filterEntity, err := ldap.GetFilterObjectClass(searchReq.Filter)
-	if err != nil {
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: error parsing filter: %s", searchReq.Filter)
-	}
-	switch filterEntity {
-	default:
-		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: unhandled filter type: %s [%s]", filterEntity, searchReq.Filter)
-	case "posixgroup":
-		posixentries, err := h.FindPosixGroups()
-		if err != nil {
-			return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: Unable to retrieve data [%s]", err.Error())
-		}
-		entries = append(entries, posixentries...)
-	case "posixaccount", "shadowaccount", "":
-		posixentries, err := h.FindPosixAccounts()
-		if err != nil {
-			return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: Unable to retrieve data [%s]", err.Error())
-		}
-		entries = append(entries, posixentries...)
-	}
-	stats.Frontend.Add("search_successes", 1)
-	h.GetLog().V(6).Info("AP: Search OK", "filter", searchReq.Filter)
-	return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
-}
-
-// If your query is for, say 'objectClass', then our LDAP
-// library will weed out this entry since it does *not* contain an objectclass attribute
-// so we are going to re-inject it to keep the LDAP library happy
-func (l LDAPOpsHelper) collectRequestedAttributesBack(attrs []*ldap.EntryAttribute, searchReq ldap.SearchRequest) []*ldap.EntryAttribute {
-	attbits := configattributematcher.FindStringSubmatch(searchReq.Filter)
-	if len(attbits) == 3 {
-		foundattname := false
-		for _, attr := range attrs {
-			if strings.ToLower(attr.Name) == strings.ToLower(attbits[1]) {
-				foundattname = true
-				break
-			}
-		}
-		// the ugly hack: we are going to pretend that the requested attribute is in there
-		if !foundattname {
-			attrs = append(attrs, &ldap.EntryAttribute{Name: attbits[1], Values: []string{attbits[2]}})
-		}
-	}
-	return attrs
-}
-
-// return true if we should not process the current operation
-func (l LDAPOpsHelper) isInTimeout(handler LDAPOpsHandler, conn net.Conn) bool {
-	cfg := handler.GetCfg()
-	if !cfg.Behaviors.LimitFailedBinds {
-		return false
-	}
-
-	remoteAddr := l.getAddr(conn)
-	now := time.Now()
-	info, ok := l.sources[remoteAddr]
-	if !ok {
-		l.sources[remoteAddr] = &sourceInfo{
-			lastSeen:  now,
-			failures:  make(chan failedBind, cfg.Behaviors.NumberOfFailedBinds),
-			waitUntil: now,
-		}
-		handler.GetLog().V(6).Info("CFRDBG: Created Struct", "remoteAddr", remoteAddr)
-		return false
-	}
-	// update so that this source does not get pruned
-	info.lastSeen = now
-	// if we are in a time out...
-	if cfg.Behaviors.LimitFailedBinds && info.waitUntil.After(now) {
-		handler.GetLog().V(6).Info("CFRDBG: Time Out")
-		return true
-	}
-	return false
-}
-
-func (l LDAPOpsHelper) maybePutInTimeout(handler LDAPOpsHandler, conn net.Conn, noteFailure bool) bool {
-	cfg := handler.GetCfg()
-	if !cfg.Behaviors.LimitFailedBinds {
-		return false
-	}
-
-	remoteAddr := l.getAddr(conn)
-	now := time.Now()
-	info, _ := l.sources[remoteAddr]
-	// if we have a failed bind...
-	if noteFailure {
-		info.failures <- failedBind{ts: time.Now()}
-		handler.GetLog().V(6).Info("CFRDBG: Failed Bind", "Count", len(info.failures))
-		// if we now have 3 failed binds in a row
-		if len(info.failures) == cfg.Behaviors.NumberOfFailedBinds {
-			handler.GetLog().V(6).Info("CFRDBG: 3 Failures")
-			// we cannot have more than 3 failed binds in our channel so pop the oldest one
-			pruned := <-info.failures
-			// if we have 3 failed bind in a row in less than 3 seconds
-			if pruned.ts.Add(cfg.Behaviors.PeriodOfFailedBinds * time.Second).After(now) {
-				handler.GetLog().V(6).Info("CFRDBG: 3 Rapid Failures")
-				// we will wait for 'n' seconds no matter what happens next
-				info.waitUntil = time.Now().Add(cfg.Behaviors.BlockFailedBindsFor * time.Second)
-				// purge our failure queue until we resume accepting operations
-				for len(info.failures) > 0 {
-					<-info.failures
-				}
-			}
-		}
-	}
-	// Prune old IPs
-	// TODO We should ensure that the time between prunings is bigger than the time to determine rapid failed binds
-	if l.nextPruning.Before(now) {
-		for sourceIP, sourceInfo := range l.sources {
-			if sourceInfo.lastSeen.Add(cfg.Behaviors.PruneSourcesOlderThan * time.Second).Before(now) {
-				delete(l.sources, sourceIP)
-			}
-		}
-		l.nextPruning = time.Now().Add(cfg.Behaviors.PruneSourceTableEvery * time.Second)
-	}
-	return false
-}
-
-func (l LDAPOpsHelper) getAddr(conn net.Conn) string {
-	fullAddr := conn.RemoteAddr().String()
-	sep := strings.LastIndex(fullAddr, ":")
-	if sep == -1 {
-		return fullAddr
-	}
-	return fullAddr[0:sep]
-}

pkg/plugins/Makefile

@@ -1,25 +0,0 @@
-#####################
-# Plugins Targets
-#####################
-
-# Note: to make a plugin compatible with a binary built in debug mode, add `-gcflags='all=-N -l'`
-
-PLUGIN_OS ?= linux
-PLUGIN_ARCH ?= amd64
-
-plugins: plugin_mysql plugin_postgres plugin_sqlite
-
-plugin_mysql: bin/mysql.so
-
-bin/mysql.so: pkg/plugins/mysql.go pkg/plugins/basesqlhandler.go
-	GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^
-
-plugin_postgres: bin/postgres.so
-
-bin/postgres.so: pkg/plugins/postgres.go pkg/plugins/basesqlhandler.go
-	GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^
-
-plugin_sqlite: bin/sqlite.so
-
-bin/sqlite.so: pkg/plugins/sqlite.go pkg/plugins/basesqlhandler.go
-	GOOS=$(PLUGIN_OS) GOARCH=$(PLUGIN_ARCH) go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -buildmode=plugin -o $@ $^

pkg/plugins/README.md

@@ -1,138 +0,0 @@
-# GLAuth Plugins
-
-This folder contains plugins; that is, backends that are not compiled in GLAuth by default.
-
-To quote 'Butonic' (Jörn Friedrich Dreyer):
-
-> Just keep the 'lightweight' in mind.
-
-To build either back-end, type
-```
-make plugin_name
-```
-where 'name' is the plugin's name; so, for instance: `make plugin_sqlite`
-
-To build back-ends for specific architectures, specify `PLUGIN_OS` and `PLUGIN_ARCH` --
- For instance, to build the sqlite plugin for the new Mac M1s:
- ```
-make plugin_sqlite PLUGIN_OS=darwin PLUGIN_ARCH=arm64
- ```
-
-## Database Plugins
-
-To use a database plugin, edit the configuration file (see pkg/plugins/sample-database.cfg) so that:
-
-```
-...
-[backend]
-  datastore = "plugin"
-  plugin = "dynamic library you created using the previous 'make' command"
-  database = "database connection string"
-...
-```
-so, let's say you built the 'sqlite' plugin, you would now specify its library: `database = sqlite.so`
-
-### SQLite, MySQL, Postgres
-
-Tables:
-- users, groups are self-explanatory
-- includegroups store the 'includegroups' relationships
-- othergroups, on the other hand, are a comma-separated list found in the users table (performance)
-
-Here is how to insert example data using your database's REPL (more detailed information can be found in pkg/plugins/sample-database.cfg)
-
-```sql
-INSERT INTO groups(name, gidnumber) VALUES('superheros', 5501);
-INSERT INTO groups(name, gidnumber) VALUES('svcaccts', 5502);
-INSERT INTO groups(name, gidnumber) VALUES('civilians', 5503);
-INSERT INTO groups(name, gidnumber) VALUES('caped', 5504);
-INSERT INTO groups(name, gidnumber) VALUES('lovesailing', 5505);
-INSERT INTO groups(name, gidnumber) VALUES('smoker', 5506);
-INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5503, 5501);
-INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5502);
-INSERT INTO includegroups(parentgroupid, includegroupid) VALUES(5504, 5501);
-INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('hackers', 5001, 5501, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
-INSERT INTO users(name, uidnumber, primarygroup, passsha256) VALUES('johndoe', 5002, 5502, '6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a');
-INSERT INTO users(name, mail, uidnumber, primarygroup, passsha256) VALUES('serviceuser', "serviceuser@example.com", 5003, 5502, '652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0');
-INSERT INTO users(name, uidnumber, primarygroup, passsha256, othergroups) VALUES('user4', 5004, 5504, '652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0', '5505,5506');
-```
-This should be equivalent to this configuration:
-```text
-[[users]]
-  name = "hackers"
-  uidnumber = 5001
-  primarygroup = 5501
-  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
-
-[[users]]
-  name = "hackers"
-  uidnumber = 5001
-  primarygroup = 5501
-  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
-
-[[users]]
-  name = "johndoe"
-  uidnumber = 5002
-  primarygroup = 5502
-  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
-
-[[users]]
-  name = "serviceuser"
-  mail = "serviceuser@example.com"
-  uidnumber = 5003
-  primarygroup = 5502
-  passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
-
-[[users]]
-  name = "user4"
-  uidnumber = 5003
-  primarygroup = 5504
-  othergroups = [5505, 5506]
-  passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
-
-[[groups]]
-  name = "superheros"
-  gidnumber = 5501
-
-[[groups]]
-  name = "svcaccts"
-  gidnumber = 5502
-
-[[groups]]
-  name = "civilians"
-  gidnumber = 5503
-  includegroups = [ 5501 ]
-
-[[groups]]
-  name = "caped"
-  gidnumber = 5504
-  includegroups = [ 5502, 5501 ]
-```
-and LDAP should return these `memberOf` values:
-```text
-uid: hackers
-ou: superheros
-memberOf: cn=caped,ou=groups,dc=militate,dc=com
-memberOf: cn=civilians,ou=groups,dc=militate,dc=com
-memberOf: cn=superheros,ou=groups,dc=militate,dc=com
-
-uid: johndoe
-ou: svcaccts
-memberOf: cn=caped,ou=groups,dc=militate,dc=com
-memberOf: cn=svcaccts,ou=groups,dc=militate,dc=com
-
-uid: serviceuser
-ou: caped
-memberOf: cn=caped,ou=groups,dc=militate,dc=com
-
-uid: user4
-ou: caped
-memberOf: cn=caped,ou=groups,dc=militate,dc=com
-memberOf: cn=lovesailing,ou=groups,dc=militate,dc=com
-memberOf: cn=smoker,ou=groups,dc=militate,dc=com
-```
-If you have the ldap client package installed, this can be easily confirmed by running
-```
-ldapsearch  -H ldap://localhost:3893 -D cn=hackers,ou=superheros,dc=glauth,dc=com -w dogood -x -bdc=glauth,dc=com cn=hackers
-```
-and so on.

pkg/plugins/basesqlhandler.go

@@ -1,500 +0,0 @@
-package main
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"net"
-	"os"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/GeertJohan/yubigo"
-	"github.com/glauth/glauth/pkg/config"
-	"github.com/glauth/glauth/pkg/handler"
-	"github.com/glauth/glauth/pkg/stats"
-	"github.com/go-logr/logr"
-	"github.com/nmcclain/ldap"
-)
-
-var configattributematcher = regexp.MustCompile(`(?i)\((?P<attribute>[a-zA-Z0-9]+)\s*=\s*(?P<value>.*)\)`)
-
-type SqlBackend interface {
-	// Name used by database/sql when loading the driver
-	GetDriverName() string
-	// Create db/schema if necessary
-	CreateSchema(db *sql.DB)
-	//
-	GetPrepareSymbol() string
-}
-
-type database struct {
-	path string
-	cnx  *sql.DB
-}
-
-type databaseHandler struct {
-	backend     config.Backend
-	log         logr.Logger
-	cfg         *config.Config
-	yubikeyAuth *yubigo.YubiAuth
-	sqlBackend  SqlBackend
-	database    database
-	MemGroups   []config.Group
-	ldohelper   handler.LDAPOpsHelper
-	attmatcher  *regexp.Regexp
-}
-
-// func NewDatabaseHandler_deprecated(log *logging.Logger, cfg *config.Config, yubikeyAuth *yubigo.YubiAuth, sqlBackend SqlBackend) handler.Handler {
-func NewDatabaseHandler(sqlBackend SqlBackend, opts ...handler.Option) handler.Handler {
-	options := handler.NewOptions(opts...)
-
-	// Note: we will never terminate this connection pool.
-	db, err := sql.Open(sqlBackend.GetDriverName(), options.Backend.Database)
-	if err != nil {
-		options.Logger.Error(err, "Unable to open SQL database named '%s' error: %s", options.Backend.Database)
-		os.Exit(1)
-	}
-	err = db.Ping()
-	if err != nil {
-		options.Logger.Error(err, "Unable to communicate with SQL database error: %s", options.Backend.Database)
-		os.Exit(1)
-	}
-
-	dbInfo := database{
-		path: options.Backend.Database,
-		cnx:  db,
-	}
-
-	handler := databaseHandler{
-		backend:     options.Backend,
-		log:         options.Logger,
-		cfg:         options.Config,
-		yubikeyAuth: options.YubiAuth,
-		sqlBackend:  sqlBackend,
-		database:    dbInfo,
-		ldohelper:   options.LDAPHelper,
-		attmatcher:  configattributematcher}
-
-	sqlBackend.CreateSchema(db)
-
-	options.Logger.V(3).Info("Database (" + sqlBackend.GetDriverName() + "::" + options.Backend.Database + ") Plugin: Ready")
-
-	return handler
-}
-
-func (h databaseHandler) GetBackend() config.Backend {
-	return h.backend
-}
-func (h databaseHandler) GetLog() logr.Logger {
-	return h.log
-}
-func (h databaseHandler) GetCfg() *config.Config {
-	return h.cfg
-}
-func (h databaseHandler) GetYubikeyAuth() *yubigo.YubiAuth {
-	return h.yubikeyAuth
-}
-
-func (h databaseHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resultCode ldap.LDAPResultCode, err error) {
-	return h.ldohelper.Bind(h, bindDN, bindSimplePw, conn)
-}
-
-func (h databaseHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn net.Conn) (result ldap.ServerSearchResult, err error) {
-	return h.ldohelper.Search(h, bindDN, searchReq, conn)
-}
-
-// Add is not yet supported for the sql backend
-func (h databaseHandler) Add(boundDN string, req ldap.AddRequest, conn net.Conn) (result ldap.LDAPResultCode, err error) {
-	return ldap.LDAPResultInsufficientAccessRights, nil
-}
-
-// Modify is not yet supported for the sql backend
-func (h databaseHandler) Modify(boundDN string, req ldap.ModifyRequest, conn net.Conn) (result ldap.LDAPResultCode, err error) {
-	return ldap.LDAPResultInsufficientAccessRights, nil
-}
-
-// Delete is not yet supported for the sql backend
-func (h databaseHandler) Delete(boundDN string, deleteDN string, conn net.Conn) (result ldap.LDAPResultCode, err error) {
-	return ldap.LDAPResultInsufficientAccessRights, nil
-}
-
-func (h databaseHandler) FindUser(userName string, searchByUPN bool) (f bool, u config.User, err error) {
-	var criterion string
-	if searchByUPN {
-		criterion = "lower(u.mail)"
-	} else {
-		criterion = "lower(u.name)"
-	}
-
-	user := config.User{}
-	found := false
-
-	err = h.database.cnx.QueryRow(fmt.Sprintf(`
-			SELECT u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey 
-			FROM users u WHERE %s=%s`,
-		criterion,
-		h.sqlBackend.GetPrepareSymbol()), userName).Scan(
-		&user.UIDNumber, &user.PrimaryGroup, &user.PassBcrypt, &user.PassSHA256, &user.OTPSecret, &user.Yubikey)
-	if err == nil {
-		found = true
-	}
-
-	return found, user, err
-}
-
-func (h databaseHandler) FindGroup(groupName string) (f bool, g config.Group, err error) {
-	group := config.Group{}
-	found := false
-
-	err = h.database.cnx.QueryRow(fmt.Sprintf(`
-			SELECT g.gidnumber FROM groups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan(
-		&group.GIDNumber)
-	if err == nil {
-		found = true
-	}
-
-	return found, group, err
-}
-
-func (h databaseHandler) FindPosixAccounts() (entrylist []*ldap.Entry, err error) {
-	entries := []*ldap.Entry{}
-
-	h.MemGroups, err = h.memoizeGroups()
-	if err != nil {
-		return entries, err
-	}
-
-	rows, err := h.database.cnx.Query(`
-		SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups,u.givenname,u.sn,u.mail,u.loginshell,u.homedirectory,u.disabled 
-		FROM users u`)
-	if err != nil {
-		return entries, err
-	}
-	defer rows.Close()
-
-	var otherGroups string
-	var disabled int
-	u := config.User{}
-	for rows.Next() {
-		err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups, &u.GivenName, &u.SN, &u.Mail, &u.LoginShell, &u.Homedir, &disabled)
-		if err != nil {
-			return entries, err
-		}
-		u.OtherGroups = h.commaListToTable(otherGroups)
-		u.Disabled = h.intToBool(disabled)
-
-		entries = append(entries, h.getAccount(u))
-	}
-
-	return entries, nil
-}
-
-func (h databaseHandler) FindPosixGroups() (entrylist []*ldap.Entry, err error) {
-	entries := []*ldap.Entry{}
-
-	h.MemGroups, err = h.memoizeGroups()
-	if err != nil {
-		return entries, err
-	}
-
-	for _, g := range h.MemGroups {
-		entries = append(entries, h.getGroup(g))
-	}
-
-	return entries, nil
-}
-
-func (h databaseHandler) Close(boundDn string, conn net.Conn) error {
-	stats.Frontend.Add("closes", 1)
-	return nil
-}
-
-func (h databaseHandler) intToBool(value int) bool {
-	if value == 0 {
-		return false
-	}
-	return true
-}
-
-func (h databaseHandler) commaListToTable(commaList string) []int {
-	if len(commaList) == 0 {
-		return make([]int, 0)
-	}
-	rowsAsStrings := strings.Split(commaList, ",")
-	rowsAsInts := make([]int, len(rowsAsStrings))
-	for i, v := range rowsAsStrings {
-		iv, err := strconv.Atoi(v)
-		if err != nil {
-			return rowsAsInts
-		}
-		rowsAsInts[i] = iv
-	}
-	return rowsAsInts
-}
-
-func (h databaseHandler) memoizeGroups() ([]config.Group, error) {
-	workMemGroups := make([]*config.Group, 0)
-	rows, err := h.database.cnx.Query(`
-		SELECT g1.name,g1.gidnumber,ig.includegroupid
-		FROM groups g1 
-		LEFT JOIN includegroups ig ON g1.gidnumber=ig.parentgroupid 
-		LEFT JOIN groups g2 ON ig.includegroupid=g2.gidnumber`)
-	if err != nil {
-		return nil, errors.New("Unable to memoize groups list")
-	}
-	defer rows.Close()
-
-	var groupName string
-	var groupId int
-	var includeId sql.NullInt64 // Store includeid from left join
-	var pg *config.Group
-	recentId := -1 // id of recently updated group
-	for rows.Next() {
-		err := rows.Scan(&groupName, &groupId, &includeId)
-		if err != nil {
-			return nil, errors.New("Unable to memoize groups list")
-		}
-		if recentId != groupId {
-			recentId = groupId
-			g := config.Group{Name: groupName, GIDNumber: groupId}
-			pg = &g // To manipulate end of slice
-			workMemGroups = append(workMemGroups, &g)
-		}
-		if includeId.Valid {
-			pg.IncludeGroups = append(pg.IncludeGroups, int(includeId.Int64))
-		}
-	}
-	memGroups := make([]config.Group, len(workMemGroups))
-	for i, v := range workMemGroups {
-		memGroups[i] = config.Group{Name: v.Name, GIDNumber: v.GIDNumber, IncludeGroups: v.IncludeGroups}
-	}
-	return memGroups, nil
-}
-
-// Used when looking up Posix Groups
-func (h databaseHandler) getGroupMembers(gid int) []string {
-	members := make(map[string]bool)
-
-	rows, err := h.database.cnx.Query(`
-			SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups
-			FROM users u WHERE lower(u.name)=?`,
-	)
-	if err != nil {
-		// Silent fail... for now
-		return []string{}
-	}
-	defer rows.Close()
-
-	var otherGroups string
-	u := config.User{}
-	for rows.Next() {
-		err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups)
-		if err != nil {
-			return []string{}
-		}
-		if u.PrimaryGroup == gid {
-			dn := fmt.Sprintf("cn=%s,ou=%s,%s", u.Name, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
-			members[dn] = true
-		} else {
-			u.OtherGroups = h.commaListToTable(otherGroups)
-			for _, othergid := range u.OtherGroups {
-				if othergid == gid {
-					dn := fmt.Sprintf("cn=%s,ou=%s,%s", u.Name, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
-					members[dn] = true
-				}
-			}
-		}
-	}
-
-	for _, g := range h.MemGroups {
-		if gid == g.GIDNumber {
-			for _, includegroupid := range g.IncludeGroups {
-				if includegroupid != gid {
-					includegroupmembers := h.getGroupMembers(includegroupid)
-
-					for _, includegroupmember := range includegroupmembers {
-						members[includegroupmember] = true
-					}
-				}
-			}
-		}
-	}
-
-	m := []string{}
-	for k := range members {
-		m = append(m, k)
-	}
-
-	sort.Strings(m)
-
-	return m
-}
-
-// Used exclusively when looking up Posix Groups
-func (h databaseHandler) getGroupMemberIDs(gid int) []string {
-	members := make(map[string]bool)
-	rows, err := h.database.cnx.Query(`
-			SELECT u.name,u.uidnumber,u.primarygroup,u.passbcrypt,u.passsha256,u.otpsecret,u.yubikey,u.othergroups
-			FROM users u`)
-	if err != nil {
-		// Silent fail... for now
-		return []string{}
-	}
-	defer rows.Close()
-
-	var otherGroups string
-	u := config.User{}
-	for rows.Next() {
-		err := rows.Scan(&u.Name, &u.UIDNumber, &u.PrimaryGroup, &u.PassBcrypt, &u.PassSHA256, &u.OTPSecret, &u.Yubikey, &otherGroups)
-		if err != nil {
-			return []string{}
-		}
-		if u.PrimaryGroup == gid {
-			members[u.Name] = true
-		} else {
-			u.OtherGroups = h.commaListToTable(otherGroups)
-			for _, othergid := range u.OtherGroups {
-				if othergid == gid {
-					members[u.Name] = true
-				}
-			}
-		}
-	}
-
-	for _, g := range h.MemGroups {
-		if gid == g.GIDNumber {
-			for _, includegroupid := range g.IncludeGroups {
-				if includegroupid == gid {
-					h.log.V(3).Info(fmt.Sprintf("Group: %d - Ignoring myself as included group", includegroupid))
-				} else {
-					includegroupmemberids := h.getGroupMemberIDs(includegroupid)
-
-					for _, includegroupmemberid := range includegroupmemberids {
-						members[includegroupmemberid] = true
-					}
-				}
-			}
-		}
-	}
-
-	m := []string{}
-	for k := range members {
-		m = append(m, k)
-	}
-
-	sort.Strings(m)
-
-	return m
-}
-
-// Invoked for every user being returned from our database
-func (h databaseHandler) getGroupDNs(gids []int) []string {
-	groups := make(map[string]bool)
-	for _, gid := range gids {
-		for _, g := range h.MemGroups {
-			if g.GIDNumber == gid {
-				dn := fmt.Sprintf("cn=%s,ou=groups,%s", g.Name, h.backend.BaseDN)
-				groups[dn] = true
-			}
-
-			for _, includegroupid := range g.IncludeGroups {
-				if includegroupid == gid && g.GIDNumber != gid {
-					includegroupdns := h.getGroupDNs([]int{g.GIDNumber})
-
-					for _, includegroupdn := range includegroupdns {
-						groups[includegroupdn] = true
-					}
-				}
-			}
-		}
-	}
-
-	g := []string{}
-	for k := range groups {
-		g = append(g, k)
-	}
-
-	sort.Strings(g)
-
-	return g
-}
-
-// Invoked for every user being returned from our database
-func (h databaseHandler) getGroupName(gid int) string {
-	for _, g := range h.MemGroups {
-		if g.GIDNumber == gid {
-			return g.Name
-		}
-	}
-	return ""
-}
-
-// Toolbox
-func (h databaseHandler) getGroup(g config.Group) *ldap.Entry {
-	attrs := []*ldap.EntryAttribute{}
-	attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{g.Name}})
-	attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", g.Name)}})
-	attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}})
-	attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixGroup"}})
-	attrs = append(attrs, &ldap.EntryAttribute{"uniqueMember", h.getGroupMembers(g.GIDNumber)})
-	attrs = append(attrs, &ldap.EntryAttribute{"memberUid", h.getGroupMemberIDs(g.GIDNumber)})
-	dn := fmt.Sprintf("cn=%s,ou=groups,%s", g.Name, h.backend.BaseDN)
-	return &ldap.Entry{dn, attrs}
-}
-
-func (h databaseHandler) getAccount(u config.User) *ldap.Entry {
-	attrs := []*ldap.EntryAttribute{}
-	attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{u.Name}})
-	attrs = append(attrs, &ldap.EntryAttribute{"uid", []string{u.Name}})
-
-	if len(u.GivenName) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{"givenName", []string{u.GivenName}})
-	}
-
-	if len(u.SN) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{"sn", []string{u.SN}})
-	}
-
-	attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}})
-	attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UIDNumber)}})
-
-	if u.Disabled {
-		attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"inactive"}})
-	} else {
-		attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}})
-	}
-
-	if len(u.Mail) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{"mail", []string{u.Mail}})
-		attrs = append(attrs, &ldap.EntryAttribute{"userPrincipalName", []string{u.Mail}})
-	}
-
-	attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}})
-
-	if len(u.LoginShell) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{u.LoginShell}})
-	} else {
-		attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}})
-	}
-
-	if len(u.Homedir) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{u.Homedir}})
-	} else {
-		attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}})
-	}
-
-	attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", u.Name)}})
-	attrs = append(attrs, &ldap.EntryAttribute{"gecos", []string{fmt.Sprintf("%s via LDAP", u.Name)}})
-	attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", u.PrimaryGroup)}})
-	attrs = append(attrs, &ldap.EntryAttribute{"memberOf", h.getGroupDNs(append(u.OtherGroups, u.PrimaryGroup))})
-	if len(u.SSHKeys) > 0 {
-		attrs = append(attrs, &ldap.EntryAttribute{"sshPublicKey", u.SSHKeys})
-	}
-	dn := fmt.Sprintf("cn=%s,ou=%s,%s", u.Name, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
-	return &ldap.Entry{dn, attrs}
-}
-
-func main() {}

