chore(dev): release 2.3.0 (#337)

The groups table name is a reserved keyword in mysql and requires that
the table name be escaped with backticks in order to use the groups
name. Other databases such as postgres do not support the use of the
backticks in the query statements. This change renames the groups table
to ldapgroups in oder to avoid this problem altogether.

This does have a dependency on the backend sql plugins to alter the
schema to match the new name.

Signed-off-by: Billy Olsen <billy.olsen@gmail.com>
Co-authored-by: Chris F Ravenscroft <chris@voilaweb.com>

.devcontainer/devcontainer.json

@@ -0,0 +1,54 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/go
+{
+	"name": "glauth",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"image": "mcr.microsoft.com/devcontainers/go:0-1.19-bullseye",
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	"features": {
+		"docker-in-docker": {
+			"version": "latest",
+			"moby": true
+		},
+		"ghcr.io/rocker-org/devcontainer-features/apt-packages:1": {
+			"packages": "oathtool,ldap-utils"
+		}
+	},
+
+	// Configure tool-specific properties.
+	"customizations": {
+		// Configure properties specific to VS Code.
+		"vscode": {
+			"settings": {},
+			"extensions": [
+				"golang.go",
+				"ms-azuretools.vscode-docker"
+			]
+		}
+	},
+
+	"containerEnv": {
+		"REPO": "glauth"
+	},
+
+	"capAdd": ["SYS_PTRACE"],
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [9000],
+
+	// Use 'portsAttributes' to set default properties for specific forwarded ports. 
+	// More info: https://containers.dev/implementors/json_reference/#port-attributes
+	"portsAttributes": {
+		"3893": {
+			"label": "LDAP",
+			"onAutoForward": "notify"
+		},
+		"5555": {
+			"label": "Web UI",
+			"onAutoForward": "openBrowser"
+		}
+	},
+
+	"postCreateCommand": "cd v2 && make setup"
+}

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-20.04
     strategy:
       matrix:
-        go-version: [1.16.x, 1.17.x]
+        go-version: [1.19.x, 1.20.x]
     steps:
       - name: Install Go
         uses: actions/setup-go@v2

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master", "dev" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "46 1 * * 3"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/codesee-arch-diagram.yml

@@ -0,0 +1,22 @@
+# This workflow was added by CodeSee. Learn more at https://codesee.io/
+# This is v2.0 of this workflow file
+on:
+  push:
+    branches:
+      - master
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+name: CodeSee
+
+permissions: read-all
+
+jobs:
+  codesee:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    name: Analyze the repo with CodeSee
+    steps:
+      - uses: Codesee-io/codesee-action@v2
+        with:
+          codesee-token: ${{ secrets.CODESEE_ARCH_DIAG_API_TOKEN }}

.github/workflows/release-please.yml

@@ -0,0 +1,24 @@
+on:
+  pull_request:
+  push:
+    branches:
+      - dev
+
+permissions:
+  contents: write
+  pull-requests: write
+
+name: release-please
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: google-github-actions/release-please-action@v3
+        with:
+          release-type: go
+          package-name: GLAuth
+          path: v2
+          default-branch: dev
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}

.gitignore

@@ -3,3 +3,4 @@ v2/certs/
 v2/bin
 v2/docker/assets/linux
 v2/gl.db
+.vscode/

.gitmodules

@@ -0,0 +1,12 @@
+[submodule "v2/pkg/plugins/glauth-sqlite"]
+	path = v2/pkg/plugins/glauth-sqlite
+	url = https://github.com/glauth/glauth-sqlite
+[submodule "v2/pkg/plugins/glauth-mysql"]
+	path = v2/pkg/plugins/glauth-mysql
+	url = https://github.com/glauth/glauth-mysql
+[submodule "v2/pkg/plugins/glauth-postgres"]
+	path = v2/pkg/plugins/glauth-postgres
+	url = https://github.com/glauth/glauth-postgres
+[submodule "v2/pkg/plugins/glauth-pam"]
+	path = v2/pkg/plugins/glauth-pam
+	url = https://github.com/glauth/glauth-pam

README.md

@@ -19,7 +19,23 @@ Go-lang LDAP Authentication (GLAuth) is a secure, easy-to-use, LDAP server w/ co
 
 Use it to centralize account management across your Linux servers, your OSX machines, and your support applications (Jenkins, Apache/Nginx, Graylog2, and many more!).
 
