Dev (#254)

* use functional options pattern to inject logr (#124)

* use functional options pattern to inject logr

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* cleanup log formatting

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* allow clean shutdown (#126)

* fix owncloud posix query, log message and provisioning api results (#128)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* don't hardcode graphapi endpoint

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* add support for write handlers (#135)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* config: match shadowaccount objectlcass (#136)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* Makefile compatiblility (#134)

Co-authored-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* update travis.yml (#154)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* check owncloud status code is ok (#153)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* Bulid and push multiarch docker images (#142)

Fix #141.

With this change, a github action is added that builds a multiarch docker image on every commit, supporting x86_64, aarch64 and arm/v7.

When the action is triggered on a release or tag, it also uploads the versioned image to github container image registry.

Co-authored-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* don't mix graph and provisioning api (#157)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* Reuse http client as much as possible and allow insecure transport (#160)

* Allow using configmaps when deploying in kubernetes (#161)

* Ensure config watcher also works in kubernetes

When using configmaps in kubernetes, the file is a symlink, and then
file-watcher is not opdated with a write event. Instead it receives a
CHMOD and a REMOVE event.

This change adds two things
1) Removal of the current wacther and adding of a new watcher for the
same path
2) The do-reload conditional is updated to also include the remove
event.

* Align write and removed conditionals

* Fix API server json formating (#163) (#164)

* Update README.md (#167)

Fixing bad port in quickstart

* Use port 3893 with ldapsearch in example (#150)

* feat: add flags for ldap listen addresses (#169)

Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>

* Assets build fix. (#171)

* Docker build fix.

* Makefile fix.

* update readme, config and deps (#170)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* Remove byanke's donation fields

* Database plugins (#133)

This commit actually covers a few items. In future commits, I will keep features distinct. This is only happening this time around due to how long it took to merge this branch.

Covered:

- Database plugins (at this time: SQLite, MySQL, Postgres)
- Backends acting as middleware: added the [[Backends]] configuration directive while retaining backward compatibility with [Backend]
- Schema introspection (root DSE query with base scope)
- When proxying, insert queried attribute back in upstream response, if absent, so that the LDAP library does not filter out all entries
- When chaining backends, any backend can be used to inject OTP value in password, before reaching a non-OTP-aware backend (currently guarded by a True statement in case we find an issue (I did thoroughly test but you never know))
- Handling of special "1.1" attributes filter meaning "I do not want attributes" (RFC 4511, 4.5.1.8)
- Support for "want types only" queries, even when proxying

* Mac M1 Support and LDAP Req Attributes (#192)

* Mac M1 Support

* Augmented root DSS and schema discovery based on content of schema directory

* LDAP workaround where req. attribute gets injected in response now works with combined filters

* SubSchema query can return a minimal set, freeipa or openldap's schemas

* Feature/upgrade ldap library version (#194)

* Stronger, salted paswords using bcrypt. (#195)

* Fixed badges in README file and added a couple improvements (#196)

* fix lock for ownCloud / graph backend (#198)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* the config struct is only needed by the config backend (#199)

* Variable "unixid" is now respectively "UIDNumber" and "GIDNumber" for… (#201)

* fix: keep watch config file when changed,renamed,removed (#189)

I will need to run `glauth.go` through `gofmt` myself but that is fine.

* Returning when unable to start config watcher (#203)

* Introducing goconvey testing and refactoring of config and ... (#204)

* Introducing goconvey testing and refactoring of config and plugin backends.

* gofmt, oops

* Refactored re-insertion of requested attributes

* Allow bind operations with no group provided (#205)

* Support for userPrincipalName binding and browsing. (#206)

* Support for userPrincipalName binding and browsing.

* Fixed travis CI test for userprincipalname

* fixing travis tests for more users

* Rate limit after failed binds (#207)

* Capabilities -- part 2 (#214) + do not dump config at startup

* Attempting migration from Travis to Github Actions

* Migration Step#2

* Migration Step#3

* Migration Step#4

* Migration Step#5

* Migration Step#6

* Migration Step#7

* Migration Step#8

* Migration Step#9

* Migration Step#9

* Migration dev...