pkg/plugins/mysql.go

@@ -1,56 +0,0 @@
-package main
-
-import (
-	"database/sql"
-
-	_ "github.com/go-sql-driver/mysql"
-
-	"github.com/glauth/glauth/pkg/handler"
-)
-
-type MysqlBackend struct {
-}
-
-func NewMySQLHandler(opts ...handler.Option) handler.Handler {
-	backend := MysqlBackend{}
-	return NewDatabaseHandler(backend, opts...)
-}
-
-func (b MysqlBackend) GetDriverName() string {
-	return "mysql"
-}
-
-func (b MysqlBackend) GetPrepareSymbol() string {
-	return "?"
-}
-
-// Create db/schema if necessary
-func (b MysqlBackend) CreateSchema(db *sql.DB) {
-	statement, _ := db.Prepare(`
-CREATE TABLE IF NOT EXISTS users (
-	id INTEGER AUTO_INCREMENT PRIMARY KEY,
-	name VARCHAR(64) NOT NULL,
-	uidnumber INTEGER NOT NULL,
-	primarygroup INTEGER NOT NULL,
-	othergroups VARCHAR(1024) DEFAULT '',
-	givenname VARCHAR(64) DEFAULT '',
-	sn VARCHAR(64) DEFAULT '',
-	mail VARCHAR(254) DEFAULT '',
-	loginshell VARCHAR(64) DEFAULT '',
-	homedirectory VARCHAR(64) DEFAULT '',
-	disabled SMALLINT  DEFAULT 0,
-	passsha256 VARCHAR(64) DEFAULT '',
-	passbcrypt VARCHAR(64) DEFAULT '',
-	otpsecret VARCHAR(64) DEFAULT '',
-	yubikey VARCHAR(128) DEFAULT '')
-`)
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE UNIQUE INDEX idx_user_name on users(name)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER AUTO_INCREMENT PRIMARY KEY, name VARCHAR(64) NOT NULL, gidnumber INTEGER NOT NULL)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE UNIQUE INDEX idx_group_name on groups(name)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS includegroups (id INTEGER AUTO_INCREMENT PRIMARY KEY, parentgroupid INTEGER NOT NULL, includegroupid INTEGER NOT NULL)")
-	statement.Exec()
-}

pkg/plugins/postgres.go

@@ -1,56 +0,0 @@
-package main
-
-import (
-	"database/sql"
-
-	_ "github.com/lib/pq"
-
-	"github.com/glauth/glauth/pkg/handler"
-)
-
-type PostgresBackend struct {
-}
-
-func NewPostgresHandler(opts ...handler.Option) handler.Handler {
-	backend := PostgresBackend{}
-	return NewDatabaseHandler(backend, opts...)
-}
-
-func (b PostgresBackend) GetDriverName() string {
-	return "postgres"
-}
-
-func (b PostgresBackend) GetPrepareSymbol() string {
-	return "$1"
-}
-
-// Create db/schema if necessary
-func (b PostgresBackend) CreateSchema(db *sql.DB) {
-	statement, _ := db.Prepare(`
-CREATE TABLE IF NOT EXISTS users (
-	id SERIAL PRIMARY KEY,
-	name TEXT NOT NULL,
-	uidnumber INTEGER NOT NULL,
-	primarygroup INTEGER NOT NULL,
-	othergroups TEXT DEFAULT '',
-	givenname TEXT DEFAULT '',
-	sn TEXT DEFAULT '',
-	mail TEXT DEFAULT '',
-	loginshell TEXT DEFAULT '',
-	homedirectory TEXT DEFAULT '',
-	disabled SMALLINT  DEFAULT 0,
-	passsha256 TEXT DEFAULT '',
-	passbcrypt TEXT DEFAULT '',
-	otpsecret TEXT DEFAULT '',
-	yubikey TEXT DEFAULT '')
-`)
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_user_name on users(name)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id SERIAL PRIMARY KEY, name TEXT NOT NULL, gidnumber INTEGER NOT NULL)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_group_name on groups(name)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS includegroups (id SERIAL PRIMARY KEY, parentgroupid INTEGER NOT NULL, includegroupid INTEGER NOT NULL)")
-	statement.Exec()
-}

pkg/plugins/sample-database.cfg

@@ -1,82 +0,0 @@
-#################
-# glauth.conf
-
-#################
-# General configuration.
-debug = true
-# syslog = true
-#
-# Enable hot-reload of configuration on changes
-# - does NOT work [ldap], [ldaps], [backend] or [api] sections
-# watchconfig = true
-
-#################
-# yubikeyclientid = "yubi-api-clientid"
-# yubikeysecret = "yubi-api-secret"
-
-#################
-# Server configuration.
-#
-# This is the old server-config format 
-# - will still work, but please use new format, shown below
-#
-# [frontend]
-#   listen = "localhost:8484"
-#   tls = false
-#   cert ="certs/server.crt"
-#   key = "certs/server.key"
-
-# This ([ldap] and [ldaps]) is the new server-config format
-[ldap]
-  enabled = true
-  listen = "0.0.0.0:3893"
-
-[ldaps]
-  enabled = false
-  listen = "0.0.0.0:3894"
-  cert = "certs/server.crt"
-  key = "certs/server.key"
-
-#################
-# The backend section controls the data store.
-[backend]
-  datastore = "plugin"
-  # If "plugin," uncomment the line below
-  plugin = "bin/sqlite.so"
-  pluginhandler = "NewSQLiteHandler"
-  baseDN = "dc=glauth,dc=com"
-
-  # // MySQL //
-  # Uncomment this line to configure your MySQL database connection string:
-  # database = "glauth:glauth@tcp(127.0.0.1:3306)/glauth"
-  # Creating database:
-  #     create database glauth identified;
-  #     grant all on glauth.* to glauth@localhost identified by 'glauth';
-  # // Postgres //
-  # Uncomment this line to configure your Postgres database connection string:
-  # database = "host=127.0.0.1 port=5432 dbname=glauth user=glauth password=glauth sslmode=disable"
-  # Creating database:
-  #     CREATE DATABASE <dbname>;
-  #     CREATE USER <username> WITH PASSWORD '<userpassword>'
-  #     GRANT ALL PRIVILEGES ON DATABASE <dbname> to <username>;
-  # // SQLite //
-  # Uncomment this line to configure your SQLite database connection string:
-  database = "gl.db"
-  
-  ## Configure dn format to use structures like 
-  ## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN"
-  ## to help ease migrations from other LDAP systems
-  # nameformat = "uid"
-  # groupformat = "cn"
-
-  ## Configure ssh-key attribute name, default is 'sshPublicKey'
-  # sshkeyattr = "ipaSshPubKey"
-
-#################
-# Enable and configure the optional REST API here.
-[api]
-  enabled = true
-  tls = false # enable TLS for production!!
-  listen = "0.0.0.0:5555"
-  cert = "cert.pem"
-  key = "key.pem"

pkg/plugins/sqlite.go

@@ -1,56 +0,0 @@
-package main
-
-import (
-	"database/sql"
-
-	_ "github.com/mattn/go-sqlite3"
-
-	"github.com/glauth/glauth/pkg/handler"
-)
-
-type SqliteBackend struct {
-}
-
-func NewSQLiteHandler(opts ...handler.Option) handler.Handler {
-	backend := SqliteBackend{}
-	return NewDatabaseHandler(backend, opts...)
-}
-
-func (b SqliteBackend) GetDriverName() string {
-	return "sqlite3"
-}
-
-func (b SqliteBackend) GetPrepareSymbol() string {
-	return "?"
-}
-
-// Create db/schema if necessary
-func (b SqliteBackend) CreateSchema(db *sql.DB) {
-	statement, _ := db.Prepare(`
-CREATE TABLE IF NOT EXISTS users (
-	id INTEGER PRIMARY KEY,
-	name TEXT NOT NULL,
-	uidnumber INTEGER NOT NULL,
-	primarygroup INTEGER NOT NULL,
-	othergroups TEXT DEFAULT '',
-	givenname TEXT DEFAULT '',
-	sn TEXT DEFAULT '',
-	mail TEXT DEFAULT '',
-	loginshell TYEXT DEFAULT '',
-	homedirectory TEXT DEFAULT '',
-	disabled SMALLINT  DEFAULT 0,
-	passsha256 TEXT DEFAULT '',
-	passbcrypt TEXT DEFAULT '',
-	otpsecret TEXT DEFAULT '',
-	yubikey TEXT DEFAULT '')
-`)
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_user_name on users(name)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS groups (id INTEGER PRIMARY KEY, name TEXT NOT NULL, gidnumber INTEGER NOT NULL)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE UNIQUE INDEX IF NOT EXISTS idx_group_name on groups(name)")
-	statement.Exec()
-	statement, _ = db.Prepare("CREATE TABLE IF NOT EXISTS includegroups (id INTEGER PRIMARY KEY, parentgroupid INTEGER NOT NULL, includegroupid INTEGER NOT NULL)")
-	statement.Exec()
-}

pkg/server/options.go

@@ -1,50 +0,0 @@
-package server
-
-import (
-	"context"
-
-	"github.com/glauth/glauth/pkg/config"
-	"github.com/go-logr/logr"
-)
-
-// Option defines a single option function.
-type Option func(o *Options)
-
-// Options defines the available options for this package.
-type Options struct {
-	Logger  logr.Logger
-	Config  *config.Config
-	Context context.Context
-}
-
-// newOptions initializes the available default options.
-func newOptions(opts ...Option) Options {
-	opt := Options{}
-
-	for _, o := range opts {
-		o(&opt)
-	}
-
-	return opt
-}
-
-// Logger provides a function to set the logger option.
-func Logger(val logr.Logger) Option {
-	return func(o *Options) {
-		o.Logger = val
-	}
-}
-
-// Config provides a function to set the config option.
-func Config(val *config.Config) Option {
-	return func(o *Options) {
-		o.Config = val
-	}
-}
-
-// Context provides a function to set the context option.
-func Context(val context.Context) Option {
-	return func(o *Options) {
-		o.Context = val
-	}
-}

release-please-config.json

@@ -0,0 +1,13 @@
+{
+  "packages": {
+    "v2": {
+      "release-type": "go",
+      "package-name": "GLAuth",
+      "pull-request-title-pattern": "ci: release ${version}",
+      "extra-files": [
+        "internal/version/const.go"
+      ]
+    }
+  },
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
+}

scripts/docker/default-config.cfg

@@ -1,73 +0,0 @@
-#################
-# glauth.conf
-
-#################
-# General configuration.
-debug = true
-#syslog = true
-
-#################
-[ldap]
-  enabled = true
-  listen = "localhost:389"
-
-[ldaps]
-  enabled = false
-  listen = "0.0.0.0:636"
-  cert = "cert.pem"
-  key = "key.pem"
-
-#################
-# The backend section controls the data store.
-[backend]
-  datastore = "config"
-  baseDN = "dc=glauth,dc=com"
-
-#################
-# The users section contains a hardcoded list of valid users.
-#   to create a passSHA256:   echo -n "mysecret" | openssl dgst -sha256
-[[users]]
-  name = "hackers"
-  uidnumber = 5001
-  primarygroup = 5501
-  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
-
-# This user record shows all of the possible fields available
-[[users]]
-  name = "johndoe"
-  givenname="John"
-  sn="Doe"
-  mail = "jdoe@example.com"
-  uidnumber = 5002
-  primarygroup = 5501
-  loginShell = "/bin/sh"
-  homeDir = "/root"
-  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
-  sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"]
-
-
-[[users]]
-  name = "serviceuser"
-  uidnumber = 5003
-  primarygroup = 5502
-  passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
-
-#################
-# The groups section contains a hardcoded list of valid users.
-[[groups]]
-  name = "superheros"
-  gidnumber = 5501
-
-[[groups]]
-  name = "svcaccts"
-  gidnumber = 5502
-
-#################
-# Enable and configure the optional REST API here.
-[api]
-  enabled = true
-  tls = false # enable TLS for production!!
-  listen = "localhost:5555"
-  cert = "cert.pem"
-  key = "key.pem"
-

scripts/test-build.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-
-img="localhost/glauth-dev"
-
-sudo docker rmi -f "$img"
-
-sudo docker build -f Dockerfile -t "$img" .
-
-sudo docker run -P "$img"

scripts/travis/good-results/posixGroupList0

@@ -1,105 +0,0 @@
-dn: cn=superheros,ou=groups,dc=glauth,dc=com
-cn: superheros
-uid: superheros
-description: superheros
-gidNumber: 5501
-objectClass: posixGroup
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
-memberUid: alexdoe
-memberUid: hackers
-memberUid: jackdoe
-memberUid: jamesdoe
-memberUid: johndoe
-memberUid: sarahdoe
-
-dn: cn=svcaccts,ou=groups,dc=glauth,dc=com
-cn: svcaccts
-uid: svcaccts
-description: svcaccts
-gidNumber: 5502
-objectClass: posixGroup
-uniqueMember: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com
-memberUid: serviceuser
-
-dn: cn=vpnaccess,ou=groups,dc=glauth,dc=com
-cn: vpnaccess
-uid: vpnaccess
-description: vpnaccess
-gidNumber: 5503
-objectClass: posixGroup
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
-memberUid: alexdoe
-memberUid: hackers
-memberUid: jackdoe
-memberUid: jamesdoe
-memberUid: johndoe
-memberUid: sarahdoe
-
-dn: cn=allaccs,ou=groups,dc=glauth,dc=com
-cn: allaccs
-uid: allaccs
-description: allaccs
-gidNumber: 5504
-objectClass: posixGroup
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com
-memberUid: alexdoe
-memberUid: hackers
-memberUid: jackdoe
-memberUid: jamesdoe
-memberUid: johndoe
-memberUid: sarahdoe
-memberUid: serviceuser
-
-dn: cn=mailadmin,ou=groups,dc=glauth,dc=com
-cn: mailadmin
-uid: mailadmin
-description: mailadmin
-gidNumber: 5505
-objectClass: posixGroup
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
-memberUid: alexdoe
-memberUid: jackdoe
-memberUid: jamesdoe
-memberUid: sarahdoe
-
-dn: cn=webmail,ou=groups,dc=glauth,dc=com
-cn: webmail
-uid: webmail
-description: webmail
-gidNumber: 5506
-objectClass: posixGroup
-
-dn: cn=fulltime,ou=groups,dc=glauth,dc=com
-cn: fulltime
-uid: fulltime
-description: fulltime
-gidNumber: 5507
-objectClass: posixGroup
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
-memberUid: alexdoe
-memberUid: jackdoe
-memberUid: jamesdoe
-memberUid: sarahdoe
-