-<hr>
+### Contributing
+- Please base all Pull Requests on [dev](https://github.com/glauth/glauth/tree/dev), not master.
+- Format your code autonmatically using `gofmt -d ./` before committing
+
+### Quickstart
+This quickstart is a great way to try out GLAuth in a non-production environment.  *Be warned that you should take the extra steps to setup SSL (TLS) for production use!*
+
+1. Download a precompiled binary from the [releases](https://github.com/glauth/glauth/releases) page.
+2. Download the [example config file](https://github.com/glauth/glauth/blob/master/v2/sample-simple.cfg).
+3. Start the GLAuth server, referencing the path to the desired config file with `-c`.
+   - `./glauth64 -c sample-simple.cfg`
+4. Test with traditional LDAP tools
+   - For example: `ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com cn=hackers`
+
+### Make Commands
+
+Note - makefile uses git data to inject build-time variables. For best results, run in the context of the git repo.
 
 ### Documentation
 

go.work

@@ -0,0 +1,3 @@
+go 1.19
+
+use ./v2

v2/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+## [2.3.0](https://github.com/glauth/glauth/compare/v2.2.0...v2.3.0) (2023-10-02)
+
+
+### ⚠ BREAKING CHANGES
+
+* **plugins:** Rename the groups table to ldapgroups ([#326](https://github.com/glauth/glauth/issues/326))
+
+### Features
+
+* Update migration code to support table names ([#339](https://github.com/glauth/glauth/issues/339)) ([349431c](https://github.com/glauth/glauth/commit/349431c6caa0388d17ab987621eb9be5f019155e))
+
+
+### Bug Fixes
+
+* **plugins:** Rename the groups table to ldapgroups ([#326](https://github.com/glauth/glauth/issues/326)) ([675b236](https://github.com/glauth/glauth/commit/675b236328a21a65daa7876a1a3c6900b85b1964))
+
+
+### Miscellaneous Chores
+
+* release 2.3.0 ([0c11325](https://github.com/glauth/glauth/commit/0c11325a2482d5067c805a4c7ed948a5e337b8f8))

v2/Makefile

@@ -1,3 +1,5 @@
+.DEFAULT_GOAL := help
+
 VERSION=$(shell bin/linuxamd64/glauth --version)
 
 GIT_COMMIT=$(shell git rev-list -1 HEAD )
@@ -14,37 +16,48 @@ GIT_IS_TAG_COMMIT=$(shell git describe --abbrev=0 --tags > /dev/null 2> /dev/nul
 GIT_BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
 
 # Build variables
-BUILD_VARS=-s -w -X main.GitCommit=${GIT_COMMIT} -X main.GitBranch=${GIT_BRANCH} -X main.BuildTime=${BUILD_TIME} -X main.GitClean=${GIT_CLEAN} -X main.LastGitTag=${LAST_GIT_TAG} -X main.GitTagIsCommit=${GIT_IS_TAG_COMMIT}
-BUILD_FILES=glauth.go
-TRIM_FLAGS=-gcflags "all=-trimpath=${PWD}" -asmflags "all=-trimpath=${PWD}"
+BUILD_VARS?=-s -w -X main.GitCommit=${GIT_COMMIT} -X main.GitBranch=${GIT_BRANCH} -X main.BuildTime=${BUILD_TIME} -X main.GitClean=${GIT_CLEAN} -X main.LastGitTag=${LAST_GIT_TAG} -X main.GitTagIsCommit=${GIT_IS_TAG_COMMIT}
+BUILD_FILES=.
+TRIM_FLAGS>?=-trimpath
 
 # Targets
 MAIN_TARGETS=linux/amd64,linux/386,linux/arm64,linux/arm-7,darwin/amd64,darwin/arm64,windows/amd64,windows/386
 PLUGIN_TARGETS=linux/amd64,linux/386,linux/arm64,linux/arm-7,darwin/amd64,darwin/arm64
 
+# For release process
+GO_RELEASE_V=$(shell go version | { read _ _ v _; echo $${v#go}; })
+
+# Build
+GOOS?=linux
+GOARCH?=amd64
+
 # Plugins
-include pkg/plugins/*/Makefile
+-include pkg/plugins/*/Makefile
 
 #####################
 # High level commands
 #####################
 
-# Build and run - used for development
+#help: @ List available tasks on this project
+help: 
+	@grep -E '[a-zA-Z\.\-]+:.*?@ .*$$' $(MAKEFILE_LIST)| tr -d '#' | sed -E 's/Makefile.//' | awk 'BEGIN {FS = ":.*?@ "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+#run: @ build and run - used for development
 run: setup devrun
 