* Migration dev...

* Migration dev...

* Migration dev...

* Docker with plugins, first step (#215)

* Docker with plugins, first step

* Build better docker images, including plugins

* Merge back from dev to feature branch step #2

* Added capabilities to CI

* - Now creating two docker images, including one with plugins
- Moving from Travis CI to GitHub Actions

* Plugins now run on distroless (#217)

* Getting rid of Travis CI now that it doesn't support FOSS anymore.

* Internal Stats -- performance view (#221)

* Local merge

* Update CI to forget about bindata

* Forgot to cleanup the cleanup...

* assets: use stdlib "embed" package (#200)

This should make it easier to include GLAuth in other projects using `go get`

* 'Airgapping' web assets for security and preventing breakage (#227)

* v2 -- V2 hierarchy (#228)

* Search refactoring, tree traversal and scope correctness (#229)

Search refactoring, tree traversal and scope correctness.

* Feature/multi cfg (#233)

* Feature/custom attributes (#240)

* Makefiles: platform releases (#241)

* Feature/release script (#242)

* Bug/fix docker build in v2 (#244)

* Fix #246 and #252

Co-authored-by: Jörn Friedrich Dreyer <jfd@butonic.de>
Co-authored-by: Zhou Wenzong <wenzong@users.noreply.github.com>
Co-authored-by: Jairo Llopis <Yajo@users.noreply.github.com>
Co-authored-by: Benedikt Kulmann <benedikt@kulmann.biz>
Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com>
Co-authored-by: Thibault Soubiran <soubi.thibault@gmail.com>
Co-authored-by: Clement JACOB <clems71@gmail.com>
Co-authored-by: Lutz Horn <code@lhorn.de>
Co-authored-by: Márk Sági-Kazár <sagikazarmark@users.noreply.github.com>
Co-authored-by: Peter Heise <pheise@koprolalie.com>
Co-authored-by: Ben Yanke <ben@benyanke.com>
Co-authored-by: fanlix <fanlix@gmail.com>
Co-authored-by: Hank Donnay <hdonnay@gmail.com>

v2/Dockerfile-plugins

@@ -7,8 +7,8 @@ LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@but
 
 # Setup work env
 RUN mkdir /app /tmp/gocode
-ADD . /app/
-WORKDIR /app
+ADD local/app /app/
+WORKDIR /app/v2
 
 # Required envs for GO
 ENV GOPATH=/tmp/gocode
@@ -25,11 +25,12 @@ RUN go get -d -v ./...
 # Build and copy final result
 RUN uname -a
 RUN uname -m
-RUN bash -c '[[ $(uname -m) == x86_64 ]] && { make linuxamd64 && cp ./bin/linuxamd64/glauth /app/glauth; export PLUGIN_OS=linux PLUGIN_ARCH=amd64; make bin/linuxamd64/sqlite.so bin/linuxamd64/postgres.so bin/linuxamd64/mysql.so && cp ./bin/linuxamd64/*.so /app/; } || { true; }'
-RUN bash -c '[[ $(uname -m) == aarch64 ]] && { make linuxarm64 && cp ./bin/linuxarm64/glauth /app/glauth; export PLUGIN_OS=linux PLUGIN_ARCH=arm64; make bin/linuxarm64/sqlite.so bin/linuxarm64/postgres.so bin/linuxarm64/mysql.so && cp ./bin/linuxarm64/*.so /app/; } || { true; }'
+RUN bash -c '[[ $(uname -m) == x86_64 ]] && { make linuxamd64 && cp ./bin/linuxamd64/glauth /app/v2/glauth; make plugins_linux_amd64 && cp ./bin/linuxamd64/*.so /app/v2/; } || { true; }'
+RUN bash -c '[[ $(uname -m) == aarch64 ]] && { make linuxarm64 && cp ./bin/linuxarm64/glauth /app/v2/glauth; make plugins_linux_arm64 && cp ./bin/linuxarm64/*.so /app/v2/; } || { true; }'
+RUN ls -l /app/v2/bin/linuxamd64
 