v2/CHANGELOG.md

@@ -0,0 +1,125 @@
+# Changelog
+
+## [2.5.2](https://github.com/glauth/glauth/compare/GLAuth-v2.5.1...GLAuth-v2.5.2) (2026-07-25)
+
+
+### Features
+
+* check plugin compatibility at release time ([700745e](https://github.com/glauth/glauth/commit/700745e640c5371361a58ef3c90245a4637c5224))
+
+## [2.5.1](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.1) (2026-07-18)
+
+
+### Bug Fixes
+
+* reject disabled users on all backends in Bind ([#470](https://github.com/glauth/glauth/issues/470)) ([fb65713](https://github.com/glauth/glauth/commit/fb65713fbdfd626cb033675fb42724a5fb3d06ff))
+* team atlanta arbitrary password ([#471](https://github.com/glauth/glauth/issues/471)) ([cb121cd](https://github.com/glauth/glauth/commit/cb121cdc2c9b831abdf7831835ec30ead2536a7a))
+
+## [2.5.0](https://github.com/glauth/glauth/compare/GLAuth-v2.5.0...GLAuth-v2.5.0) (2026-04-19)
+
+
+### Features
+
+* allow tracing configuration via main config ([f692394](https://github.com/glauth/glauth/commit/f692394942aa0f93a1aa1572331fd1c3e3553156))
+* alt container build registry ([f8dee8d](https://github.com/glauth/glauth/commit/f8dee8da879232f5c6ae2a2a19565562c7d0d9fd))
+* embedded plugins ([c0ed908](https://github.com/glauth/glauth/commit/c0ed90822fd4d2ee7104a1979d423a0c93d758ac))
+* introduce context for otlp spans into handler pkg ([d05630f](https://github.com/glauth/glauth/commit/d05630f66b80a776fd406782ad1fde5c6c66eac6))
+* introduce context for otlp spans into plugins pkg ([46e49b6](https://github.com/glauth/glauth/commit/46e49b6976318a9f3670b88bdcb3411dfac0a17c))
+* introduce legacy behavior, based on past versions ([#318](https://github.com/glauth/glauth/issues/318)) ([34a6b30](https://github.com/glauth/glauth/commit/34a6b30b8fe69c90cab09eb85890ffdfe8fc80fd))
+* introduce otelsql ([2ca5312](https://github.com/glauth/glauth/commit/2ca53126965aa7d42b23aee15f750df12822d454))
+* introduce otlp tracer ([0cf0403](https://github.com/glauth/glauth/commit/0cf04037a2a7b38c8ed7af2451b115f48c5427b5))
+* proxying ldap paging compat ([#422](https://github.com/glauth/glauth/issues/422)) ([8476506](https://github.com/glauth/glauth/commit/8476506b8c51e993eb90c73d612f69fec5350b89))
+* starttls and ldaps now matching features ([#458](https://github.com/glauth/glauth/issues/458)) ([d68c78a](https://github.com/glauth/glauth/commit/d68c78a18b150679038e5ce549b6b227c31518d7))
+* wire up basic tracer ([1c2b23c](https://github.com/glauth/glauth/commit/1c2b23c00ff85b83a6d2e4bf4a9a68081aaf2777))
+
+
+### Bug Fixes
+
+* 246 and [#252](https://github.com/glauth/glauth/issues/252) ([ceefc66](https://github.com/glauth/glauth/commit/ceefc66dbba9ae054958269825de31d22d30e262))
+* config watcher now updates whenf ile added to dir ([#424](https://github.com/glauth/glauth/issues/424)) ([a90f37b](https://github.com/glauth/glauth/commit/a90f37b23b76af22c700392d68bf227b7aee1894))
+* Credentials leaked on INFO log level ([#451](https://github.com/glauth/glauth/issues/451)) ([645dbb2](https://github.com/glauth/glauth/commit/645dbb226683ae57f3d5382e21ea42444e940752))
+* drop vendored toml ([24455e3](https://github.com/glauth/glauth/commit/24455e39889716ce7ae1e7e8a7dacfa7d4c96080))
+* formatting ([c90cbfe](https://github.com/glauth/glauth/commit/c90cbfe5fb090fc19a55d64e01cd0e31c38bf2f0))
+* go test not checking otp within allowed basedn ([#403](https://github.com/glauth/glauth/issues/403)) ([ed52a91](https://github.com/glauth/glauth/commit/ed52a91ec4117ff58fe606a1d8ba10786501a1e5))
+* move all toml parsing into a new internal package, drop the mappings in favour of toml.Primitive decoding ([3ba8e11](https://github.com/glauth/glauth/commit/3ba8e1113217be647d240261322453d213ea7da4))
+* patch group name fetches for the rest of handlers ([#450](https://github.com/glauth/glauth/issues/450)) ([b498736](https://github.com/glauth/glauth/commit/b498736cfdd0ee6f1585d682a5c54c9d927b8dbb))
+* remove spinlock in monitoring code ([#405](https://github.com/glauth/glauth/issues/405)) ([a2c151b](https://github.com/glauth/glauth/commit/a2c151b0d025332462369a846a51ef4deff5332b))
+* removed config setup from main, reshoring log configuration ([5fe8aca](https://github.com/glauth/glauth/commit/5fe8aca852bdfe7e375ea99b87074bae35fc3407))
+* update ldap library to fix [#389](https://github.com/glauth/glauth/issues/389) ([#430](https://github.com/glauth/glauth/issues/430)) ([a5ecc26](https://github.com/glauth/glauth/commit/a5ecc26e064cea9e4dab3dd234ebd5d5eb06be0e))
+* update tracing code to work with breaking otlp 1.20 changes ([1a37396](https://github.com/glauth/glauth/commit/1a3739610997b58100040d0c8a405596fccc8e23))
+* upgrade to use BurntSushi/toml ([f9addbc](https://github.com/glauth/glauth/commit/f9addbc2c5b13ccc2779dbabc4c55bc8706f53d6))
+
+
+### Miscellaneous Chores
+
+* force release 2.5.0 ([ff7a9e6](https://github.com/glauth/glauth/commit/ff7a9e6215857e0dd3450504b7b063409ccfc374))
+* release 2.3.1 ([0bf3d4a](https://github.com/glauth/glauth/commit/0bf3d4a82a8451e7bbda74e3730345aab5a855a7))
+
+## [2.4.0](https://github.com/glauth/glauth/compare/v2.3.2...v2.4.0) (2024-08-04)
+
+
+### Features
+
+* proxying ldap paging compat ([#422](https://github.com/glauth/glauth/issues/422)) ([8476506](https://github.com/glauth/glauth/commit/8476506b8c51e993eb90c73d612f69fec5350b89))
+
+
+### Bug Fixes
+
+* config watcher now updates whenf ile added to dir ([#424](https://github.com/glauth/glauth/issues/424)) ([a90f37b](https://github.com/glauth/glauth/commit/a90f37b23b76af22c700392d68bf227b7aee1894))
+* update ldap library to fix [#389](https://github.com/glauth/glauth/issues/389) ([#430](https://github.com/glauth/glauth/issues/430)) ([a5ecc26](https://github.com/glauth/glauth/commit/a5ecc26e064cea9e4dab3dd234ebd5d5eb06be0e))
+
+## [2.3.2](https://github.com/glauth/glauth/compare/v2.3.1...v2.3.2) (2024-02-19)
+
+
+### Bug Fixes
+
+* remove spinlock in monitoring code ([#405](https://github.com/glauth/glauth/issues/405)) ([a2c151b](https://github.com/glauth/glauth/commit/a2c151b0d025332462369a846a51ef4deff5332b))
+
+## [2.3.1](https://github.com/glauth/glauth/compare/v2.2.1...v2.3.1) (2024-02-12)
+
+
+### Features
+
+* allow tracing configuration via main config ([f692394](https://github.com/glauth/glauth/commit/f692394942aa0f93a1aa1572331fd1c3e3553156))
+* introduce context for otlp spans into handler pkg ([d05630f](https://github.com/glauth/glauth/commit/d05630f66b80a776fd406782ad1fde5c6c66eac6))
+* introduce context for otlp spans into plugins pkg ([46e49b6](https://github.com/glauth/glauth/commit/46e49b6976318a9f3670b88bdcb3411dfac0a17c))
+* introduce otelsql ([2ca5312](https://github.com/glauth/glauth/commit/2ca53126965aa7d42b23aee15f750df12822d454))
+* introduce otlp tracer ([0cf0403](https://github.com/glauth/glauth/commit/0cf04037a2a7b38c8ed7af2451b115f48c5427b5))
+* wire up basic tracer ([1c2b23c](https://github.com/glauth/glauth/commit/1c2b23c00ff85b83a6d2e4bf4a9a68081aaf2777))
+
+
+### Bug Fixes
+
+* drop vendored toml ([24455e3](https://github.com/glauth/glauth/commit/24455e39889716ce7ae1e7e8a7dacfa7d4c96080))
+* formatting ([c90cbfe](https://github.com/glauth/glauth/commit/c90cbfe5fb090fc19a55d64e01cd0e31c38bf2f0))
+* go test not checking otp within allowed basedn ([#403](https://github.com/glauth/glauth/issues/403)) ([ed52a91](https://github.com/glauth/glauth/commit/ed52a91ec4117ff58fe606a1d8ba10786501a1e5))
+* move all toml parsing into a new internal package, drop the mappings in favour of toml.Primitive decoding ([3ba8e11](https://github.com/glauth/glauth/commit/3ba8e1113217be647d240261322453d213ea7da4))
+* removed config setup from main, reshoring log configuration ([5fe8aca](https://github.com/glauth/glauth/commit/5fe8aca852bdfe7e375ea99b87074bae35fc3407))
+* update tracing code to work with breaking otlp 1.20 changes ([1a37396](https://github.com/glauth/glauth/commit/1a3739610997b58100040d0c8a405596fccc8e23))
+* upgrade to use BurntSushi/toml ([f9addbc](https://github.com/glauth/glauth/commit/f9addbc2c5b13ccc2779dbabc4c55bc8706f53d6))
+
+
+### Miscellaneous Chores
+
+* release 2.3.1 ([0bf3d4a](https://github.com/glauth/glauth/commit/0bf3d4a82a8451e7bbda74e3730345aab5a855a7))
+
+## [2.3.0](https://github.com/glauth/glauth/compare/v2.2.0...v2.3.0) (2023-10-02)
+
+
+### ⚠ BREAKING CHANGES
+
+* **plugins:** Rename the groups table to ldapgroups ([#326](https://github.com/glauth/glauth/issues/326))
+
+### Features
+
+* Update migration code to support table names ([#339](https://github.com/glauth/glauth/issues/339)) ([349431c](https://github.com/glauth/glauth/commit/349431c6caa0388d17ab987621eb9be5f019155e))
+
+
+### Bug Fixes
+
+* **plugins:** Rename the groups table to ldapgroups ([#326](https://github.com/glauth/glauth/issues/326)) ([675b236](https://github.com/glauth/glauth/commit/675b236328a21a65daa7876a1a3c6900b85b1964))
+
+
+### Miscellaneous Chores
+
+* release 2.3.0 ([0c11325](https://github.com/glauth/glauth/commit/0c11325a2482d5067c805a4c7ed948a5e337b8f8))

v2/Makefile

@@ -0,0 +1,379 @@
+.DEFAULT_GOAL := help
+
+MAKEFLAGS += --no-print-directory
+
+VERSION=$(shell if [ -x bin/linuxamd64/glauth ]; then bin/linuxamd64/glauth --version; else bin/glauth-linux-amd64 --version; fi)
+
+GIT_COMMIT=$(shell git rev-list -1 HEAD )
+BUILD_TIME=$(shell date -u +%Y%m%d_%H%M%SZ)
+GIT_CLEAN=$(shell git status | grep -E "working (tree|directory) clean" | wc -l | sed 's/^[ ]*//')
+
+# Last git tag
+LAST_GIT_TAG=$(shell git describe --abbrev=0 --tags 2> /dev/null)
+
+# this=1 if the current commit is the tagged commit (ie, if this is a release build)
+GIT_IS_TAG_COMMIT=$(shell git describe --abbrev=0 --tags > /dev/null 2> /dev/null && echo "1" || echo "0")
+
+# Used when a tag isn't available
+GIT_BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
+
+# Build variables
+BUILD_VARS?=-s -w
+BUILD_FILES=.
+TRIM_FLAGS>?=-trimpath
+BUILD_TAGS?=noembed
+
+# Targets
+MAIN_TARGETS?=linux/amd64,linux/386,linux/arm64,linux/arm-7,linux/riscv64,darwin/amd64,darwin/arm64,windows/amd64,windows/386
+PLUGIN_TARGETS?=linux/amd64,linux/386,linux/arm64,linux/arm-7,linux/riscv64,darwin/amd64,darwin/arm64
+EMBED_TARGETS?=windows/amd64
+
+# For release process
+GO_RELEASE_V=$(shell go version | { read _ _ v _; echo $${v#go}; })
+
+# Build
+GOOS?=linux
+GOARCH?=amd64
+
+# Plugins
+-include pkg/plugins/*/Makefile
+
+#####################
+# High level commands
+#####################
+
+#help: @ List available tasks on this project
+help: 
+	@grep -E '[a-zA-Z\.\-]+:.*?@ .*$$' $(MAKEFILE_LIST)| tr -d '#' | sed -E 's/Makefile.//' | awk 'BEGIN {FS = ":.*?@ "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+#run: @ build and run - used for development
+run: setup devrun
+
+mocks:
+	go install go.uber.org/mock/mockgen@v0.3.0
+	# generate gomocks
+	go generate ./...
+.PHONY: mocks
+
+vet:
+	-go vet ./...
+.PHONY: vet
+#test: @ runs package, root integration, and shell integration tests
+test: mocks vet
+	go test -v -cover -coverprofile coverage.out ./pkg/... ./internal/... .
+	$(MAKE) runtest
+#all: @ run build process for all binaries
+all: setup binaries verify
+
+#fast: @ run build process for only linuxamd64
+fast: setup linuxamd64
+
+#fastdebug: @ run build process for only linuxamd64 in debug mode
+fastdebug: setup linuxamd64debug
+
+#binaries: @ list of binary formats to build
+binaries: linux386 linuxamd64 linuxarm linuxarm64 linuxriscv64 darwinamd64 darwinarm64 win386 winamd64
+
+#setup: @ setup commands to always run
+setup: getdeps format
+
+#####################
+# Subcommands
+#####################
+#	@echo \- removing any changes and pulling latest master && \
+#	git reset --hard HEAD >/dev/null 2>&1 && \
+#	git checkout master >/dev/null 2>&1 && \
+#	git pull >/dev/null 2>&1 && \
+
+prepbuild:
+	echo \- taking care of ignore files && \
+	sudo rm -rf bin/* >/dev/null && \
+	echo \- cleaning up plugins remnants && \
+	make forget-plugins && \
+	make remember-plugins
+
+forget-embed:
+	@if [ -f pkg/server/embed_sqlite.go ]; then \
+		mv pkg/server/embed_sqlite.go /tmp/; \
+	fi
+
+remember-embed:
+	@if [ ! -f pkg/server/embed_sqlite.go ]; then \
+		mv /tmp/embed_sqlite.go pkg/server/; \
+	fi
+
+# Run integration test
+runtest:
+	./scripts/ci/integration-test.sh cleanup
+
+# Get all dependencies
+getdeps:
+	go get -d ./...
+
+updatetest:
+	./scripts/ci/integration-test.sh
+
+format:
+	go fmt ./...
+
+devrun:
+	go run ${BUILD_FILES} -c sample-simple.cfg
+
+#testplugin: @ start GLAuth with a dynamically loaded plugin and stop it cleanly
+GLAUTH_BIN?=bin/glauth-linux-amd64
+PLUGIN_BIN?=bin/sqlite-linux-amd64.so
+PLUGIN_CONFIG?=pkg/plugins/glauth-sqlite/sample-database.cfg
+PLUGIN_LDAP_PORT?=13893
+PLUGIN_API_PORT?=15555
+
+testplugin:
+	@set -e; \
+	test -x "$(GLAUTH_BIN)"; \
+	test -r "$(PLUGIN_BIN)"; \
+	test -f "$(PLUGIN_CONFIG)"; \
+	tmpdir=$$(mktemp -d); \
+	trap 'rm -rf "$$tmpdir"' EXIT; \
+	sed \
+		-e 's#^[[:space:]]*plugin = .*#  plugin = "$(abspath $(PLUGIN_BIN))"#' \
+		-e "s#^[[:space:]]*database = .*#  database = \"$$tmpdir/gl.db\"#" \
+		-e 's#listen = "0.0.0.0:3893"#listen = "127.0.0.1:$(PLUGIN_LDAP_PORT)"#' \
+		-e 's#listen = "0.0.0.0:5555"#listen = "127.0.0.1:$(PLUGIN_API_PORT)"#' \
+		"$(PLUGIN_CONFIG)" > "$$tmpdir/config.cfg"; \
+	"$(GLAUTH_BIN)" -c "$$tmpdir/config.cfg" > "$$tmpdir/glauth.log" 2>&1 & \
+	pid=$$!; \
+	sleep 2; \
+	if ! kill -0 "$$pid" 2>/dev/null; then \
+		set +e; wait "$$pid"; status=$$?; set -e; \
+		cat "$$tmpdir/glauth.log"; \
+		exit $$status; \
+	fi; \
+	kill -TERM "$$pid"; \
+	set +e; wait "$$pid"; status=$$?; set -e; \
+	cat "$$tmpdir/glauth.log"; \
+	exit $$status
+
+mkbindir:
+	@echo "create directory bin/$(GOOS)$(GOARCH)"
+	@mkdir -p bin/$(GOOS)$(GOARCH)
+.PHONY: mkbindir
+
+build: mkbindir
+	@go build ${TRIM_FLAGS} -tags ${BUILD_TAGS} -ldflags "${BUILD_VARS}" -o bin/$(GOOS)$(GOARCH)/glauth -buildvcs .
+	$(MAKE) sha256
+.PHONY: build
+
+builddebug: mkbindir
+	@go build ${TRIM_FLAGS} -tags ${BUILD_TAGS} -gcflags="all=-N -l" -o bin/$(GOOS)$(GOARCH)/glauth -buildvcs .
+	$(MAKE) sha256
+.PHONY: builddebug
+
+sha256:
+	@sha256sum bin/$(GOOS)$(GOARCH)/glauth > bin/$(GOOS)$(GOARCH)/glauth.sha256
+.PHONY: sha256
+
+linuxamd64debug:
+	GOOS=linux GOARCH=amd64 $(MAKE) builddebug
+
+linux386:
+	GOOS=linux GOARCH=386 $(MAKE) build
+
+linuxamd64:
+	GOOS=linux GOARCH=amd64 $(MAKE) build
+
+linuxarm:
+	GOOS=linux GOARCH=arm $(MAKE) build
+
+linuxarm64:
+	GOOS=linux GOARCH=arm64 $(MAKE) build
+
+linuxriscv64:
+	GOOS=linux GOARCH=riscv64 $(MAKE) build
+
+testing:
+	mkdir -p pkg/embed && \
+	cat pkg/plugins/glauth-sqlite/sqlite.go | sed -e 's/func main() {}//' -e 's/^package main/package embed/' > pkg/embed/sqlite.go  && \
+	go mod tidy && \
+	GOOS=linux GOARCH=amd64 CGO_ENABLED=1 BUILD_TAGS=embedsqlite $(MAKE) build && \
+	rm -rf pkg/embed
+
+darwinamd64:
+	GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 $(MAKE) build
+
+darwinarm64:
+	GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 $(MAKE) build
+
+win386:
+	GOOS=windows GOARCH=386 $(MAKE) build
+
+winamd64:
+	GOOS=windows GOARCH=amd64 $(MAKE) build
+
+verify:
+	@for binary in linux386 linuxamd64 linuxarm linuxarm64 linuxriscv64 darwinamd64 darwinarm64 win386 winamd64; do cd bin/$$binary && sha256sum glauth.sha256 -c && cd ../..; done
+
+pull-plugin-dependencies:
+	(for pkg in $$(cat $$M/go.mod | awk '/^require [a-z]/{print $$2"@"$$3} /^\)/{rblock=0} rblock{if($$4!="indirect" && $$1!~"glauth"){print $$1"@"$$2}} /^require \(/{rblock=1}'); do if [ "$$(grep $${pkg%@*} go.mod 2>/dev/null)" = "" ]; then go get $$pkg; fi; done)
+
+#prepare-plugins-buid: @ pull plugins dependencies for local building
+prepare-plugins-build:
+	@M=pkg/plugins/glauth-sqlite make pull-plugin-dependencies && \
+	M=pkg/plugins/glauth-mysql make pull-plugin-dependencies && \
+	M=pkg/plugins/glauth-postgres make pull-plugin-dependencies && \
+	M=pkg/plugins/glauth-pam make pull-plugin-dependencies
+
+forget-plugin:
+	rm -rf $M ../.git/modules/v2/$M; \
+	git config --remove-section submodule.v2/$M; \
+	git rm --cache $M; \
+	go mod tidy; \
+	true
+
+#forget-plugin: @ remove plugins, restoring original file structure
+forget-plugins:
+	for pkg in pkg/plugins/*; do \
+		if [ -d "$$pkg" ]; then \
+			P=$$(echo $$pkg | cut -d'/' -f 3) M=$$pkg make forget-plugin >/dev/null 2>&1;\
+		fi; \
+	done; \
+	rm -rf buildlogs
+
+remember-plugins:
+	cd ../ && \
+	for module in $$(cat .gitmodules | awk '/path =/{P=$$3} /url =/{print $$3 "," P}'); do \
+		git submodule add $${module%%,*} $${module#*,}; \
+	done; \
+	git submodule update --init --recursive
+
+_buildmain:
+	@xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out glauth -dest bin -buildvcs=false --targets="${MAIN_TARGETS}" .
+
+#buildmain: @ build main binaries for distribution
+buildmain: prepbuild _buildmain
+
+buildsingleembed:
+	git checkout -b build_embeds && \
+	mkdir -p pkg/embed && \
+	cat pkg/plugins/$P/$M | sed -e 's/func main() {}//' -e 's/^package main/package embed/' > pkg/embed/$M  && \
+	go mod tidy && \
+	git add pkg/embed/$M go.mod go.sum && \
+	git commit -m "build cruft" && \
+	git push -u origin build_embeds && \
+	xgo -v -ldflags="${BUILD_VARS}" --tags=$T -trimpath -go ${GO_RELEASE_V} -out glauth -dest bin -buildvcs=false --targets="${EMBED_TARGETS}" . && \
+	rm -rf pkg/embed && \
+	git checkout master && \
+	git push -d origin build_embeds && \
+	git branch -D build_embeds
+
+_buildmainembeds:
+	P=glauth-sqlite M=sqlite.go T=embedsqlite make buildsingleembed
+
+#buildmainembeds: @ build main binaries for distribution, including embedded plugins
+buildmainembeds: prepbuild _buildmainembeds
+
+buildplugin: 
+ifeq ($P,pam)
+	xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go --bringupcmd 'apt update && apt install -y libpam0g-dev' .
+else
+	xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go . 
+endif
+	(cd bin && for lib in $$(ls $$P-* | grep -v \.so$$); do sudo mv $$lib $$lib.so; done); 
+
+_buildplugins: prepare-plugins-build
+	for pkg in pkg/plugins/*; do \
+		if [ -d "$$pkg" ]; then \
+			M=pkg/plugins/$$(echo $$pkg | cut -d'/' -f 3) && P=$$(echo $$M | grep -oP 'glauth-\K\w+') && M=$$M P=$$P make buildplugin;\
+		fi; \
+	done; \
+
+#buildplugins: @ build base plugins for distribution
+buildplugins: forget-embed _buildplugins remember-embed
+
+_checkdockerauth:
+	@if ! grep -q "index.docker.io" $(HOME)/.docker/config.json; then \
+		echo "❌ Not logged in to Docker Hub (index.docker.io not found in config)."; \
+		exit 1; \
+	fi; \
+	if ! grep -q "ghcr.io" $(HOME)/.docker/config.json; then \
+		echo "❌ Not logged in to GitHub Hub (ghcr.io not found in config)."; \
+		exit 1; \
+	fi
+
+builddockermain:
+	$(if $(TAG),,$(error ❌ Must set TAG))
+	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
+	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 docker/assets/linux/riscv64 && \
+	cp -f bin/glauth-linux-amd64 docker/assets/linux/amd64/glauth && \
+	cp -f bin/glauth-linux-arm64 docker/assets/linux/arm64/glauth && \
+	cp -f bin/glauth-linux-arm-7 docker/assets/linux/arm/v7/glauth && \
+    cp -f bin/glauth-linux-riscv64 docker/assets/linux/riscv64/glauth && \
+	docker buildx build --tag ghcr.io/$$REPO/glauth:$$TAG -t ghcr.io/$$REPO/glauth:latest -f docker/Dockerfile-standalone --platform linux/amd64,linux/arm64,linux/arm/v7,linux/riscv64 --push docker && \
+	docker buildx build --tag $$REPO/glauth:$$TAG -t $$REPO/glauth:latest -f docker/Dockerfile-standalone --platform linux/amd64,linux/arm64,linux/arm/v7,linux/riscv64 --push docker
+
+builddockerplugins:
+	$(if $(TAG),,$(error ❌ Must set TAG))
+	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
+	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 docker/assets/linux/riscv64 && \
+	cp -f bin/sqlite-linux-amd64.so docker/assets/linux/amd64/sqlite.so && \
+	cp -f bin/sqlite-linux-arm64.so docker/assets/linux/arm64/sqlite.so && \
+	cp -f bin/sqlite-linux-arm-7.so docker/assets/linux/arm/v7/sqlite.so && \
+	cp -f bin/sqlite-linux-riscv64.so docker/assets/linux/riscv64/sqlite.so && \
+	cp -f bin/mysql-linux-amd64.so docker/assets/linux/amd64/mysql.so && \
+	cp -f bin/mysql-linux-arm64.so docker/assets/linux/arm64/mysql.so && \
+	cp -f bin/mysql-linux-arm-7.so docker/assets/linux/arm/v7/mysql.so && \
+	cp -f bin/mysql-linux-riscv64.so docker/assets/linux/riscv64/mysql.so && \
+	cp -f bin/postgres-linux-amd64.so docker/assets/linux/amd64/postgres.so && \
+	cp -f bin/postgres-linux-arm64.so docker/assets/linux/arm64/postgres.so && \
+	cp -f bin/postgres-linux-arm-7.so docker/assets/linux/arm/v7/postgres.so && \
+	cp -f bin/postgres-linux-riscv64.so docker/assets/linux/riscv64/postgres.so && \
+	docker buildx build --tag ghcr.io/$$REPO/glauth-plugins:$$TAG -t ghcr.io/$$REPO/glauth-plugins:latest -f docker/Dockerfile-plugins --platform linux/amd64,linux/arm64,linux/arm/v7,linux/riscv64 --push docker && \
+	docker buildx build --tag $$REPO/glauth-plugins:$$TAG -t $$REPO/glauth-plugins:latest -f docker/Dockerfile-plugins --platform linux/amd64,linux/arm64,linux/arm/v7,linux/riscv64 --push docker
+
+builddocker: _checkdockerauth builddockermain builddockerplugins
+
+buildeverything: prepbuild forget-embed _buildplugins _buildmain testplugin remember-embed _buildmainembeds builddocker
+
+#testdocker: @ run integration test using docker
+testdocker:
+	$(if $(REPO),,$(error Must set REPO - glauth or other))
+	@echo "==> Cleaning up any existing image to be on the safe side..." && \
+	(for image in $$(docker image ls -q "$$REPO/glauth*"); do \
+		for container in $$(docker container ls -a -q -f ancestor=$$image); do \
+			docker stop $$container; \
+			while [ "$$(docker container ls -q -f ancestor=$$image)" != "" ]; do sleep 1; done; \
+			docker rm $$container; \
+		done; \
+		docker rmi $$image; \
+	done) && \
+	echo "==> Running glauth main container..." && \
+	docker run -d --name glauth-test -p 3893:3893 $$REPO/glauth:latest && \
+	sleep 5 && \
+	if [ "$$(ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com cn=hackers | grep posixAccount)" != "" ]; then \
+		echo "Checked: Glauth is responding properly to ldapsearch query."; \
+	else \
+		echo "glauth check did not pass. Aborting."; \
+		exit 1; \
+	fi && \
+	echo "==> Stopping glauth main container..." && \
+	docker stop glauth-test && \
+	while [ "$$(docker ps -q -f name=glauth-test)" != "" ]; do sleep 1; done; \
+	docker rm glauth-test && \
+	echo "==> Running glauth plugins container..." && \
+	docker run -d --name glauth-test -p 3893:3893 $$REPO/glauth-plugins:latest && \
+	sleep 5 && \
+	if [ "$$(ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com cn=hackers | grep posixAccount)" != "" ]; then \
+		echo "Checked: Glauth is responding properly to ldapsearch query."; \
+	else \
+		echo "glauth check did not pass. Aborting."; \
+		exit 1; \
+	fi && \
+	echo "==> Stopping glauth plugins container..." && \
+	docker stop glauth-test  && \
+	while [ "$$(docker ps -q -f name=glauth-test)" != "" ]; do sleep 1; done; \
+	docker rm glauth-test && \
+	echo "==> Testing complete."
+
+.PHONY: all \
+	prepbuild run test fast binaries setup getdeps runtest updatetest format devrun \
+	linux386 linuxamd64 linuxarm linuxarm64 linuxriscv64 darwinamd64 darwinarm64 win386 winamd64 verify \
+	pull-plugin pull-base-plugins forget-plugin forget-plugins buildmain buildplugin build \
+	buildplugins builddockermain builddockerplugins builddocker testdocker testplugin buildeverything

v2/docker/Dockerfile-plugins

@@ -0,0 +1,44 @@
+#################
+# Build Step
+#################
+
+FROM alpine:latest as build
+
+RUN apk add --no-cache git make busybox-static dumb-init
+
+#################
+# Run Step
+#################
+
+FROM gcr.io/distroless/base-debian13 as run
+
+LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>" \
+      org.opencontainers.image.title="GLauth" \
+      org.opencontainers.image.description="A simple LDAP server for development, home use, or CI pipelines" \
+      org.opencontainers.image.authors="Ben Yanke, Jörn Friedrich Dreyer, Chris F Ravenscroft" \
+      org.opencontainers.image.source="https://github.com/glauth/glauth" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="latest" \
+      org.opencontainers.image.url="https://github.com/glauth/glauth"
+
+ARG TARGETPLATFORM
+
+# Copy docker specific scripts from build container
+COPY assets/start-plugins.sh /app/docker/start-plugins.sh
+COPY assets/default-config-plugins.cfg /app/docker/default-config-plugins.cfg
+COPY assets/gl.db /app/docker/gl.db
+COPY assets/$TARGETPLATFORM/glauth /app/glauth
+COPY assets/$TARGETPLATFORM/*.so /app/
+
+# Just what we need
+COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init
+COPY --from=build /bin/busybox.static /bin/sh
+COPY --from=build /bin/busybox.static /bin/ln
+COPY --from=build /bin/busybox.static /bin/rm
+RUN ln /bin/sh /usr/bin/cp && ln /bin/sh /usr/bin/mkdir && rm /bin/ln /bin/rm
+
+# Expose web and LDAP ports
+EXPOSE 389 636 5555
+
+ENTRYPOINT ["/usr/bin/dumb-init", "--"]
+CMD ["/bin/sh", "/app/docker/start-plugins.sh"]

v2/docker/Dockerfile-standalone

@@ -0,0 +1,42 @@
+#################
+# Build Step
+#################
+
+FROM alpine:latest as build
+
+RUN apk add --no-cache git make busybox-static dumb-init
+
+#################
+# Run Step
+#################
+
+FROM gcr.io/distroless/base-debian13 as run
+
+LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>" \
+      org.opencontainers.image.title="GLauth" \
+      org.opencontainers.image.description="A simple LDAP server for development, home use, or CI pipelines" \
+      org.opencontainers.image.authors="Ben Yanke, Jörn Friedrich Dreyer, Chris F Ravenscroft" \
+      org.opencontainers.image.source="https://github.com/glauth/glauth" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="latest" \
+      org.opencontainers.image.url="https://github.com/glauth/glauth"
+
+ARG TARGETPLATFORM
+
+# Copy docker specific scripts from build container
+COPY assets/start-standalone.sh /app/docker/start-standalone.sh
+COPY assets/default-config-standalone.cfg /app/docker/default-config-standalone.cfg
+COPY assets/$TARGETPLATFORM/glauth /app/glauth
+
+# Just what we need
+COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init
+COPY --from=build /bin/busybox.static /bin/sh
+COPY --from=build /bin/busybox.static /bin/ln
+COPY --from=build /bin/busybox.static /bin/rm
+RUN ln /bin/sh /usr/bin/cp && ln /bin/sh /usr/bin/mkdir && rm /bin/ln /bin/rm
+
+# Expose web and LDAP ports
+EXPOSE 389 636 5555
+
+ENTRYPOINT ["/usr/bin/dumb-init", "--"]
+CMD ["/bin/sh", "/app/docker/start-standalone.sh"]

v2/docker/assets/default-config-plugins.cfg

@@ -0,0 +1,38 @@
+#################
+# glauth.conf
+
+#################
+# General configuration.
+debug = true
+#syslog = true
+
+#################
+[ldap]
+  enabled = true
+  listen = "0.0.0.0:3893"
+
+[ldaps]
+  enabled = false
+  listen = "0.0.0.0:3894"
+  cert = "cert.pem"
+  key = "key.pem"
+
+#################
+# The backend section controls the data store.
+[backend]
+  datastore = "plugin"
+  # If "plugin," uncomment the line below
+  plugin = "/app/sqlite.so"
+  pluginhandler = "NewSQLiteHandler"
+  baseDN = "dc=glauth,dc=com"
+  database = "/app/config/gl.db"
+
+#################
+# Enable and configure the optional REST API here.
+[api]
+  enabled = true
+  tls = false # enable TLS for production!!
+  listen = "localhost:5555"
+  cert = "cert.pem"
+  key = "key.pem"
+

v2/docker/assets/default-config-standalone.cfg

@@ -45,6 +45,8 @@ debug = true
   # sshkeyattr = "ipaSshPubKey"
 
 [behaviors]
+  # Ignore all capabilities restrictions, for instance allowing every user to perform a search
+  IgnoreCapabilities = false
   # Enable a "fail2ban" type backoff mechanism temporarily banning repeated failed login attempts
   LimitFailedBinds = true
   # How many failed login attempts are allowed before a ban is imposed
@@ -66,6 +68,9 @@ debug = true
   uidnumber = 5001
   primarygroup = 5501
   passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
+    [[users.capabilities]]
+    action = "search"
+    object = "ou=superheros,dc=glauth,dc=com"
 
 # This user record shows all of the possible fields available
 [[users]]
@@ -91,6 +96,9 @@ debug = true
   uidnumber = 5003
   primarygroup = 5502
   passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
+    [[users.capabilities]]
+    action = "search"
+    object = "*"
 
 # Test user showing 2 factor auth authentication
 [[users]]
@@ -100,6 +108,9 @@ debug = true
   passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
   otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
   yubikey = "vvjrcfalhlaa"
+    [[users.capabilities]]
+    action = "search"
+    object = "ou=superheros,dc=glauth,dc=com"
 
 [[users]]
   name = "uberhackers"

v2/docker/assets/start-plugins.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+
+# Copy config file if it doesn't exist so that the app can start
+if [ ! -f /app/config/config.cfg ] ; then
+  echo "Config file not found at /app/config/config.cfg"
+  echo "Copying example configuration file to run."
+  mkdir -p /app/config
+  cp /app/docker/default-config-plugins.cfg /app/config/config.cfg || exit 1
+  # This file will be ignored when switching away from the default (sqlite)
+  cp /app/docker/gl.db /app/config/gl.db || exit 1
+ fi
+
+
+echo "";
+echo "Version and build information:";
+echo "";
+
+# Output version string to logs
+/app/glauth --version
+
+
+echo "";
+echo "Starting GLauth now.";
+echo "";
+
+# Run app
+cd /app
+/app/glauth -c /app/config/config.cfg
+
+echo ""
+echo "GLauth has exited."
+echo "Exiting."

v2/docker/assets/start-standalone.sh

@@ -4,7 +4,8 @@
 if [ ! -f /app/config/config.cfg ] ; then
   echo "Config file not found at /app/config/config.cfg"
   echo "Copying example configuration file to run."
-  cp /app/docker/default-config.cfg /app/config/config.cfg || exit 1
+  mkdir -p /app/config
+  cp /app/docker/default-config-standalone.cfg /app/config/config.cfg || exit 1
  fi
 
 

v2/glauth.go

@@ -0,0 +1,287 @@
+package main
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/GeertJohan/yubigo"
+	"github.com/arl/statsviz"
+	docopt "github.com/docopt/docopt-go"
+	"github.com/fsnotify/fsnotify"
+	"github.com/glauth/glauth/v2/internal/monitoring"
+	_tls "github.com/glauth/glauth/v2/internal/tls"
+	"github.com/glauth/glauth/v2/internal/toml"
+	"github.com/glauth/glauth/v2/internal/tracing"
+	"github.com/glauth/glauth/v2/internal/version"
+	"github.com/glauth/glauth/v2/pkg/config"
+	"github.com/glauth/glauth/v2/pkg/frontend"
+	"github.com/glauth/glauth/v2/pkg/logging"
+	"github.com/glauth/glauth/v2/pkg/server"
+	"github.com/glauth/glauth/v2/pkg/stats"
+	"github.com/jinzhu/copier"
+
+	"github.com/rs/zerolog"
+)
+
+const programName = "glauth"
+
+var usage = `glauth: securely expose your LDAP for external auth
+
+Usage:
+  glauth [options] -c <file|s3 url>
+  glauth -h --help
+  glauth --version
+
+Options:
+  -c, --config <file>       Config file.
+  -K <aws_key_id>           AWS Key ID.
+  -S <aws_secret_key>       AWS Secret Key.
+  -r <aws_region>           AWS Region [default: us-east-1].
+  --aws_endpoint_url <url>  Custom S3 endpoint.
+  --ldap <address>          Listen address for the LDAP server.
+  --ldaps <address>         Listen address for the LDAPS server.
+  --ldaps-cert <cert-file>  Path to cert file for the LDAPS server.
+  --ldaps-key <key-file>    Path to key file for the LDAPS server.
+  --check-config            Check configuration file and exit.
+  -h, --help                Show this screen.
+  --version                 Show version.
+`
+
+var (
+	log      zerolog.Logger
+	args     map[string]interface{}
+	yubiAuth *yubigo.YubiAuth
+
+	activeConfig = &config.Config{}
+)
+
+func main() {
+
+	if err := parseArgs(); err != nil {
+		fmt.Println("Could not parse command-line arguments")
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	checkConfig := false
+	if cc, ok := args["--check-config"]; ok {
+		if cc == true {
+			checkConfig = true
+		}
+	}
+
+	cfg, err := toml.NewConfig(checkConfig, getConfigLocation(), args)
+
+	if err != nil {
+		fmt.Println("Configuration file error")
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	if checkConfig {
+		fmt.Println("Config file seems ok (but I am not checking much at this time)")
+		return
+	}
+
+	if err := copier.Copy(activeConfig, cfg); err != nil {
+		log.Info().Err(err).Msg("Could not save reloaded config. Holding on to old config")
+	}
+
+	log = logging.InitLogging(activeConfig.Debug, activeConfig.Syslog, activeConfig.StructuredLog)
+
+	if !checkConfig {
+		if cfg.Debug {
+			log.Info().Msg("Debugging enabled")
+		}
+		if cfg.Syslog {
+			log.Info().Msg("Syslog enabled")
+		}
+	}
+
+	log.Info().Msg("AP start")
+
+	startService()
+}
+
+func startService() {
+	// stats
+	stats.General.Set("version", stats.Stringer(version.Version))
+
+	// web API
+	if activeConfig.API.Enabled {
+		log.Info().Msg("Web API enabled")
+
+		if activeConfig.API.Internals {
+			statsviz.Register(
+				http.DefaultServeMux,
+				statsviz.Root("/internals"),
+				statsviz.SendFrequency(1000*time.Millisecond),
+			)
+		}
+
+		go frontend.RunAPI(
+			frontend.Logger(log),
+			frontend.Config(&activeConfig.API),
+		)
+	}
+
+	monitor := monitoring.NewMonitor(&log)
+	tracer := tracing.NewTracer(
+		tracing.NewConfig(
+			activeConfig.Tracing.Enabled,
+			activeConfig.Tracing.GRPCEndpoint,
+			activeConfig.Tracing.HTTPEndpoint,
+			&log,
+		),
+	)
+
+	startConfigWatcher()
+
+	var err error
+	var starttlsConfig *tls.Config
+	if c := activeConfig.LDAP; c.Enabled && c.TLS {
+		// TODO check if tls params are string or bytes and change config accordingly
+		starttlsConfig, err = _tls.MakeTLS([]byte(c.TLSCert), []byte(c.TLSKey), c.LegacyTLS)
+
+		if err != nil {
+			log.Warn().Err(err).Msg("unable to configure TLS for StartTLS: StartTLS won't be supported")
+		}
+	}
+
+	var ldapstlsConfig *tls.Config
+	if c := activeConfig.LDAPS; c.Enabled {
+		// TODO check if tls params are string or bytes and change config accordingly
+		ldapstlsConfig, err = _tls.MakeTLS([]byte(c.Cert), []byte(c.Key), c.LegacyTLS)
+
+		if err != nil {
+			log.Warn().Err(err).Msg("unable to configure TLS for LDAPS")
+			os.Exit(1)
+		}
+	}
+
+	s, err := server.NewServer(
+		server.Logger(log),
+		server.Config(activeConfig),
+		server.StartTLSConfig(starttlsConfig),
+		server.LDAPSTLSConfig(ldapstlsConfig),
+		server.Monitor(monitor),
+		server.Tracer(tracer),
+	)
+
+	if err != nil {
+		log.Error().Err(err).Msg("could not create server")
+		os.Exit(1)
+	}
+
+	if activeConfig.LDAP.Enabled {
+		go func() {
+			if err := s.ListenAndServe(); err != nil {
+				log.Error().Err(err).Msg("could not start LDAP server")
+				os.Exit(1)
+			}
+		}()
+	}
+
+	if activeConfig.LDAPS.Enabled {
+		go func() {
+			if err := s.ListenAndServeTLS(); err != nil {
+				log.Error().Err(err).Msg("could not start LDAPS server")
+				os.Exit(1)
+			}
+		}()
+	}
+
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+
+	// Block until we receive our signal.
+	<-c
+
+	// Doesn't block if no connections, but will otherwise wait
+	// until the timeout deadline.
+	s.Shutdown()
+
+	// Optionally, you could run srv.Shutdown in a goroutine and block on
+	// <-ctx.Done() if your application should wait for other services
+	// to finalize based on context cancellation.
+	log.Info().Msg("AP exit")
+	os.Exit(0)
+}
+
+func startConfigWatcher() {
+	configFileLocation := getConfigLocation()
+	if !activeConfig.WatchConfig || strings.HasPrefix(configFileLocation, "s3://") {
+		return
+	}
+
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		log.Error().Err(err).Msg("could not start config-watcher")
+		return
+	}
+
+	ticker := time.NewTicker(1 * time.Second)
+	go func() {
+		isChanged, isRemoved := false, false
+		for {
+			select {
+			case event := <-watcher.Events:
+				log.Info().Str("e", event.Op.String()).Msg("watcher got event")
+				if event.Op&fsnotify.Write == fsnotify.Write {
+					isChanged = true
+				} else if event.Op&fsnotify.Remove == fsnotify.Remove { // vim edit file with rename/remove
+					isChanged, isRemoved = true, true
+				} else if event.Op&fsnotify.Create == fsnotify.Create { // only when watching a directory
+					isChanged = true
+				}
+			case err := <-watcher.Errors:
+				log.Error().Err(err).Msg("watcher error")
+			case <-ticker.C:
+				// wakeup, try finding removed config
+			}
+			if _, err := os.Stat(configFileLocation); !os.IsNotExist(err) && (isRemoved || isChanged) {
+				if isRemoved {
+					log.Info().Str("file", configFileLocation).Msg("rewatching config")
+					watcher.Add(configFileLocation) // overwrite
+					isChanged, isRemoved = true, false
+				}
+				if isChanged {
+
+					cfg, err := toml.NewConfig(false, configFileLocation, args)
+
+					if err != nil {
+						log.Info().Err(err).Msg("Could not reload config. Holding on to old config")
+					} else {
+						log.Info().Msg("Config was reloaded")
+
+						if err := copier.Copy(activeConfig, cfg); err != nil {
+							log.Info().Err(err).Msg("Could not save reloaded config. Holding on to old config")
+						}
+					}
+					isChanged = false
+				}
+			}
+		}
+	}()
+
+	watcher.Add(configFileLocation)
+}
+
+func parseArgs() error {
+	var err error
+
+	if args, err = docopt.Parse(usage, nil, true, version.GetVersion(), false); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func getConfigLocation() string {
+	return args["--config"].(string)
+}