 # Check glauth works
-RUN /app/glauth --version
+RUN /app/v2/glauth --version
 
 #################
 # Run Step
@@ -39,13 +40,13 @@ FROM gcr.io/distroless/base-debian10 as run
 LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>"
 
 # Copy binary from build container
-COPY --from=build /app/glauth /app/glauth
-COPY --from=build /app/*.so /app/
+COPY --from=build /app/v2/glauth /app/glauth
+COPY --from=build /app/v2/*.so /app/
 
 # Copy docker specific scripts from build container
-COPY --from=build /app/scripts/docker/start-plugins.sh /app/docker/
-COPY --from=build /app/scripts/docker/default-config-plugins.cfg /app/docker/
-COPY --from=build /app/scripts/docker/gl.db /app/docker/
+COPY --from=build /app/v2/scripts/docker/start-plugins.sh /app/docker/
+COPY --from=build /app/v2/scripts/docker/default-config-plugins.cfg /app/docker/
+COPY --from=build /app/v2/scripts/docker/gl.db /app/docker/
 
 # Just what we need
 COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init

v2/Dockerfile-standalone

@@ -7,8 +7,8 @@ LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@but
 
 # Setup work env
 RUN mkdir /app /tmp/gocode
-ADD . /app/
-WORKDIR /app
+ADD local/app /app/
+WORKDIR /app/v2
 
 # Required envs for GO
 ENV GOPATH=/tmp/gocode
@@ -24,12 +24,12 @@ RUN go get -d -v ./...
 
 # Build and copy final result
 RUN uname -a
-RUN if [ $(uname -m) == x86_64 ]; then make linuxamd64 && cp ./bin/linuxamd64/glauth /app/glauth; fi
-RUN if [ $(uname -m) == aarch64 ]; then make linuxarm64 && cp ./bin/linuxarm64/glauth /app/glauth; fi
-RUN if [ $(uname -m) == armv7l ]; then make linuxarm && cp ./bin/linuxarm/glauth /app/glauth; fi
+RUN if [ $(uname -m) == x86_64 ]; then make linuxamd64 && cp ./bin/linuxamd64/glauth /app/v2/glauth; fi
+RUN if [ $(uname -m) == aarch64 ]; then make linuxarm64 && cp ./bin/linuxarm64/glauth /app/v2/glauth; fi
+RUN if [ $(uname -m) == armv7l ]; then make linuxarm && cp ./bin/linuxarm/glauth /app/v2/glauth; fi
 
 # Check glauth works
-RUN /app/glauth --version
+RUN /app/v2/glauth --version
 
 #################
 # Run Step
@@ -39,11 +39,11 @@ FROM gcr.io/distroless/base-debian10 as run
 LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>"
 
 # Copy binary from build container
-COPY --from=build /app/glauth /app/glauth
+COPY --from=build /app/v2/glauth /app/glauth
 
 # Copy docker specific scripts from build container
-COPY --from=build /app/scripts/docker/start-standalone.sh /app/docker/
-COPY --from=build /app/scripts/docker/default-config-standalone.cfg /app/docker/
+COPY --from=build /app/v2/scripts/docker/start-standalone.sh /app/docker/
+COPY --from=build /app/v2/scripts/docker/default-config-standalone.cfg /app/docker/
 
 # Just what we need
 COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init

v2/pkg/handler/ldapopshelper.go

@@ -603,11 +603,14 @@ func (l LDAPOpsHelper) findUser(h LDAPOpsHandler, bindDN string, checkGroup bool
 		userName := ""
 		if len(parts) == 1 {
 			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
-		} else if len(parts) == 2 {
+		} else if len(parts) == 2 || (len(parts) == 3 && parts[2] == fmt.Sprintf("%s=users", h.GetBackend().GroupFormat)) {
 			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
 			groupName = strings.TrimPrefix(parts[1], h.GetBackend().GroupFormat+"=")
 		} else {
 			h.GetLog().V(2).Info("BindDN should have only one or two parts", "binddn", bindDN, "numparts", len(parts))
+			for _, part := range parts {
+				h.GetLog().V(2).Info("Parts", "part", part)
+			}
 			return nil, ldap.LDAPResultInvalidCredentials
 		}
 

v2/pkg/plugins/Makefile

@@ -29,6 +29,9 @@ plugins_darwin: plugins_darwin_amd64 plugins_darwin_arm64
 plugins_linux_amd64:
 	PLUGIN_OS=linux PLUGIN_ARCH=amd64 make plugins
 