v2/glauth_test.go

@@ -0,0 +1,454 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/glauth/ldap"
+	"github.com/pquerna/otp/totp"
+)
+
+type testEnv struct {
+	checkanonymousrootDSE bool
+	checkTOTP             bool
+	checkbindUPN          bool
+	svcdn                 string
+	svcdnnogroup          string
+	otpdn                 string
+	expectedinfo          string
+	expectedaccount       string
+	scopedaccount         string
+	expectedfirstaccount  string
+	expectedgroup         string
+	checkemployeetype     string
+}
+
+func glauthBinary() string {
+	if binary := os.Getenv("GLAUTH_TEST_BINARY"); binary != "" {
+		return binary
+	}
+
+	qualified := filepath.Join("bin", runtime.GOOS+runtime.GOARCH, "glauth")
+	if _, err := os.Stat(qualified); err == nil {
+		return qualified
+	}
+
+	distribution := filepath.Join("bin", "glauth-"+runtime.GOOS+"-"+runtime.GOARCH)
+	if runtime.GOOS == "windows" {
+		distribution += ".exe"
+	}
+	if _, err := os.Stat(distribution); err == nil {
+		return distribution
+	}
+
+	return "bin/glauth"
+}
+
+func TestProperBuild(t *testing.T) {
+	info, err := os.Stat(glauthBinary())
+	if err != nil {
+		t.Fatal(err)
+	}
+	mode := uint32(info.Mode())
+	if mode&0b001001001 == 0 {
+		t.Fatalf("bad file mode: %b", mode)
+	}
+}
+
+func TestConfigBackendRejectsPasswordlessUserBinds(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := listener.Addr().(*net.TCPAddr).Port
+	listener.Close()
+
+	configPath := filepath.Join(t.TempDir(), "passwordless.cfg")
+	config := fmt.Sprintf(`debug = false
+
+[ldap]
+  enabled = true
+  listen = "127.0.0.1:%d"
+  tls = false
+
+[ldaps]
+  enabled = false
+
+[backend]
+  datastore = "config"
+  baseDN = "dc=glauth,dc=com"
+
+[behaviors]
+  LimitFailedBinds = false
+
+[[groups]]
+  name = "svc"
+  gidnumber = 5501
+
+[[users]]
+  name = "nopass"
+  uidnumber = 5001
+  primarygroup = 5501
+    [[users.capabilities]]
+    action = "search"
+    object = "*"
+`, port)
+	if err := os.WriteFile(configPath, []byte(config), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	svc := startSvc(t, fmt.Sprintf("127.0.0.1:%d", port), glauthBinary(), "-c", configPath)
+	defer stopSvc(svc)
+
+	bindDN := "cn=nopass,dc=glauth,dc=com"
+	for _, tc := range []struct {
+		name     string
+		password string
+		want     string
+	}{
+		{name: "arbitrary password", password: "definitely-wrong", want: "exit status 49"},
+		{name: "empty password", password: "", want: "exit status 53"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := runAndSelect(t, getFirst, "ldapsearch", "-LLL", "-H", fmt.Sprintf("ldap://127.0.0.1:%d", port), "-D", bindDN, "-w", tc.password, "-x", "-b", "dc=glauth,dc=com", "(cn=nopass)")
+			if got != tc.want {
+				t.Fatalf("bind result = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func ldapOnlyConfig(t *testing.T, source string) string {
+	t.Helper()
+	data, err := os.ReadFile(source)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	contents := string(data)
+	sectionMarker := "\n[ldaps]\n"
+	markerStart := strings.Index(contents, sectionMarker)
+	if markerStart < 0 {
+		t.Fatalf("%s has no [ldaps] section", source)
+	}
+	start := markerStart + 1
+	relEnd := strings.Index(contents[start+len("[ldaps]"):], "\n[")
+	if relEnd < 0 {
+		t.Fatalf("%s has no section after [ldaps]", source)
+	}
+	end := start + len("[ldaps]") + relEnd
+	section := contents[start:end]
+	sectionWithoutLDAPS := strings.Replace(section, "enabled = true", "enabled = false", 1)
+	if section == sectionWithoutLDAPS {
+		t.Fatalf("%s [ldaps] section does not enable LDAPS", source)
+	}
+
+	contents = contents[:start] + sectionWithoutLDAPS + contents[end:]
+	path := filepath.Join(t.TempDir(), filepath.Base(source))
+	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func batteryOfTests(t *testing.T, env *testEnv) {
+	// We aren't checking that "github.com/pquerna/otp/totp" creates correct values.
+	// That's what their own tests are for.
+	// We are checking that the totp code gets through glauth code successfully
+	otpvalue, err := totp.GenerateCode("3hnvnk4ycv44glzigd6s25j4dougs3rk", time.Now())
+	if err != nil {
+		t.Fatal("Failed to generate totp code:", err)
+	}
+
+	const addr = "ldap://127.0.0.1:3893"
+	bind := func(dn, password string, rest ...string) []string {
+		return append([]string{"-LLL", "-H", addr, "-D", dn, "-w", password, "-x"}, rest...)
+	}
+	svc := func(rest ...string) []string { return bind(env.svcdn, "mysecret", rest...) }
+	otp := func(password string) []string {
+		return bind(env.otpdn, password, "-bou=superheros,dc=glauth,dc=com", "cn=hackers")
+	}
+
+	const (
+		inSuperheros = "should find them in the 'superheros' group"
+		listFromUser = "should get a list starting with the 'hackers' user"
+		badCreds     = "should get 'Invalid credentials(49)'"
+	)
+
+	tests := []struct {
+		name string
+		skip bool
+		args []string
+		line func(string) string
+		want string
+		msg  string
+	}{
+		{
+			name: "searching for the 'hackers' user",
+			args: svc("-bdc=glauth,dc=com", "cn=hackers"),
+			want: env.expectedaccount,
+			msg:  inSuperheros,
+		},
+		{
+			name: "searching for the 'hackers' user without binding with a group",
+			skip: env.svcdnnogroup == "",
+			args: bind(env.svcdnnogroup, "mysecret", "-bdc=glauth,dc=com", "cn=hackers"),
+			want: env.expectedaccount,
+			msg:  inSuperheros,
+		},
+		{
+			name: "searching for the 'hackers' user after binding using the account's UPN",
+			skip: !env.checkbindUPN,
+			args: bind("serviceuser@example.com", "mysecret", "-bdc=glauth,dc=com", "cn=hackers"),
+			want: env.expectedaccount,
+			msg:  inSuperheros,
+		},
+		{
+			name: "querying the root SDE",
+			args: svc("-s", "base", "(objectclass=*)"),
+			line: getSecond,
+			want: env.expectedinfo,
+			msg:  "should get some meta information",
+		},
+		{
+			name: "querying the root SDE anonymously without authorizing in config file",
+			skip: !env.checkanonymousrootDSE,
+			args: []string{"-LLL", "-H", addr, "-x", "-s", "base", "(objectclass=*)"},
+			want: "exit status 50",
+			msg:  "should get error 50",
+		},
+		{
+			name: "enumerating posix groups",
+			args: svc("-bdc=glauth,dc=com", "(objectclass=posixgroup)"),
+			want: env.expectedgroup,
+			msg:  "should get a list starting with the 'superheros' group",
+		},
+		{
+			name: "searching for members of the 'superheros' group",
+			args: svc("-bdc=glauth,dc=com", "(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com)"),
+			want: env.expectedfirstaccount,
+			msg:  listFromUser,
+		},
+		{
+			name: "performing a complex search for members of 'superheros' group",
+			args: svc("-bdc=glauth,dc=com", "(&(objectClass=*)(memberOf=ou=superheros,ou=groups,dc=glauth,dc=com))"),
+			want: env.expectedfirstaccount,
+			msg:  listFromUser,
+		},
+		{
+			name: "searching for the 'hacker' user using a TOTP-enabled account",
+			skip: !env.checkTOTP,
+			args: otp("mysecret" + otpvalue),
+			want: env.scopedaccount,
+			msg:  inSuperheros,
+		},
+		{
+			name: "searching for the 'hacker' user using a TOTP-enabled account and no value",
+			skip: !env.checkTOTP,
+			args: otp("mysecret"),
+			want: "exit status 49",
+			msg:  badCreds,
+		},
+		{
+			name: "searching for the 'hacker' user using a TOTP-enabled account and the wrong value",
+			skip: !env.checkTOTP,
+			args: otp("mysecret123456"),
+			want: "exit status 49",
+			msg:  badCreds,
+		},
+		{
+			name: "searching for the 'hacker' user",
+			skip: env.checkemployeetype == "",
+			args: svc("-bdc=glauth,dc=com", env.checkemployeetype, "employeetype"),
+			line: getSecond,
+			want: "employeetype: Intern",
+			msg:  "type should be 'Intern'",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.skip {
+				t.SkipNow()
+			}
+			line := tc.line
+			if line == nil {
+				line = getFirst
+			}
+			if got := runAndSelect(t, line, "ldapsearch", tc.args...); got != tc.want {
+				t.Fatalf("%s\ngot:  %s\nwant: %s", tc.msg, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestSampleSimple(t *testing.T) {
+	env := testEnv{
+		checkanonymousrootDSE: true,
+		checkTOTP:             true,
+		checkbindUPN:          true,
+		expectedinfo:          "supportedLDAPVersion: 3",
+		svcdn:                 "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com",
+		svcdnnogroup:          "cn=serviceuser,dc=glauth,dc=com",
+		otpdn:                 "cn=otpuser,ou=superheros,dc=glauth,dc=com",
+		expectedaccount:       "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com",
+		scopedaccount:         "dn: cn=hackers,ou=superheros,dc=glauth,dc=com",
+		expectedfirstaccount:  "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com",
+		expectedgroup:         "dn: ou=superheros,ou=users,dc=glauth,dc=com",
+		checkemployeetype:     "cn=hackers",
+	}
+
+	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", ldapOnlyConfig(t, "sample-simple.cfg"))
+	batteryOfTests(t, &env)
+	stopSvc(svc)
+}
+
+func TestSQLitePlugin(t *testing.T) {
+	_, err := os.Stat("bin/sqlite.so")
+	if err != nil {
+		t.Log("Unable to find sqlite plugin")
+		t.SkipNow()
+	}
+
+	env := testEnv{
+		checkanonymousrootDSE: true,
+		checkTOTP:             false,
+		checkbindUPN:          true,
+		expectedinfo:          "supportedLDAPVersion: 3",
+		svcdn:                 "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com",
+		svcdnnogroup:          "cn=serviceuser,dc=glauth,dc=com",
+		otpdn:                 "cn=otpuser,ou=superheros,dc=glauth,dc=com",
+		expectedaccount:       "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com",
+		scopedaccount:         "dn: cn=hackers,ou=superheros,dc=glauth,dc=com",
+		expectedfirstaccount:  "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com",
+		expectedgroup:         "dn: ou=superheros,ou=users,dc=glauth,dc=com",
+		checkemployeetype:     "",
+	}
+
+	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", "pkg/plugins/glauth-sqlite/sample-database.cfg")
+	batteryOfTests(t, &env)
+	stopSvc(svc)
+}
+
+func TestLdapInjection(t *testing.T) {
+	out, err := doRun("sh", "-c", "docker ps | grep ldap-service | wc -l")
+	if err != nil {
+		t.Log("Unable to find docker container:", out)
+		t.SkipNow()
+	}
+	matchingContainers := getFirst(out)
+	if matchingContainers != "1" {
+		t.Log("Unable to find docker container:", out)
+		t.SkipNow()
+	}
+
+	env := testEnv{
+		checkanonymousrootDSE: false,
+		checkTOTP:             true,
+		checkbindUPN:          false,
+		expectedinfo:          "objectClass: top",
+		svcdn:                 "cn=serviceuser,cn=svcaccts,ou=users,dc=glauth,dc=com",
+		svcdnnogroup:          "", // ignore
+		otpdn:                 "cn=otpuser,cn=superheros,ou=users,dc=glauth,dc=com",
+		expectedaccount:       "dn: cn=hackers,cn=superheros,ou=users,dc=glauth,dc=com",
+		scopedaccount:         "dn: cn=hackers,cn=superheros,ou=users,dc=glauth,dc=com",
+		expectedfirstaccount:  "dn: cn=johndoe,cn=superheros,ou=users,dc=glauth,dc=com",
+		expectedgroup:         "dn: ou=superheros,ou=users,dc=glauth,dc=com",
+		checkemployeetype:     "",
+	}
+
+	svc := startSvc(t, "127.0.0.1:3893", glauthBinary(), "-c", "sample-ldap-injection.cfg")
+	batteryOfTests(t, &env)
+	stopSvc(svc)
+}
+
+// -----=============================================================================----
+func waitForPort(host string, timeout time.Duration) error {
+	start := time.Now()
+	for {
+		conn, err := ldap.Dial("tcp", host)
+		if err == nil {
+			err = conn.Bind("_", "_")
+			if err == nil {
+				conn.Close()
+				return fmt.Errorf("Successfully authenticated to glauth. This should not happen")
+			}
+			e := &ldap.Error{}
+			if errors.As(err, &e) && e.ResultCode == 49 {
+				conn.Close()
+				return nil
+			}
+			conn.Close()
+			// We have an error, it's probably a connection error or an error saying that ldap isn't setup yet
+			// try again
+		}
+		if time.Since(start) > timeout {
+			return fmt.Errorf("timeout waiting for port %s: %w", host, err)
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+}
+
+func startSvc(t *testing.T, addr string, name string, arg ...string) *exec.Cmd {
+	cmd := exec.Command(name, arg...)
+	cmd.Stderr = t.Output()
+	cmd.Stdout = t.Output()
+	if err := cmd.Start(); err != nil {
+		t.Fatal("Failed to start glauth:", err)
+	}
+	if err := waitForPort(addr, time.Second*2); err != nil {
+		t.Fatal("Failed to wait for glauth to start:", err)
+	}
+	// the port is listening but the ldap server may not be accepting connections yet
+	// TODO: make glauth listen as the last part of the initialization that way as soon as it listens it can process connections
+	return cmd
+}
+
+func stopSvc(svc *exec.Cmd) {
+	svc.Process.Kill()
+	svc.Process.Wait()
+}
+
+func getFirst(output string) string {
+	out := strings.SplitN(output, "\n", 2)
+	if len(out) < 1 {
+		return "*fail*"
+	}
+	return out[0]
+}
+
+func getSecond(output string) string {
+	out := strings.SplitN(output, "\n", 3)
+	if len(out) < 2 {
+		return "*fail*"
+	}
+	return out[1]
+}
+
+func doRun(name string, arg ...string) (string, error) {
+	out, err := exec.Command(name, arg...).CombinedOutput()
+	if err != nil {
+		return string(bytes.TrimSpace(out)), err
+	}
+
+	return string(bytes.TrimSpace(out)), nil
+}
+
+func runAndSelect(t testing.TB, pick func(string) string, name string, arg ...string) string {
+	t.Helper()
+	out, err := doRun(name, arg...)
+	if err != nil {
+		t.Log(out)
+		return err.Error()
+	}
+	return pick(out)
+}

v2/go.mod

@@ -0,0 +1,62 @@
+module github.com/glauth/glauth/v2
+
+go 1.25.0
+
+require (
+	github.com/BurntSushi/toml v1.3.2
+	github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e
+	github.com/arl/statsviz v0.6.0
+	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
+	github.com/fsnotify/fsnotify v1.7.0
+	github.com/glauth/ldap v0.0.0-20240419171521-1f14f5c1b4ad
+	github.com/jinzhu/copier v0.4.0
+	github.com/pquerna/otp v1.4.0
+	github.com/prometheus/client_golang v1.18.0
+	github.com/prometheus/client_model v0.5.0
+	github.com/rs/zerolog v1.31.0
+	github.com/uptrace/opentelemetry-go-extra/otelsql v0.2.3
+	github.com/yaegashi/msgraph.go v0.1.4
+	go.opentelemetry.io/contrib/propagators/jaeger v1.46.0
+	go.opentelemetry.io/otel v1.46.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0
+	go.opentelemetry.io/otel/sdk v1.46.0
+	go.opentelemetry.io/otel/trace v1.46.0
+	go.uber.org/mock v0.4.0
+	golang.org/x/crypto v0.55.0
+	gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/rickb777/date v1.12.4 // indirect
+	github.com/rickb777/plural v1.2.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
+	google.golang.org/grpc v1.83.1 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+)

v2/go.sum

@@ -0,0 +1,261 @@
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e h1:Bqtt5C+uVk+vH/t5dmB47uDCTwxw16EYHqvJnmY2aQc=
+github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e/go.mod h1:njRCDrl+1RQ/A/+KVU8Ho2EWAxUSkohOWczdW3dzDG0=
+github.com/arl/statsviz v0.6.0 h1:jbW1QJkEYQkufd//4NDYRSNBpwJNrdzPahF7ZmoGdyE=
+github.com/arl/statsviz v0.6.0/go.mod h1:0toboo+YGSUXDaS4g1D5TVS4dXs7S7YYT5J/qnW2h8s=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
+github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/glauth/ldap v0.0.0-20240419171521-1f14f5c1b4ad h1:2ERGXiofR9ISXg4evamCngs2EeuMhVJRuDwWGa6bS6s=
+github.com/glauth/ldap v0.0.0-20240419171521-1f14f5c1b4ad/go.mod h1:5ueZMujvJ5nuYPyBj6uQTPV4R1YshboRa/osaP4Emfs=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
+github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
+github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
+github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/rickb777/date v1.12.4 h1:+6IzcCCS/1t17DrmnEvrznyq7nM8vPwir6/UhlyohKw=
+github.com/rickb777/date v1.12.4/go.mod h1:xP0eo/I5qmUt97yRGClHZfyLZ3ikMw6v6SU5MOGZTE0=
+github.com/rickb777/plural v1.2.0 h1:5tvEc7UBCZ7l8h/2UeybSkt/uu1DQsZFOFdNevmUhlE=
+github.com/rickb777/plural v1.2.0/go.mod h1:UdpyWFCGbo3mvK3f/PfZOAOrkjzJlYN/sD46XNWJ+Es=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.31.0 h1:FcTR3NnLWW+NnTwwhFWiJSZr4ECLpqCm6QsEnyvbV4A=
+github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/uptrace/opentelemetry-go-extra/otelsql v0.2.3 h1:LNi0Qa7869/loPjz2kmMvp/jwZZnMZ9scMJKhDJ1DIo=
+github.com/uptrace/opentelemetry-go-extra/otelsql v0.2.3/go.mod h1:jyigonKik3C5V895QNiAGpKYKEvFuqjw9qAEZks1mUg=
+github.com/yaegashi/msgraph.go v0.1.4 h1:leDXSczAbwBpYFSmmZrdByTiPoUw8dbTfNMetAjJvbw=
+github.com/yaegashi/msgraph.go v0.1.4/go.mod h1:vgeYhHa5skJt/3lTyjGXThTZhwbhRnGo6uUxzoJIGME=
+github.com/yaegashi/wtz.go v0.0.2/go.mod h1:nOLA5QXsmdkRxBkP5tljhua13ADHCKirLBrzPf4PEJc=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/propagators/jaeger v1.21.1 h1:f4beMGDKiVzg9IcX7/VuWVy+oGdjx3dNJ72YehmtY5k=
+go.opentelemetry.io/contrib/propagators/jaeger v1.21.1/go.mod h1:U9jhkEl8d1LL+QXY7q3kneJWJugiN3kZJV2OWz3hkBY=
+go.opentelemetry.io/contrib/propagators/jaeger v1.46.0 h1:uxl0SGcmuBkHj/Adl9oftEAyiawQBPL5RzMAmt/Yvq4=
+go.opentelemetry.io/contrib/propagators/jaeger v1.46.0/go.mod h1:LiOkxCIvoLofmRps7f8l0NkBtmObnAyQ5trteFs6wj8=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 h1:OFnwLJr+pF3iHrlGSzbxyuo6/6HyBlnlN1CWEJmBVcw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0/go.mod h1:716wFneO0ov19A2beH5hjfh9AK5z/VWNAtDijp1Y0/g=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 h1:w53CDeOA/Kurp7yRsegSr6pbbr759dOvJ+yNmWM6Hxs=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0/go.mod h1:BOmGMCbAtvcJiSJ+hLuhgPLdDbimnraSl8irz3iY8sY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 h1:digkEZCJWobwBqMwC0cwCq8/wkkRy/OowZg5OArWZrM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0/go.mod h1:/OpE/y70qVkndM0TrxT4KBoN3RsFZP0QaofcfYrj76I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 h1:lgh3PiVrRUWMLOVSkQicxzZll5NjF1r+AtsX1XRIHw0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0/go.mod h1:5Cnhth3m/AgOeTgE3ex12pPmiu/gGtZit03kSzx9X7s=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 h1:KrC1YrQeSt46ITMWAbgQx1M1eV1/1TKzttrBzymPmss=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0/go.mod h1:zDSEzoEqsOrgBeGvH66KRgxh90VonFyJqBHA0Pk3+rM=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0 h1:VhlEQAPp9R1ktYfrPk5SOryw1e9LDDTZCbIPFrho0ec=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0/go.mod h1:kB3ufRbfU+CQ4MlUcqtW8Z7YEOBeK2DJ6CmR5rYYF3E=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 h1:bl2S7Ubua0Nms+D/gAmznQTd4dxxMA93aKbcpKqiTCs=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0/go.mod h1:L0hRV50XdVIODHUfWEqGRCXQvj2rV82STVo12FMFBU0=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0 h1:KdRxPiAoMptR3vfWzvjjvutTsSiwbC2uG0496rzZNfo=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.46.0/go.mod h1:K/qSA+3G7Eovxi4K09wzrAgkWRnosS0DAOZeEpve7sM=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
+go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200529172331-a64b76657301/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200731060945-b5fad4ed8dd6/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d h1:VBu5YqKPv6XiJ199exd8Br+Aetz+o08F+PLMnwJQHAY=
+google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4=
+google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d h1:DoPTO70H+bcDXcd39vOqb2viZxgqeBeSGtZ55yZU4/Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI=
+google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b h1:tdSyAzD5FHJmZAZ13d5WexAo7YJkiyGphhzFfInMnDw=
+gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b/go.mod h1:cE0dCGx2UfBTjLFlzEx4EXJUmoX6BXBoX9GjKOvqha4=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

v2/internal/monitoring/handlers.go

@@ -0,0 +1,28 @@
+package monitoring
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"github.com/rs/zerolog"
+)
+
+type API struct {
+	logger zerolog.Logger
+}
+
+func (a *API) RegisterEndpoints(router *http.ServeMux) {
+	router.HandleFunc("/metrics", a.prometheusHTTP)
+}
+
+func (a *API) prometheusHTTP(w http.ResponseWriter, r *http.Request) {
+	promhttp.Handler().ServeHTTP(w, r)
+}
+
+func NewAPI(logger zerolog.Logger) *API {
+	a := new(API)
+
+	a.logger = logger
+
+	return a
+}

v2/internal/monitoring/interfaces.go

@@ -0,0 +1,13 @@
+package monitoring
+
+import "github.com/glauth/ldap"
+
+type MonitorInterface interface {
+	SetResponseTimeMetric(map[string]string, float64) error
+	SetLDAPMetric(map[string]string, float64) error
+}
+
+type LDAPServerInterface interface {
+	SetStats(bool)
+	GetStats() ldap.Stats
+}

v2/internal/monitoring/ldap.go

@@ -0,0 +1,58 @@
+package monitoring
+
+import (
+	"time"
+
+	"github.com/rs/zerolog"
+)
+
+type LDAPMonitorWatcher struct {
+	syncTicker *time.Ticker
+
+	ldap LDAPServerInterface
+
+	monitor MonitorInterface
+	logger  *zerolog.Logger
+}
+
+func (m *LDAPMonitorWatcher) sync() {
+	for {
+		select {
+		case tick := <-m.syncTicker.C:
+			m.logger.Debug().Time("value", tick).Msg("Tick")
+			m.storeMetrics()
+		}
+	}
+}
+
+func (m *LDAPMonitorWatcher) storeMetrics() {
+	stats := m.ldap.GetStats()
+
+	if err := m.monitor.SetLDAPMetric(map[string]string{"type": "conns"}, float64(stats.Conns)); err != nil {
+		m.logger.Error().Err(err).Msg("failed to set metric")
+	}
+	if err := m.monitor.SetLDAPMetric(map[string]string{"type": "binds"}, float64(stats.Binds)); err != nil {
+		m.logger.Error().Err(err).Msg("failed to set metric")
+	}
+	if err := m.monitor.SetLDAPMetric(map[string]string{"type": "unbinds"}, float64(stats.Unbinds)); err != nil {
+		m.logger.Error().Err(err).Msg("failed to set metric")
+	}
+	if err := m.monitor.SetLDAPMetric(map[string]string{"type": "searches"}, float64(stats.Searches)); err != nil {
+		m.logger.Error().Err(err).Msg("failed to set metric")
+	}
+}
+
+func NewLDAPMonitorWatcher(ldap LDAPServerInterface, monitor MonitorInterface, logger *zerolog.Logger) *LDAPMonitorWatcher {
+	m := new(LDAPMonitorWatcher)
+
+	m.syncTicker = time.NewTicker(15 * time.Second)
+	m.ldap = ldap
+	m.monitor = monitor
+	m.logger = logger
+
+	m.ldap.SetStats(true)
+
+	go m.sync()
+
+	return m
+}

v2/internal/monitoring/ldap_test.go

@@ -0,0 +1,36 @@
+package monitoring
+
+import (
+	"testing"
+	"time"
+
+	"github.com/glauth/ldap"
+	"github.com/rs/zerolog"
+	"go.uber.org/mock/gomock"
+)
+
+//go:generate mockgen -build_flags=--mod=mod -package monitoring -destination ./mock_interfaces.go -source=./interfaces.go
+
+func TestNewLDAPMonitorWatcherRunsOnASchedule(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockMonitor := NewMockMonitorInterface(ctrl)
+	mockLDAPServer := NewMockLDAPServerInterface(ctrl)
+
+	stats := ldap.Stats{}
+
+	mockLDAPServer.EXPECT().SetStats(true).Times(1)
+	mockLDAPServer.EXPECT().GetStats().MinTimes(1).Return(stats)
+	mockMonitor.EXPECT().SetLDAPMetric(map[string]string{"type": "conns"}, float64(0)).MinTimes(1)
+	mockMonitor.EXPECT().SetLDAPMetric(map[string]string{"type": "binds"}, float64(0)).MinTimes(1)
+	mockMonitor.EXPECT().SetLDAPMetric(map[string]string{"type": "unbinds"}, float64(0)).MinTimes(1)
+	mockMonitor.EXPECT().SetLDAPMetric(map[string]string{"type": "searches"}, float64(0)).MinTimes(1)
+
+	logger := zerolog.Nop()
+	m := NewLDAPMonitorWatcher(mockLDAPServer, mockMonitor, &logger)
+
+	m.syncTicker = time.NewTicker(5 * time.Microsecond)
+
+	// allow goroutine to start and ticker to tick
+	time.Sleep(10 * time.Millisecond)
+}

v2/internal/monitoring/v0.go

@@ -0,0 +1,139 @@
+package monitoring
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// The code below liberally borrows from https://github.com/albertito/prometheus-expvar-exporter
+// and is adapted (just a little) for our purpose.
+
+type Collector struct {
+	url       string
+	names     map[string]string
+	helps     map[string]string
+	labelName map[string]string
+}
+
+func (c *Collector) Describe(ch chan<- *prometheus.Desc) {
+	return
+}
+
+func (c *Collector) Collect(ch chan<- prometheus.Metric) {
+	resp, err := http.Get(c.url)
+	if err != nil {
+		log.Printf("Error scraping %q: %v", c.url, err)
+		return
+	}
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		log.Printf("Error reading body of %q: %v", c.url, err)
+		return
+	}
+
+	// Replace "\xNN" with "?" because the default parser doesn't handle them
+	// well.
+	re := regexp.MustCompile(`\\x..`)
+	body = re.ReplaceAllFunc(body, func(s []byte) []byte {
+		return []byte("?")
+	})
+
+	var vs map[string]interface{}
+	err = json.Unmarshal(body, &vs)
+	if err != nil {
+		log.Printf("Error unmarshalling json from %q: %v", c.url, err)
+		return
+	}
+
+	for k, v := range vs {
+		name := strings.ReplaceAll(k, "/", "_")
+		if n, ok := c.names[k]; ok {
+			name = n
+		}
+
+		help := fmt.Sprintf("expvar %q", k)
+		if h, ok := c.helps[k]; ok {
+			help = h
+		}
+
+		lnames := []string{}
+		if ln, ok := c.labelName[k]; ok {
+			lnames = append(lnames, ln)
+		}
+
+		desc := prometheus.NewDesc(name, help, lnames, nil)
+
+		switch v := v.(type) {
+		case float64:
+			ch <- prometheus.MustNewConstMetric(desc, prometheus.UntypedValue, v)
+		case bool:
+			ch <- prometheus.MustNewConstMetric(desc, prometheus.UntypedValue,
+				valToFloat(v))
+		case map[string]interface{}:
+			// We only support explicitly written label names.
+			if len(lnames) != 1 {
+				continue
+			}
+			for lk, lv := range v {
+				ch <- prometheus.MustNewConstMetric(desc, prometheus.UntypedValue,
+					valToFloat(lv), lk)
+			}
+		case string:
+			// Not supported by Prometheus.
+			continue
+		case []interface{}:
+			// Not supported by Prometheus.
+			continue
+		default:
+			continue
+		}
+	}
+}
+
+func NewCollector(url string) *Collector {
+	c := new(Collector)
+	c.url = url
+	c.names = map[string]string{
+		"proxy":          "glauth_proxy",
+		"proxy_frontend": "glauth_proxy_frontend",
+		"proxy_backend":  "glauth_proxy_backend",
+	}
+	c.helps = map[string]string{
+		"proxy":          "General Metrics",
+		"proxy_frontend": "Frontend Metrics",
+		"proxy_backend":  "Backend Metrics",
+	}
+	c.labelName = map[string]string{
+		"proxy":          "metric",
+		"proxy_frontend": "metric",
+		"proxy_backend":  "metric",
+	}
+
+	prometheus.MustRegister(c)
+
+	return c
+}
+
+func valToFloat(v interface{}) float64 {
+	switch v := v.(type) {
+	case float64:
+		return v
+	case bool:
+		if v {
+			return 1.0
+		}
+		return 0.0
+	case string:
+		return 0.0
+	}
+	log.Printf("unexpected value type: %#v", v)
+	return 0.0
+}

v2/internal/monitoring/v1.go

@@ -0,0 +1,109 @@
+package monitoring
+
+import (
+	"fmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/rs/zerolog"
+)
+
+type Monitor struct {
+	responseTime *prometheus.HistogramVec
+	ldapMetric   *prometheus.GaugeVec
+
+	logger *zerolog.Logger
+}
+
+func (m *Monitor) SetResponseTimeMetric(tags map[string]string, value float64) error {
+	if m.responseTime == nil {
+		return fmt.Errorf("metric not instantiated")
+	}
+
+	m.responseTime.With(tags).Observe(value)
+
+	return nil
+}
+
+func (m *Monitor) SetLDAPMetric(tags map[string]string, value float64) error {
+	if m.ldapMetric == nil {
+		return fmt.Errorf("metric not instantiated")
+	}
+
+	m.ldapMetric.With(tags).Set(value)
+
+	return nil
+}
+
+func (m *Monitor) constLabels() map[string]string {
+	return map[string]string{
+		"library": "github.com/glauth/glauth",
+	}
+
+}
+
+func (m *Monitor) registerHistograms() {
+	histograms := make([]*prometheus.HistogramVec, 0)
+
+	m.responseTime = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name:        "tcp_response_time_seconds",
+			Help:        "tcp_response_time_seconds",
+			ConstLabels: m.constLabels(),
+		},
+		[]string{"operation", "status"},
+	)
+
+	histograms = append(histograms, m.responseTime)
+
+	for _, histogram := range histograms {
+		err := prometheus.Register(histogram)
+
+		switch err.(type) {
+		case nil:
+			return
+		case prometheus.AlreadyRegisteredError:
+			m.logger.Debug().Interface("metric", histogram).Msg("metric already registered")
+		default:
+			m.logger.Error().Interface("metric", histogram).Msg("metric could not be registered")
+		}
+	}
+}
+
+func (m *Monitor) registerGauges() {
+	gauges := make([]*prometheus.GaugeVec, 0)
+
+	m.ldapMetric = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Name:        "ldap_metric",
+			Help:        "ldap_metric",
+			ConstLabels: m.constLabels(),
+		},
+		[]string{"type"},
+	)
+
+	gauges = append(gauges, m.ldapMetric)
+
+	for _, gauge := range gauges {
+		err := prometheus.Register(gauge)
+
+		switch err.(type) {
+		case nil:
+			return
+		case prometheus.AlreadyRegisteredError:
+			m.logger.Debug().Interface("metric", gauge).Msg("metric already registered")
+		default:
+			m.logger.Error().Interface("metric", gauge).Msg("metric could not be registered")
+		}
+	}
+}
+
+func NewMonitor(logger *zerolog.Logger) *Monitor {
+	m := new(Monitor)
+
+	m.logger = logger
+
+	m.registerHistograms()
+	m.registerGauges()
+
+	return m
+}

v2/internal/monitoring/v1_test.go

@@ -0,0 +1,62 @@
+package monitoring
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/rs/zerolog"
+)
+
+func TestNewMonitorImplementsInterface(t *testing.T) {
+	logger := zerolog.Nop()
+	m := NewMonitor(&logger)
+
+	i := reflect.TypeOf((*MonitorInterface)(nil)).Elem()
+
+	if !reflect.TypeOf(m).Implements(i) {
+		t.Fatal("Monitor doesn't implement MonitorInterface")
+	}
+}
+
+func TestMonitorSetLDAPMetricSucceeds(t *testing.T) {
+	logger := zerolog.Nop()
+	m := NewMonitor(&logger)
+
+	labels := map[string]string{"type": "test"}
+	m.SetLDAPMetric(labels, float64(10))
+
+	mLDAPMetric := dto.Metric{}
+	m.ldapMetric.With(labels).Write(&mLDAPMetric)
+
+	if mLDAPMetric.GetGauge().GetValue() != float64(10) {
+		t.Fatalf("metric value should have been set to %v", float64(10))
+	}
+}
+
+func TestMonitorSetResponseTimeMetricSucceeds(t *testing.T) {
+	logger := zerolog.Nop()
+	m := NewMonitor(&logger)
+
+	labels := map[string]string{"operation": "test", "status": "0"}
+	m.SetResponseTimeMetric(labels, float64(10))
+
+	mResponseTimeMetric := dto.Metric{}
+	m.responseTime.With(labels).(prometheus.Metric).Write(&mResponseTimeMetric)
+
+	if mResponseTimeMetric.GetHistogram().GetSampleSum() != float64(10) {
+		t.Fatalf("metric value should have been set to %v", float64(10))
+	}
+
+	for _, bucket := range mResponseTimeMetric.GetHistogram().GetBucket() {
+		if bucket.GetUpperBound() < float64(10) && bucket.GetCumulativeCount() != 0 {
+			t.Fatal("there should be no count for this metric bucket")
+		}
+
+		if bucket.GetUpperBound() >= float64(10) && bucket.GetCumulativeCount() != 1 {
+			t.Fatal("there should be one entry into this metric bucket")
+		}
+
+	}
+}

v2/internal/tls/tls.go

@@ -0,0 +1,123 @@
+package tls
+
+import (
+	tls "crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+
+	"github.com/rs/zerolog"
+)
+
+var (
+	log zerolog.Logger
+)
+
+var secureCipherSuites = []uint16{
+	// TLS 1.3 cipher suites (automatically used when TLS 1.3 is negotiated)
+	tls.TLS_AES_128_GCM_SHA256,
+	tls.TLS_AES_256_GCM_SHA384,
+	tls.TLS_CHACHA20_POLY1305_SHA256,
+
+	// TLS 1.2 ECDHE cipher suites (Forward Secrecy)
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+	tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+
+	// Additional secure TLS 1.2 cipher suites (CBC with HMAC-SHA256)
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+	// 	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+	// tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+}
+
+// MakeTLS generates a tls.Config
+func MakeTLS(clientCert, key []byte, legacy bool) (*tls.Config, error) {
+	if clientCert == nil && key == nil {
+		return new(tls.Config), nil
+	}
+
+	var err error
+
+	cert, err := tls.X509KeyPair(clientCert, key)
+
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debug().Str("key", string(key))
+	log.Debug().Str("client.certificate", string(clientCert))
+	log.Debug().Interface("certificate", cert)
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Get the SystemCertPool, continue with an empty pool on error
+	rootCAs, err := x509.SystemCertPool()
+
+	if rootCAs == nil {
+		rootCAs = x509.NewCertPool()
+		log.Warn().Err(err).Msg("Using empty cert-pool")
+	} else {
+		log.Info().Msg("Using system cert-pool")
+	}
+
+	for _, cert := range DecodePEM(clientCert).Certificate {
+		x509Cert, err := x509.ParseCertificate(cert)
+		if err != nil {
+			log.Error().Err(err).Msg("issue parsing cert PEM")
+		}
+		rootCAs.AddCert(x509Cert)
+	}
+
+	log.Debug().Interface("root.ca", rootCAs)
+	log.Debug().Interface("certificates", []tls.Certificate{cert})
+
+	if legacy {
+		return &tls.Config{
+			RootCAs:                  rootCAs,
+			MinVersion:               tls.VersionTLS10,
+			MaxVersion:               tls.VersionTLS13,
+			PreferServerCipherSuites: true,
+			CipherSuites:             nil,
+			Certificates:             []tls.Certificate{cert},
+		}, nil
+	}
+
+	return &tls.Config{
+		RootCAs:                  rootCAs,
+		MinVersion:               tls.VersionTLS12,
+		MaxVersion:               tls.VersionTLS13,
+		PreferServerCipherSuites: true,
+		CipherSuites:             secureCipherSuites,
+		Certificates:             []tls.Certificate{cert},
+	}, nil
+}
+
+// DecodePEM builds a PEM certificate object
+func DecodePEM(certPEM []byte) tls.Certificate {
+	var cert tls.Certificate
+	var certDER *pem.Block
+	for {
+		certDER, certPEM = pem.Decode(certPEM)
+		if certDER == nil {
+			break
+		}
+		if certDER.Type == "CERTIFICATE" {
+			cert.Certificate = append(cert.Certificate, certDER.Bytes)
+		}
+	}
+
+	return cert
+}
+
+func CipherSuiteNames(suites []uint16) []string {
+	var names []string
+	for _, suite := range suites {
+		names = append(names, tls.CipherSuiteName(suite))
+	}
+	return names
+}