+plugins_linux_arm64:
+	PLUGIN_OS=linux PLUGIN_ARCH=arm64 make plugins
+
 plugins_darwin_amd64:
 	PLUGIN_OS=darwin PLUGIN_ARCH=amd64 make plugins
 

v2/scripts/ship-docker-build.sh

@@ -18,10 +18,17 @@ prepare_image() {
     profile="$1"
     img="localhost/$(image_name $profile)"
 
+    inform "Deleting local builds to avoid future surprises."
+    rm -rf bin
+    inform "Mounting pseudo app directory to expose parent to current context."
+    mkdir -p local/app
+    sudo mount -o bind .. local/app/
     inform "Building profile: $profile container: $img"
     podman build --security-opt seccomp=scripts/docker/fastat-workaround.json -f Dockerfile-$profile -t $img
+    sudo umount local/app
 
     inform "Starting registry"
+    mkdir -p local/registry
     podman run -d --name registry -p 5000:5000 -v ./local/registry:/var/lib/registry --restart=unless-stopped registry:2
 
     inform "Pushing image to container"

v2/tools/release.sh

@@ -11,7 +11,16 @@ REMOTE_HOST=192.168.1.36
 # Exit immediataly on error code
 set -e
 
+info() {
+  echo ""
+  echo "################################################################################"
+  echo "$1"
+  echo "################################################################################"
+  echo ""
+}
+
 remoteprepare() {
+  info "Preparing remote environment for execution"
   ssh $REMOTE_HOST mkdir -p $REMOTE_ROOT/tools
   scp $LOCAL_ROOT/tools/release.sh $REMOTE_HOST:$REMOTE_ROOT/tools/release.sh
   ssh $REMOTE_HOST chmod +x $REMOTE_ROOT/tools/release.sh
@@ -19,6 +28,7 @@ remoteprepare() {
 
 localmake() {
   branch="$1"
+  info "Building local $branch environment"
   cd $LOCAL_ROOT
   git checkout $branch
   git pull
@@ -29,11 +39,13 @@ localmake() {
 
 requestremotemake() {
   branch="$1"
+  info "Requesting remote $branch build"
   ssh -t $REMOTE_HOST GOPATH=$REMOTE_GOPATH PATH=$REMOTE_PATH:\$PATH $REMOTE_ROOT/tools/release.sh $branch iamremote
 }
 
 remotemake() {
   branch="$1"
+  info "Building remote $branch environment"
   cd $REMOTE_ROOT
   git checkout $branch
   git pull
@@ -42,6 +54,7 @@ remotemake() {
 }
 
 retrieveremote() {
+  info "Retrieving remote artifacts"
   for pkg in $(ssh $REMOTE_HOST ls $REMOTE_ROOT/bin); do
     for lib in $(ssh $REMOTE_HOST ls $REMOTE_ROOT/bin/$pkg); do
       scp $REMOTE_HOST:$REMOTE_ROOT/bin/$pkg/$lib $LOCAL_ROOT/bin/$pkg/$lib
@@ -51,6 +64,7 @@ retrieveremote() {
 }
 
 archivelocal() {
+  info "Archiving local artifacts"
   cd bin
   [[ -f *.zip ]] && rm -f *.zip
   for pkg in *; do
@@ -67,15 +81,15 @@ ACT="$1"
 
 case $ACT in
   dev)
-    remoteprepare
     localmake dev
+    remoteprepare
     requestremotemake dev
     retrieveremote
     archivelocal
     ;;
   master)
-    remoteprepare
     localmake master
+    remoteprepare
     requestremotemake master
     retrieveremote
     archivelocal