v2/internal/toml/config.go

@@ -0,0 +1,491 @@
+package toml
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+
+	"github.com/BurntSushi/toml"
+	"github.com/GeertJohan/yubigo"
+	"github.com/glauth/glauth/v2/pkg/config"
+	"github.com/rs/zerolog/log"
+	"gopkg.in/amz.v3/aws"
+	"gopkg.in/amz.v3/s3"
+)
+
+type Config struct {
+	Users []toml.Primitive
+}
+
+type User struct {
+	Name             string
+	CustomAttributes []toml.Primitive
+}
+
+// NewConfig reads the cli flags and config file
+func NewConfig(checkConfig bool, location string, args map[string]interface{}) (*config.Config, error) {
+	// Parse config-file into config{} struct
+	cfg, err := parseConfigFile(location, args)
+	if err != nil {
+		return nil, err
+	}
+
+	// Handle parsed flags
+	cfg, err = handleArgs(cfg, args)
+	if err != nil {
+		return nil, err
+	}
+
+	// Handle parsing of legacy [frontend] section into [ldap] and/or [ldaps] sections
+	cfg, err = handleLegacyConfig(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	cfg, err = validateConfig(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	// TODO @shipperizer reinstate this
+	// // Before greenlighting new config entirely, lets make sure the yubiauth works - in case they changed
+
+	if _, err := yubigo.NewYubiAuth(cfg.YubikeyClientID, cfg.YubikeySecret); err != nil && len(cfg.YubikeyClientID) > 0 && len(cfg.YubikeySecret) > 0 {
+		return nil, err
+	}
+
+	return cfg, nil
+}
+
+func parseConfigFile(configFileLocation string, args map[string]interface{}) (*config.Config, error) {
+	cfg := new(config.Config)
+	// setup defaults
+	cfg.LDAP.Enabled = false
+	cfg.LDAPS.Enabled = true
+
+	// parse the config file
+	if strings.HasPrefix(configFileLocation, "s3://") {
+		region, present := aws.Regions[args["-r"].(string)]
+		if !present {
+			return cfg, fmt.Errorf("invalid AWS region: %s", args["-r"])
+		}
+		if args["--aws_endpoint_url"] != nil {
+			region = aws.Region{
+				Name:       "User defined",
+				S3Endpoint: args["--aws_endpoint_url"].(string),
+			}
+			present = true
+		}
+		auth, err := aws.EnvAuth()
+		if err != nil {
+			if args["-K"] == nil || args["-S"] == nil {
+				return cfg, fmt.Errorf("AWS credentials not found: must use -K and -S flags, or set these env vars:\n\texport AWS_ACCESS_KEY_ID=\"AAA...\"\n\texport AWS_SECRET_ACCESS_KEY=\"BBBB...\"\n")
+			}
+			auth = aws.Auth{
+				AccessKey: args["-K"].(string),
+				SecretKey: args["-S"].(string),
+			}
+		}
+		// parse S3 url
+		s3url := strings.TrimPrefix(configFileLocation, "s3://")
+		parts := strings.SplitN(s3url, "/", 2)
+		if len(parts) != 2 {
+			return cfg, fmt.Errorf("invalid S3 URL: %s", s3url)
+		}
+		b, err := s3.New(auth, region).Bucket(parts[0])
+		if err != nil {
+			return cfg, err
+		}
+		tomlData, err := b.Get(parts[1])
+		if err != nil {
+			return cfg, err
+		}
+		if _, err := toml.Decode(string(tomlData), cfg); err != nil {
+			return cfg, err
+		}
+	} else { // local config file
+		fInfo, err := os.Stat(configFileLocation)
+		if err != nil {
+			return cfg, fmt.Errorf("non-existent config path: %s", configFileLocation)
+		}
+
+		if fInfo.IsDir() { // multiple files in a directory
+			rawCfgStruct := make(map[string]interface{})
+
+			// To keep things simple, we are not going to use the default values built in Cfg
+			// so far (LDAP.Enabled, LDAPS.Enabled, etc) so do not forget to specify them!
+			/*
+				sourcebuf := new(bytes.Buffer)
+				err = toml.NewEncoder(sourcebuf).Encode(cfg)
+				if err != nil {
+					return cfg, err
+				}
+				var initialRawCfgStruct interface{}
+				if err := toml.Unmarshal(sourcebuf.Bytes(), &initialRawCfgStruct); err != nil {
+					return cfg, err
+				}
+				if err = mergeConfigs(&rawCfgStruct, initialRawCfgStruct); err != nil {
+					return cfg, err
+				}
+			*/
+
+			files, _ := os.ReadDir(configFileLocation)
+			for _, f := range files {
+				canonicalName := filepath.Join(configFileLocation, f.Name())
+
+				bs, _ := os.ReadFile(canonicalName)
+				var curRawCfgStruct interface{}
+				if err := toml.Unmarshal(bs, &curRawCfgStruct); err != nil {
+					return cfg, err
+				}
+				if err = mergeConfigs(&rawCfgStruct, curRawCfgStruct); err != nil {
+					return cfg, err
+				}
+			}
+
+			destbuf := new(bytes.Buffer)
+			err = toml.NewEncoder(destbuf).Encode(rawCfgStruct)
+			if err != nil {
+				return cfg, err
+			}
+			fmt.Println(destbuf.String())
+			merged := config.Config{}
+			if _, err = toml.Decode(destbuf.String(), &merged); err != nil {
+				return cfg, err
+			}
+			cfg = &merged
+		} else {
+			_, err = toml.DecodeFile(configFileLocation, cfg)
+			if err != nil {
+				return cfg, err
+			}
+		}
+
+		usersCustomAttributes(configFileLocation, cfg)
+	}
+
+	// Backward Compability
+	if cfg.Backend.Datastore != "" {
+		if cfg.Backends != nil {
+			return cfg, fmt.Errorf("you cannot specify both [Backend] and [[Backends]] directives in the same configuration ")
+		} else {
+			cfg.Backends = append(cfg.Backends, cfg.Backend)
+		}
+	}
+
+	// Patch with default values where not specified
+	for i := range cfg.Backends {
+		if cfg.Backends[i].NameFormat == "" {
+			cfg.Backends[i].NameFormat = "cn,uid"
+		}
+		cfg.Backends[i].NameFormatAsArray = strings.Split(cfg.Backends[i].NameFormat, ",")
+		if cfg.Backends[i].GroupFormat == "" {
+			cfg.Backends[i].GroupFormat = "ou,cn"
+		}
+		cfg.Backends[i].GroupFormatAsArray = strings.Split(cfg.Backends[i].GroupFormat, ",")
+		if cfg.Backends[i].SSHKeyAttr == "" {
+			cfg.Backends[i].SSHKeyAttr = "sshPublicKey"
+		}
+	}
+	//
+
+	return cfg, nil
+}
+
+// usersCustomAttributes changes config passed in by adding extra information coming from the custom attributes
+func usersCustomAttributes(location string, config *config.Config) {
+	// TODO @shipperizer deal with multiple files like in line #126
+	c := new(Config)
+
+	md, err := toml.DecodeFile(location, c)
+
+	if err != nil {
+		log.Error().Err(err).Msg("issues parsing users...keep going")
+		return
+	}
+
+	for _, u := range c.Users {
+		user := new(User)
+		md.PrimitiveDecode(u, user)
+
+		if user.CustomAttributes == nil {
+			continue
+		}
+
+		for idx, cUser := range config.Users {
+			if cUser.Name != user.Name {
+				continue
+			}
+
+			x := make(map[string]interface{})
+
+			for _, attribute := range user.CustomAttributes {
+				_ = md.PrimitiveDecode(attribute, x)
+
+				for k, v := range x {
+
+					if config.Users[idx].CustomAttrs == nil {
+						config.Users[idx].CustomAttrs = make(map[string]interface{})
+					}
+
+					config.Users[idx].CustomAttrs[k] = v
+
+				}
+			}
+		}
+	}
+}
+
+func mergeConfigs(config1 interface{}, config2 interface{}) error {
+	var merger func(int, string, interface{}, interface{}) error
+	merger = func(depth int, keyName string, cfg1 interface{}, cfg2 interface{}) error {
+		//fmt.Println(strings.Repeat("    ", depth), "Handling element: ", keyName, " for: ", cfg2)
+		switch element2 := cfg2.(type) {
+		case map[string]interface{}:
+			//fmt.Println(strings.Repeat("     ", depth), " - A map")
+			element2, ok := cfg2.(map[string]interface{})
+			if !ok {
+				return fmt.Errorf("config source: %s is not a map", keyName)
+			}
+			element1, ok := cfg1.(*map[string]interface{})
+			if !ok {
+				return fmt.Errorf("config dest: %s is not a map", keyName)
+			}
+			for k, _ := range element2 {
+				//fmt.Println(strings.Repeat("     ", depth), "  - key: ", k)
+				_, ok := (*element1)[k]
+				if !ok {
+					(*element1)[k] = element2[k]
+				} else {
+					//fmt.Println(strings.Repeat("     ", depth), "  - merging: ", element2[k])
+					asanarrayptr, ok := (*element1)[k].([]map[string]interface{})
+					if ok {
+						if err := merger(depth+1, k, &asanarrayptr, element2[k]); err != nil {
+							return err
+						}
+						(*element1)[k] = asanarrayptr
+					} else {
+						asamapptr, ok := (*element1)[k].(map[string]interface{})
+						if ok {
+							if err := merger(depth+1, k, &asamapptr, element2[k]); err != nil {
+								return err
+							}
+							(*element1)[k] = asamapptr
+						} else {
+							return fmt.Errorf("config dest: %s does not make a valid map/array ptr", keyName)
+						}
+					}
+				}
+			}
+		case []map[string]interface{}:
+			//fmt.Println(strings.Repeat("     ", depth), " - An array")
+			element2, ok := cfg2.([]map[string]interface{})
+			if !ok {
+				return fmt.Errorf("config source: %s is not a map array", keyName)
+			}
+			//fmt.Println(strings.Repeat("     ", depth), "  - element2: ", element2)
+			element1, ok := cfg1.(*[]map[string]interface{})
+			if !ok {
+				return fmt.Errorf("config dest: %s is not a map array", keyName)
+			}
+			//fmt.Println(strings.Repeat("     ", depth), "  - element1: ", element1)
+			for index, _ := range element2 {
+				*element1 = append(*element1, element2[index])
+			}
+		case string:
+			//fmt.Println(strings.Repeat("     ", depth), " - A string")
+			element2, ok := cfg2.(string)
+			if !ok {
+				return fmt.Errorf("config: %s is not a string", keyName)
+			}
+		case bool:
+			//fmt.Println(strings.Repeat("     ", depth), " - A boolean")
+			element2, ok := cfg2.(bool)
+			if !ok {
+				return fmt.Errorf("config: %s is not a boolean value", keyName)
+			}
+		case float64:
+			//fmt.Println(strings.Repeat("     ", depth), " - A float64")
+			element2, ok := cfg2.(float64)
+			if !ok {
+				return fmt.Errorf("config: %s is not a float64 value", keyName)
+			}
+		case nil:
+			//fmt.Println(strings.Repeat("     ", depth), " - Nil")
+		default:
+			log.Info().Str("type", reflect.TypeOf(element2).String()).Msg("Unknown element type found in configuration file. Ignoring.")
+		}
+		return nil
+	}
+
+	err := merger(0, "TOP", config1, config2)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func handleArgs(cfg *config.Config, args map[string]interface{}) (*config.Config, error) {
+	// LDAP flags
+	if ldap, ok := args["--ldap"].(string); ok && ldap != "" {
+		cfg.LDAP.Enabled = true
+		cfg.LDAP.Listen = ldap
+	}
+
+	// LDAPS flags
+	if ldaps, ok := args["--ldaps"].(string); ok && ldaps != "" {
+		cfg.LDAPS.Enabled = true
+		cfg.LDAPS.Listen = ldaps
+	}
+	if ldapsCert, ok := args["--ldaps-cert"].(string); ok && ldapsCert != "" {
+		cfg.LDAPS.Cert = ldapsCert
+	}
+	if ldapsKey, ok := args["--ldaps-key"].(string); ok && ldapsKey != "" {
+		cfg.LDAPS.Key = ldapsKey
+	}
+
+	return cfg, nil
+}
+
+func handleLegacyConfig(cfg *config.Config) (*config.Config, error) {
+	if len(cfg.Frontend.Listen) > 0 && (len(cfg.LDAP.Listen) > 0 || len(cfg.LDAPS.Listen) > 0) {
+		// Both old server-config and new - dont allow
+		return cfg, fmt.Errorf("both old and new server-config in use - please remove old format ([frontend]) and migrate to new format ([ldap], [ldaps])")
+	}
+
+	if len(cfg.Frontend.Listen) > 0 {
+		// We're going with old format - parse it into new
+		log.Info().Msg("Config [frontend] is deprecated - please move to [ldap] and [ldaps] as-per documentation")
+
+		cfg.LDAP.Enabled = !cfg.Frontend.TLS
+		cfg.LDAPS.Enabled = cfg.Frontend.TLS
+
+		if cfg.Frontend.TLS {
+			cfg.LDAPS.Listen = cfg.Frontend.Listen
+		} else {
+			cfg.LDAP.Listen = cfg.Frontend.Listen
+		}
+
+		if len(cfg.Frontend.Cert) > 0 {
+			cfg.LDAPS.Cert = cfg.Frontend.Cert
+		}
+		if len(cfg.Frontend.Key) > 0 {
+			cfg.LDAPS.Key = cfg.Frontend.Key
+		}
+	}
+	return cfg, nil
+}
+func validateConfig(cfg *config.Config) (*config.Config, error) {
+
+	if !cfg.LDAP.Enabled && !cfg.LDAPS.Enabled {
+		return cfg, fmt.Errorf("no server configuration found: please provide either LDAP or LDAPS configuration")
+	}
+
+	if cfg.LDAPS.Enabled {
+		// LDAPS enabled - verify requirements (cert, key, listen)
+		if len(cfg.LDAPS.Listen) == 0 {
+			return cfg, fmt.Errorf("no LDAPS bind address was specified: please disable LDAPS or use the 'listen' option")
+		}
+
+		if cfg.LDAPS.Cert == "" && cfg.LDAPS.CertPath != "" {
+			byteData, err := os.ReadFile(cfg.LDAPS.CertPath)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS certificate file")
+			}
+			cfg.LDAPS.Cert = string(byteData)
+		}
+
+		if cfg.LDAPS.Key == "" && cfg.LDAPS.KeyPath != "" {
+			byteData, err := os.ReadFile(cfg.LDAPS.KeyPath)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS key file")
+			}
+			cfg.LDAPS.Key = string(byteData)
+		}
+
+		// Ugly wart for backward compatibility
+		// In the olden times, we would simply say "please read from this file"
+		// This is now the role of the Path files.
+		if !strings.HasPrefix(cfg.LDAPS.Cert, "-----") {
+			byteData, err := os.ReadFile(cfg.LDAPS.Cert)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS certificate file")
+			}
+			cfg.LDAPS.Cert = string(byteData)
+		}
+		if !strings.HasPrefix(cfg.LDAPS.Key, "-----") {
+			byteData, err := os.ReadFile(cfg.LDAPS.Key)
+			if err != nil {
+				return cfg, fmt.Errorf("unable to read TLS key file")
+			}
+			cfg.LDAPS.Key = string(byteData)
+		}
+
+		if cfg.LDAPS.Cert == "" || cfg.LDAPS.Key == "" {
+			return cfg, fmt.Errorf("LDAPS was enabled but no certificate or key were specified: please disable LDAPS or use the 'cert'/'key' or 'certpath'/'keypath' options")
+		}
+	}
+
+	if cfg.LDAP.Enabled {
+		// LDAP enabled - verify listen
+		if len(cfg.LDAP.Listen) == 0 {
+			return cfg, fmt.Errorf("no LDAP bind address was specified: please disable LDAP or use the 'listen' option")
+		}
+
+		if cfg.LDAP.TLS {
+			if cfg.LDAP.TLSCert == "" && cfg.LDAP.TLSCertPath != "" {
+				byteData, err := os.ReadFile(cfg.LDAP.TLSCertPath)
+				if err != nil {
+					return cfg, fmt.Errorf("unable to read TLS certificate file")
+				}
+				cfg.LDAP.TLSCert = string(byteData)
+			}
+
+			if cfg.LDAP.TLSKey == "" && cfg.LDAP.TLSKeyPath != "" {
+				byteData, err := os.ReadFile(cfg.LDAP.TLSKeyPath)
+				if err != nil {
+					return cfg, fmt.Errorf("unable to read TLS key file")
+				}
+				cfg.LDAP.TLSKey = string(byteData)
+			}
+
+			if cfg.LDAP.TLSCert == "" || cfg.LDAP.TLSKey == "" {
+				return cfg, fmt.Errorf("StartTLS was enabled but no certificate or key were specified: please disable StartTLS or use the 'tlscert'/'tlskey' or 'tlscertpath'/'tlskeypath' options")
+			}
+		}
+	}
+
+	//spew.Dump(cfg)
+	for i := range cfg.Backends {
+		switch cfg.Backends[i].Datastore {
+		case "":
+			cfg.Backends[i].Datastore = "config"
+		case "config":
+		case "ldap":
+		case "owncloud":
+		case "plugin":
+		case "embed":
+		default:
+			return cfg, fmt.Errorf("invalid backend %s - must be 'config', 'ldap', 'owncloud', 'plugin' or 'embed", cfg.Backends[i].Datastore)
+		}
+	}
+
+	// TODO: remove after deprecating UnixID on User and Group
+	for _, user := range cfg.Users {
+		if user.UnixID != 0 {
+			user.UIDNumber = user.UnixID
+			log.Info().Msg(fmt.Sprintf("User '%s': 'unixid' is deprecated - please move to 'uidnumber' as per documentation", user.Name))
+		}
+	}
+	for _, group := range cfg.Groups {
+		if group.UnixID != 0 {
+			group.GIDNumber = group.UnixID
+			log.Info().Msg(fmt.Sprintf("Group '%s': 'unixid' is deprecated - please move to 'gidnumber' as per documentation", group.Name))
+		}
+	}
+
+	return cfg, nil
+}

v2/internal/tracing/config.go

@@ -0,0 +1,24 @@
+package tracing
+
+import (
+	"github.com/rs/zerolog"
+)
+
+type Config struct {
+	OtelHTTPEndpoint string
+	OtelGRPCEndpoint string
+	Logger           *zerolog.Logger
+
+	Enabled bool
+}
+
+func NewConfig(enabled bool, otelGRPCEndpoint, otelHTTPEndpoint string, logger *zerolog.Logger) *Config {
+	c := new(Config)
+
+	c.OtelGRPCEndpoint = otelGRPCEndpoint
+	c.OtelHTTPEndpoint = otelHTTPEndpoint
+	c.Logger = logger
+	c.Enabled = enabled
+
+	return c
+}

v2/internal/tracing/tracer.go

@@ -0,0 +1,134 @@
+package tracing
+
+import (
+	"context"
+	"runtime/debug"
+
+	"github.com/rs/zerolog"
+	"go.opentelemetry.io/contrib/propagators/jaeger"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
+	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
+	"go.opentelemetry.io/otel/exporters/stdout/stdouttrace"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/sdk/resource"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	semconv "go.opentelemetry.io/otel/semconv/v1.18.0"
+	"go.opentelemetry.io/otel/trace"
+	"go.opentelemetry.io/otel/trace/embedded"
+	"go.opentelemetry.io/otel/trace/noop"
+)
+
+type Tracer struct {
+	embedded.Tracer
+
+	tracer trace.Tracer
+
+	logger *zerolog.Logger
+}
+
+func (t *Tracer) init(service string, e sdktrace.SpanExporter) {
+	traceProvider := sdktrace.NewTracerProvider(
+		sdktrace.WithSampler(sdktrace.AlwaysSample()),
+		sdktrace.WithBatcher(e),
+		sdktrace.WithResource(
+			t.buildResource(service),
+		),
+	)
+
+	otel.SetTracerProvider(traceProvider)
+	otel.SetTextMapPropagator(propagation.NewCompositeTextMapPropagator(propagation.TraceContext{}, propagation.Baggage{}, jaeger.Jaeger{}))
+
+	t.tracer = otel.Tracer(service)
+}
+
+func (t *Tracer) gitRevision(settings []debug.BuildSetting) string {
+	for _, setting := range settings {
+		if setting.Key == "vcs.revision" {
+			return setting.Value
+		}
+	}
+
+	return "n/a"
+}
+
+func (t *Tracer) buildResource(service string) *resource.Resource {
+	var res *resource.Resource
+
+	res = resource.NewWithAttributes(
+		semconv.SchemaURL,
+		semconv.ServiceName(service),
+		semconv.ServiceVersion("n/a"),
+	)
+
+	if info, ok := debug.ReadBuildInfo(); ok {
+		if service == "" {
+			service = info.Path
+		}
+
+		res = resource.NewWithAttributes(
+			semconv.SchemaURL,
+			semconv.ServiceName(service),
+			attribute.String("git_sha", t.gitRevision(info.Settings)),
+			attribute.String("app", info.Main.Path),
+		)
+	}
+
+	return res
+}
+
+func (t *Tracer) Start(ctx context.Context, spanName string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
+	return t.tracer.Start(ctx, spanName, opts...)
+}
+
+// basic tracer implementation of trace.Tracer, just adding some extra configuration
+func NewTracer(cfg *Config) *Tracer {
+	t := new(Tracer)
+
+	t.logger = cfg.Logger
+
+	// if tracing disabled skip the config
+	if !cfg.Enabled {
+		t.tracer = noop.NewTracerProvider().Tracer("github.com/glauth/glauth")
+
+		return t
+	}
+
+	var err error
+	var exporter sdktrace.SpanExporter
+
+	if cfg.OtelGRPCEndpoint != "" {
+		exporter, err = otlptrace.New(
+			context.TODO(),
+			otlptracegrpc.NewClient(
+				otlptracegrpc.WithEndpoint(cfg.OtelGRPCEndpoint),
+				otlptracegrpc.WithInsecure(),
+			),
+		)
+	} else if cfg.OtelHTTPEndpoint != "" {
+		exporter, err = otlptrace.New(
+			context.TODO(),
+			otlptracehttp.NewClient(
+				otlptracehttp.WithEndpoint(cfg.OtelHTTPEndpoint),
+				otlptracehttp.WithInsecure(),
+			),
+		)
+	} else {
+		exporter, err = stdouttrace.New(
+			stdouttrace.WithPrettyPrint(),
+		)
+	}
+
+	if err != nil {
+		t.logger.Error().Err(err).Msg("unable to initialize tracing exporter")
+		return nil
+	}
+
+	// set tracer provider and propagator properly, this is to ensure all
+	// instrumentation library could run well
+	t.init("github.com/glauth/glauth", exporter)
+
+	return t
+}

v2/internal/version/const.go

@@ -0,0 +1,5 @@
+package version
+
+// Version is the tag of the latest release, it gets changed by the ci
+// process when a release is happening
+const Version = "v2.5.2" // x-release-please-version

v2/internal/version/vcs.go

@@ -0,0 +1,68 @@
+package version
+
+import (
+	"fmt"
+	"runtime/debug"
+)
+
+type gitInfo struct {
+	BuildTime string
+	Commit    string
+	Dirty     bool
+}
+
+// GetVersion reads builtime vars and returns a full string containing info about
+// the currently running version of the software. Primarily used by the
+// --version flag at runtime.
+func GetVersion() string {
+
+	// TODO @shipperizer see if it's worth replacing with info.Main.Path
+	// aka github.com/glauth/glauth/v2 - not great but worth checking
+
+	name := "GLauth"
+
+	info, ok := debug.ReadBuildInfo()
+
+	if !ok {
+		return fmt.Sprintf(`
+%s
+Non-release build`,
+			name)
+	}
+
+	gitInfo := vcsInfo(info.Settings)
+
+	// If a release, use the tag
+	if !gitInfo.Dirty {
+		return fmt.Sprintf(`%s %s
+Build time: %s
+Commit: %s`, name, Version, gitInfo.BuildTime, gitInfo.Commit)
+	}
+
+	return fmt.Sprintf(`%s
+Non-release build based on tag %s
+Build time: %s
+Commit: %s`, name, Version, gitInfo.BuildTime, gitInfo.Commit)
+
+}
+
+func vcsInfo(settings []debug.BuildSetting) *gitInfo {
+	info := new(gitInfo)
+
+	info.BuildTime = "unknown"
+	info.Commit = "unknown"
+	info.Dirty = false
+
+	for _, v := range settings {
+		switch v.Key {
+		case "vcs.revision":
+			info.Commit = v.Value
+		case "vcs.modified":
+			info.Dirty = v.Value == "true"
+		case "vcs.time":
+			info.BuildTime = v.Value
+		}
+	}
+
+	return info
+}

v2/misc/openldap/grantadminsearch.ldif

@@ -0,0 +1,3 @@
+olcAccess: to dn.subtree="dc=glauth,dc=com"
+  by dn.exact="cn=admin,dc=glauth,dc=com" manage
+  by * break

v2/misc/openldap/grantserviceusersearch.ldif

@@ -0,0 +1,7 @@
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+delete: olcAccess
+-
+add: olcAccess
+olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=serviceuser,cn=svcaccts,ou=users,dc=glauth,dc=com" write by anonymous auth by * none
+olcAccess: to * by self write by dn="cn=serviceuser,cn=svcaccts,ou=users,dc=glauth,dc=com" write by users read by * none

v2/misc/openldap/setserviceuserpassword.ldif

@@ -0,0 +1,4 @@
+dn: cn=serviceuser,cn=svcaccts,ou=users,dc=glauth,dc=com
+changetype: modify
+replace: userPassword
+userPassword: mysecret

v2/misc/sambaad/ldap.conf

@@ -0,0 +1,3 @@
+TLS_REQCERT never
+URI ldaps://192.168.1.222
+BASE dc=test,dc=example,dc=com

v2/misc/sambaad/runad.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+for arg in "$@"; do
+    if [[ "$arg" == *"="* ]]; then
+        key="${arg%%=*}"
+        value="${arg#*=}"
+        eval "$key"="'$value'"
+    else
+        eval "$arg"=true
+    fi
+done
+
+if [[ "$ipaddr" == "" ]]; then
+    echo "Please provide ipaddr=<ip address> to create/use" >&2
+    exit 1
+fi
+
+if [[ "$ipmask" == "" ]]; then
+    ipmask=24
+fi
+
+eipaddr=$(echo "$ipaddr" | sed 's/\./\\./g')
+ifname=$(ip -brief addr show | awk "/$eipaddr\// {print \$1}")
+if [[ "$ifname" == "" ]]; then
+    ping -c 1 $ipaddr &>/dev/null
+    if [[ $? -eq 0 ]]; then
+        echo "It looks like you specified an already allocated ip address." >&2
+        exit 1
+    fi
+fi
+
+if [[ "$ifname" == "" ]]; then
+    passed=0
+    if [[ "$ipmask" == "" ]]; then
+        passed=1
+    fi
+    if [[ "$iface" == "" ]]; then
+        passed=2
+    fi
+    if [[ $passed -ne 0 ]]; then
+        echo "To create an interface, specify ipaddr=<ip address> ipmask=<mask> iface=<interface name>" >&2
+        echo "Example: ipaddr=192.168.1.222 ipmask=24 iface=en0" >&2
+        exit 1
+    fi
+    echo "Creating $ipaddr/$ipmask on interface $iface"
+    sudo ip addr add $ipaddr/$ipmask dev $iface
+fi
+
+if [[ "$domain" == "" ]]; then
+    domain="TEST.EXAMPLE.COM"
+fi
+if [[ "$defaultdns" == "" ]]; then
+    defaultdns="192.168.1.1"
+fi
+
+echo "Running Samba AD, listening on $ipaddr for domain $domain"
+docker run -d
+    --name ad \
+    --hostname DC1 \
+    --restart unless-stopped \
+    -e REALM='TEST.LOCAL' \
+    -e DOMAIN='TEST' \
+    -e ADMIN_PASS='MySecret2026!' \
+    -e DNS_FORWARDER='8.8.8.8' \
+    -v dc_etc:/usr/local/samba/etc \
+    -v dc_private:/usr/local/samba/private \
+    -v dc_var:/usr/local/samba/var \
+    -p $ipaddr:53:53 \
+    -p $ipaddr:53:53/udp \
+    -p $ipaddr:88:88 \
+    -p $ipaddr:88:88/udp \
+    -p $ipaddr:135:135 \
+    -p $ipaddr:137-138:137-138/udp \
+    -p $ipaddr:139:139 \
+    -p $ipaddr:389:389 \
+    -p $ipaddr:389:389/udp \
+    -p $ipaddr:445:445 \
+    -p $ipaddr:464:464 \
+    -p $ipaddr:464:464/udp \
+    -p $ipaddr:636:636 \
+    -p $ipaddr:1024-1044:1024-1044 \
+    -p $ipaddr:3268-3269:3268-3269 \
+    diegogslomp/samba-ad-dc

v2/misc/sambaad/samba-ca.pem

@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFtDCCA5ygAwIBAgIEhCJsaTANBgkqhkiG9w0BAQsFADB6MR0wGwYDVQQKExRT
+YW1iYSBBZG1pbmlzdHJhdGlvbjE3MDUGA1UECxMuU2FtYmEgLSB0ZW1wb3Jhcnkg
+YXV0b2dlbmVyYXRlZCBDQSBjZXJ0aWZpY2F0ZTEgMB4GA1UEAxMXVEVTVERDLnRl
+c3QuZXhhbXBsZS5jb20wHhcNMjYwMTE4MDAwMDA0WhcNMjcxMjE5MDAwMDA0WjB6
+MR0wGwYDVQQKExRTYW1iYSBBZG1pbmlzdHJhdGlvbjE3MDUGA1UECxMuU2FtYmEg
+LSB0ZW1wb3JhcnkgYXV0b2dlbmVyYXRlZCBDQSBjZXJ0aWZpY2F0ZTEgMB4GA1UE
+AxMXVEVTVERDLnRlc3QuZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQDuYBt2jNruSR4xL0wI8Nx2uq+jQKpiViWzDPw4eivNrLXc8Bdr
+o9GqCo4uokPZiFS6jGez3holnMKF1bxU8uES2ma228zRIJVAHo0qU2O8zGoMtAuL
+Z+F9gZAVSQKUMp0Vl2yyNERY453Ne4B2Oz92G87YtNuDyNYzuK4778FiE5iXjvan
+CsAENXrspfxvn8QD5IloHPFoieFkfeaigDA6Zjtr2be+LhDbc2wn6YY7t8Z+5wxG
+UPUy8oYKQ5lyHSn6I7aezAJpJJHSN4eSg76smTMjUOAnLqJJHPurGF9zzq+maRg+
+M2runjqRcnZzQtkdZJayK8GQ39kEFpHnl1PueexFEIA5PxHaJEbapAiL7nP65bAy
+Ey6wiOVvuLgztf8CU6hT/Not3qVG5lCGiK1VC9W684X5vQcVnQXTAIY3Edt91u8C
+/wt4i5j58orVbcghAZMsU3FKjjqyvQMMSD2Pwgf6+m2mVQIAnZOrkErsQrltmFxO
+CPBbRY+5Yg8v2ZucMWfKNy4IEzm8LyddrZKAENbW73/bZtPCw7cJqeb6ZaWVzrqW
+BAgMiyrBYq/oGnXP6rHnTpB02LWTx8dvPPmEgvPhjecCRKroesYeKX38KWywGalA
+xXbs+Eo9ApGst7qhkenAzM3E7Fy56OoELUAKGQW9gtVEnn+8BofLhezUyQIDAQAB
+o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQU
+ShGTEQzxmK0IrRMPiPYbRxfntYQwDQYJKoZIhvcNAQELBQADggIBAFxD6ShgnqwK
+6oMzXKZOXoVfVu8yFKhL9Z3ui+6Q/duckzLf873sMlxz9msLTjH1O2Pk9gaND9/l
+25t37BvVLuNTJKHvTfte53l8fQUrqCgOq2feARoXyCAA77bTUh+uSGsjZYGbSJx/
+M93fOtabElD9T3o3B0L2EJyL7LHZ3in9MOyVBBcCnOMqi+1eoQEnaoj5TRnE8eEu
+RuTs7Vu3lceZuCvH1mTRPis2D8bPCWa3aAI6w+LZoJNP3B1izo6Arjje7TBHBMGJ
+A65o9LP1+OeZ5EA+J3nIkU5rSHu+Pk5biBNEThsnkGjEhSTXZPCVgZRQJOgQyvnf
+LPWUOMdMLsnsO2oW3/BG6zTmbZw4CMzE8yZUtNZxph7+N1ukzYWZbSwDADxxi+dQ
+vFQk6tguKpxBCko+pWajgNcxG97MFQMMCfGfva7xdaqBSB4R8sdmQm+wknAYQrlm
+Jc6csvkJgoIHvyBn9yfSKYNvbjh8RUGA2TZMWrbBMdt51ivw6e1NM16OneGtELh+
+zGlgv0EfJPaf9IG+RWqvMuhGFF1DgqBi8l816XFy4g3SEFC2F0D6VAv9mQZdq8q1
+9y7B9vpcBQbNiHqJahIEwgp1JlHdoj281Ms2KixBf88O0y7zSMbyejxHtGv8IUVD
++Nth1G9FpENenG73njJIh1dLLYyHvxnp
+-----END CERTIFICATE-----

v2/misc/sambaad/samba-tls/ca.crt

@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIFETCCAvmgAwIBAgIUHfUrLa/sMlGeT6VIZdkj73UjZfkwDQYJKoZIhvcNAQEL
+BQAwGDEWMBQGA1UEAwwNU2FtYmEgVGVzdCBDQTAeFw0yNjAxMTgwMTEzMzVaFw0z
+NjAxMTYwMTEzMzVaMBgxFjAUBgNVBAMMDVNhbWJhIFRlc3QgQ0EwggIiMA0GCSqG
+SIb3DQEBAQUAA4ICDwAwggIKAoICAQC464FD54YJ1rgi/5Z9DQrIbEzED8NhMjo/
+ndqD+0sfqkiYjQEqAh7Wpj+6r9D9AZ1wnTdF2Ee767OTwkSA2lG5aQAF9HDFzgIJ
+8yVbeqJIABOzKotLTl1wCNeRx+YeY69xcytzsQ6iNFyOVV/CbkbxtyJvDfxD9rC5
+Pwf1A7yBLz0H8U+kXBKC0SCDSW4+SAgmJQu3NQ7wd2eg+EBH/cPVhw0F97K3Yfb0
+c8wekQdqAMrvfo/jq81/JADUEmzi1lyQ34zX2ToBIeu42/oTBmJ8ZX2ZAFgUu0y1
+Kh+rmmYLhszPLfwB/28j1wizd/iVdpN0+ssJj3y+rEgKeXFfo1x7KSWprHUCJzZk
++T7l59tEg7ZiSuRexgkc3Rf+4DYNq7JzCFnVnBvhC++fym29JRrriX0DOUYMGAS3
+dFBiLJT65kdLCwrgkCAZTbsNKTVkEQx3QYn58dUYMTmQXndg4AEG0VUa4s+oqOFu
+jokyeqVqp37CUm0MU9cKJVnkMqWkqI9JRTBe90xHSy5xrmB0N1zM/FbUTBvMCh6Z
+t7ZAiB3gB1LTXaDRWafJ+opYJtPkVhvAlmFjEwuYCYdUM8lz+i/MKK8hrAoztUvr
+C2n5qoDUX5Tm9VygefWVxzCvyzTy+FKEq+4aU8ye0zohCJ+UP1SMi3j98aGdVjBJ
+sI9KhOQNmQIDAQABo1MwUTAdBgNVHQ4EFgQUgFOZGLtmwudA8tVaKeLvowVQLMYw
+HwYDVR0jBBgwFoAUgFOZGLtmwudA8tVaKeLvowVQLMYwDwYDVR0TAQH/BAUwAwEB
+/zANBgkqhkiG9w0BAQsFAAOCAgEAPNmj5RCacwRbySYERx8XBlcV50DRFnFS51G0
+EEKObiOBxt/xboAt/bPw+6dVeqS0JILrgMJhHn7dufRTdnGK/z9VkRDrTh6FudAk
+16qdhglXzPrPzETGl1VHJxQEkqm+qkUeD4r9waUP5ZIXdsUrvGdnCaXgQRA3v2RD
+NDvNldmgCTScjTPM4ox0B2iL0P0Uo4pRzQTGuPmubCMv2B8EkBOPIQx/TO2svL6M
+oal/25v06+xUEyVAxWQPD4xolL8ksEjdqa7l5h/1YkpouWq+jaEDpWGzVqt/fLYI
+cdGUxSNcaueEmHB2QOklrTdDVvvczAE98ytDZ/zswj8cKKLhe2d3Z3ie40xx+4/x
+NprbosIGWrHnz0NbDlzXRvd8yk7ZWk4QFRycJb7Ve3Za3hPOlDeKgm5iCjafCS4G
+C1D8r+SwGjCjgsaL7J/zY4IHyxurRVBU+jZSRgy2WQlR/BQ2gSdVt3BhxsEPgbmu
+jKOiPltNkqPmUHoXFnosJyAblF8yjYkBPBpbM5luAUiKMYBkdkSA3oSJYK3WuIDl
+UNcKwcC9sJPu63ciPDtEZlgV5blvMr80PPyJZDofo+KHxWweKxoyXxQoIKCrP53D
+Av2KGBhIZlJUzNrj4LWMGbf+8BAGL+i1oyM77D/N8L589Y0x1mQMa/quQW+TJ8kH
+g2wgxQw=
+-----END CERTIFICATE-----

v2/misc/sambaad/samba-tls/ca.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQC464FD54YJ1rgi
+/5Z9DQrIbEzED8NhMjo/ndqD+0sfqkiYjQEqAh7Wpj+6r9D9AZ1wnTdF2Ee767OT
+wkSA2lG5aQAF9HDFzgIJ8yVbeqJIABOzKotLTl1wCNeRx+YeY69xcytzsQ6iNFyO
+VV/CbkbxtyJvDfxD9rC5Pwf1A7yBLz0H8U+kXBKC0SCDSW4+SAgmJQu3NQ7wd2eg
++EBH/cPVhw0F97K3Yfb0c8wekQdqAMrvfo/jq81/JADUEmzi1lyQ34zX2ToBIeu4
+2/oTBmJ8ZX2ZAFgUu0y1Kh+rmmYLhszPLfwB/28j1wizd/iVdpN0+ssJj3y+rEgK
+eXFfo1x7KSWprHUCJzZk+T7l59tEg7ZiSuRexgkc3Rf+4DYNq7JzCFnVnBvhC++f
+ym29JRrriX0DOUYMGAS3dFBiLJT65kdLCwrgkCAZTbsNKTVkEQx3QYn58dUYMTmQ
+Xndg4AEG0VUa4s+oqOFujokyeqVqp37CUm0MU9cKJVnkMqWkqI9JRTBe90xHSy5x
+rmB0N1zM/FbUTBvMCh6Zt7ZAiB3gB1LTXaDRWafJ+opYJtPkVhvAlmFjEwuYCYdU
+M8lz+i/MKK8hrAoztUvrC2n5qoDUX5Tm9VygefWVxzCvyzTy+FKEq+4aU8ye0zoh
+CJ+UP1SMi3j98aGdVjBJsI9KhOQNmQIDAQABAoICADiu8APZn2u6pt0LjZytd8Wx
+9OIQlupfVB2WDJpyWDfPocspRdcTqVJQya43II+9g/42IvBE+NAw0u4TGZ6JzY1R
+E1G/+SWZHWThZG0jLUV2yJMeEm62CcxC2Zl1NiPQmMHk9MfU2VB9TnXO07isxxBm
++6YhGlfW8ZsHKDBBwfGzgjjCDpCqLH5vDlFQG/v5Zo4SwwGYwQiTAXAFSOcIcZQt
+fp96qwyted669DHWcPhcX9iD6iV2z1oOtjZLo5bw8JT0AZ9UlgQs2q3iuEhGp7/L
++HEC+vz34O6Th/u5K1iTLIrBZMNUAkRxMNiaiNd/7nloOv6mPi3Qb5DOYyNW1wzg
+TlF5fERqz2OeuFqjnEfoE/uFjvBN0bclenuFTCWDeSxEZqni9qjLhnqK4Iot7/D2
+P148t4UIT8h5l82Wiod05cenlnPfpWbRRdzVXy0NZe1BTf2U8LXRW1ANdJyfVSC6
+802KPP6noWnaFYfkhIIdD10ZlTd9vTwdcHEYfoJNNbXcwwI/OslGwPB1a+tp+rSd
+Vr2l8RoF0/28cjsRnDi7hoaMkNIqszXq1WA+d5zOvmOsfuy/32pfnm+rw8HafYNj
+SNK0t5sh0PCsHrRrCRfTaOIQbFveABcf0uxbM68xSMAIKH8rpTrp4lcEEO5Yrcrj
+qDFQ7rw+VnRR0Nu4eX+VAoIBAQDbWhvWkZssTNHR8Xs9OtaAiHktEgJbreaRPvCe
+GgfyuZ+aYj6M9ivY/z99AJqH4pueXWbZuyBHmPp39zvvN44WP6Yc+4EDyDpiRIxi
+CjofYzbOIMxnMqgXePPWHXv+UA1zaSu1HGF1kMMeU+cT4knQpkQNrbmioYIetOnU
+BzdKJt/LTK2KRvHn4VN6Tt49ZnIfrAo8UIOZPdpT6qumX/RENw0/66AU220bLtaP
+xxZNqipjf56wikkQiHbmP85ZW9dPTR2aUtJZkS7nmJhTuH782ES96soPjYREH/fZ
+K5TdWn7Se6NcdHgoG5W2voqP3GFUyvKxRNLSK/tjN1UGYKx/AoIBAQDX0LSDjqKX
+nn+kZBHVXmMtEWVu44CijdDvBIkri5rjO5QdEtgk15gxYXwakRiXgmpsDk/fyBEQ
+n7iIlao697vNh3cWbe9xuBBhccLcmkrt1qKSO9a1qjbh4lZ10F4SLsZrDz1dTWwf
+Xvlofl1oNbh9a39xDT9Pa6qt2tZLThianqjHXssMsaEQPNrWduJmM8um/OT+CHoJ
+6XTzX9SZrMOcevPdAWARdqgBohcfMD2LhMkY0HIkZGdP1/FYdAbHqjK+81pvtPYE
+JNRQLCgWMWqfUnnay6lMwN/0U7u0AHE4futYMqrn8gGl0JuGLZ6o1BDxpf2Thkfv
+KpDLDcyFMBnnAoIBAQDGfXvDZm8sXzde603B0oRYOyasCifoHi0OMg46gwO+OQqc
+AVro47o52n/w9aLgY8a+P3baf+Jt55h/BlJN3c/Ngjsm7s+IRJ/QXIdMEEUYMgdd
+74AHwmcpFmJP1s5lCruhPAI5GT13zU9DGll4PMTe8hWS6ymYaN3+O2d8XitCBnts
+1C4Veq1cTyHjA4tHtHSBBIUenxz2hmoSlcBOBXZcZBSxSt7JAOZyOqgd4uHj1aAV
++V34EqqbM2GkaQipA9qKABZRl7CRLDdti0AMQl9nHazWzqeZ+008+FCnTDChPUqV
+3RuuhhZU9OE9RJ7OH3ZT7HJAxy6e0P3igieGZeSxAoIBAQCho2ogAmuavZaCTITi
+1w/WyGm9NN26YhczfaUzHRuDx7K2V8/VQDh3+7iUuUm+6GnGxq1iQRku50Gx4s6d
+3cAmPqid/vbQqHh0U10MFu+51QDsH68/Xt4+LmRtVwOuAKSRuNdQE1XA5URN1B8n
+lty36xSHWtGpLU2navkHa9WXsO9ea4wO1Nd6LuoEqQQGYhLM3iqwbS7iT51NTuAP
+vUrA34HYbFhEnCdXGczRijL+VRS85honUZ/jOCxGAJi3YK0jQWbhtZpxHhh6d6gK
+fzaJX59ulQ0XNHpIJ5K1TYN/OegQpdpFYIeFZomlZHOppTOPmbAjlvY3lhzeSFZ/
+BrjPAoIBAQCsJqoFNpJpJFT/gGL6xWS4O158E5GxYXl3raN/dfBMGZnbTr0nHrbC
+4vyrWaQFVsovea7SZnzfLdyesLuJ1FIUhsal166o/g6Vf5wgDn7LHZ202tt2DokV
+ECETQTA+VBTXysc7/dwsTohbee7Jg6xZ/qHSdP6nUan9xiC3pOx0G/vT5FaH9kBJ
+dJ2mQ93n/l1A6q9Hn5AFyoCqniOszVsQ357N9uxakQiX48JKKWG7+BneKtGzN2bu
+9ArlPSNscNDb4yF2fqksTHvIYbGuJ3icbObjWUKOCQbtpva4Rkrnoqqg5nHM0L+f
+3tGhl1yrO4/YIpQrp0OgMV1HDYXEOwwI
+-----END PRIVATE KEY-----

v2/misc/sambaad/samba-tls/ca.srl

@@ -0,0 +1 @@
+59634A59EBDC029E7D479619E12C1868317CE811

v2/misc/sambaad/samba-tls/server.cnf

@@ -0,0 +1,17 @@
+[req]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+req_extensions = req_ext
+
+[dn]
+CN = TESTDC.test.example.com
+
+[req_ext]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = TESTDC.test.example.com
+DNS.2 = localdc.test.example.com
+IP.1  = 192.168.1.222

v2/misc/sambaad/samba-tls/server.crt

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEUDCCAjigAwIBAgIUWWNKWevcAp59R5YZ4SwYaDF86BEwDQYJKoZIhvcNAQEL
+BQAwGDEWMBQGA1UEAwwNU2FtYmEgVGVzdCBDQTAeFw0yNjAxMTgwMTE0MDRaFw0y
+ODA0MjIwMTE0MDRaMCIxIDAeBgNVBAMMF1RFU1REQy50ZXN0LmV4YW1wbGUuY29t
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA04ZWa1/UrP6eAkwvc2oL
+XCewax+5GWWhIj0XVgglblPNcPbK0dLTienfGnfEYxgrCl4o+H7c+SFYcJ/Sg5jw
+W4/POs+NWoo3ixj71TYWwK+7bUPt2RbNadCAxo4SejdB0zOjpTRn4dDIMZ0+wrg5
+Ah3jkTnPmwWjpvt280KkojUz+7mhdKFXBBmyjr/ftWU8C+1nyJt5/tVl7PE0VcOL
+MBok9djjHlj2aKLCw8Hj0CyL+yYFM4keWvYAguXYjVayMC2w8VffvjjO3Wd7/LWi
+AkDIAhnKyc1oJ8X4h9XK1irEw8lgWH93jyRx54eG32/C3HuNRQA9oQgJrfaK5YCJ
+kQIDAQABo4GHMIGEMEIGA1UdEQQ7MDmCF1RFU1REQy50ZXN0LmV4YW1wbGUuY29t
+ghhsb2NhbGRjLnRlc3QuZXhhbXBsZS5jb22HBMCoAd4wHQYDVR0OBBYEFJDd+Fmx
+vsrKEvBMXBwtBeFxjVjWMB8GA1UdIwQYMBaAFIBTmRi7ZsLnQPLVWini76MFUCzG
+MA0GCSqGSIb3DQEBCwUAA4ICAQBwS8/1iAFnopOui1V/qdRBsBTWcXdQS7x1PqVU
+nJkd+T5AYtLu3tJ+PBO9rfgDNVWVz37GB8CTgr4TpGOt7ruaVSZvw9uMRBxYeeit
+Kf11gssI2eTZESv8yqsa1DtLheQS0AQ7IVjq9wZSw+i3zQ8lQDvFoCWa8nv+C+YZ
+cfFSnhfXNRQIM+lxn6vrtZa/GgJh6MTF+vCfLvStveCsTvT7i/w0EzO8NFqGBrsX
+ldombU/WNketQXQEaLAU6NQVvJCjkC9Wgc+KcOQOV77U7CHi3lsc2TAoGlMuJ1lP
+zyQWJqHKkuWGODeBSd9FfjoZv81+OGPaCAh7bkOHwqAUjgEIL8SV1fX8i13HTkG5
+nhbN6XoiezjKixfH/EAQHiKhi6/7nzYltz6bJFHpIfBa097l7Yhx/o/HIdKDWV2S
+VnLIJMJpf/Qn80led1HQPeRWR1EC+fWhBzOg2mCJJpYkpqaOlHVujZ2c5JLckhxH
+WuIkicvR+LE07IjgZFWUwCXW/PkDDHtiJ0MD6RAiFzFbnuGGMadv3lUBJBUeKL3P
+PaDC/pue9AAgbWN9ndg8CTorDR2HHjjOyVTkum5bPL2vChuG3/mx+KHcgwDyEWt8
+cJTxXNaid928rR0aSPsSd4WNlCTDwXhUpClaVRaip/rcfrhJaaFUe7xWpQe8dkvO
+hiuYEQ==
+-----END CERTIFICATE-----