-# Run the integration test on linuxamd64 (eventually allow the binary to be set)
+#test: @ runs the integration test on linuxamd64 (eventually allow the binary to be set)
 test: runtest
 
-# Run build process for all binaries
+#all: @ run build process for all binaries
 all: setup binaries verify
 
-# Run build process for only linuxamd64
+#fast: @ run build process for only linuxamd64
 fast: setup linuxamd64
 
-# list of binary formats to build
+#binaries: @ list of binary formats to build
 binaries: linux386 linuxamd64 linuxarm linuxarm64 darwinamd64 darwinarm64 win386 winamd64
 
-# Setup commands to always run
+#setup: @ setup commands to always run
 setup: getdeps format
 
 #####################
@@ -68,29 +81,43 @@ format:
 devrun:
 	go run ${BUILD_FILES} -c sample-simple.cfg
 
+mkbindir:
+	@echo "create directory bin/$(GOOS)$(GOARCH)"
+	@mkdir -p bin/$(GOOS)$(GOARCH)
+.PHONY: mkbindir
+
+build: mkbindir
+	@go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$(GOOS)$(GOARCH)/glauth -buildvcs .
+	$(MAKE) sha256
+.PHONY: build
+
+sha256:
+	@sha256sum bin/$(GOOS)$(GOARCH)/glauth > bin/$(GOOS)$(GOARCH)/glauth.sha256
+.PHONY: sha256
+
 linux386:
-	mkdir -p bin/$@ && GOOS=linux GOARCH=386 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=linux GOARCH=386 $(MAKE) build
 
 linuxamd64:
-	mkdir -p bin/$@ && GOOS=linux GOARCH=amd64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=linux GOARCH=amd64 $(MAKE) build
 
 linuxarm:
-	mkdir -p bin/$@ && GOOS=linux GOARCH=arm go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=linux GOARCH=arm $(MAKE) build
 
 linuxarm64:
-	mkdir -p bin/$@ && GOOS=linux GOARCH=arm64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=linux GOARCH=arm64 $(MAKE) build
 
 darwinamd64:
-	mkdir -p bin/$@ && GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 $(MAKE) build
 
 darwinarm64:
-	mkdir -p bin/$@ && GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 $(MAKE) build
 
 win386:
-	mkdir -p bin/$@ && GOOS=windows GOARCH=386 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=windows GOARCH=386 $(MAKE) build
 
 winamd64:
-	mkdir -p bin/$@ && GOOS=windows GOARCH=amd64 go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$@/glauth ${BUILD_FILES} && cd bin/$@ && sha256sum glauth > glauth.sha256
+	GOOS=windows GOARCH=amd64 $(MAKE) build
 
 verify:
 	@for binary in linux386 linuxamd64 linuxarm linuxarm64 darwinamd64 darwinarm64 win386 winamd64; do cd bin/$$binary && sha256sum glauth.sha256 -c && cd ../..; done
@@ -99,6 +126,7 @@ pull-plugin:
 	@git submodule add $U $M && \
 	(for pkg in $$(cat $$M/go.mod | awk '/^require [a-z]/{print $$2} /^\)/{rblock=0} rblock{if($$4!="indirect" && $$1!~"glauth"){print $$1}} /^require \(/{rblock=1}'); do if [ "$$(grep $$pkg go.mod &>/dev/null)" = "" ]; then go get $$pkg; fi; done)
 
+#pull-base-plugins: @ pull plugins for local building
 pull-base-plugins:
 	@U=https://github.com/glauth/glauth-sqlite M=pkg/plugins/glauth-sqlite make pull-plugin && \
 	U=https://github.com/glauth/glauth-mysql M=pkg/plugins/glauth-mysql make pull-plugin && \
@@ -111,21 +139,24 @@ forget-plugin:
 	git rm --cache $M && \
 	go mod tidy
 
+#forget-plugin: @ remove plugins, restoring original file structure
 forget-plugins:
 	for pkg in pkg/plugins/*/go.mod; do\
 		P=$$(echo $$pkg | cut -d'/' -f 3) M=$$(dirname $$pkg) make forget-plugin;\
 	done
 
+#releasemain: @ build main binaries for distribution
 releasemain:
-	@xgo -v -ldflags="${BUILD_VARS}" -trimpath -go 1.18.1 -out glauth -dest bin -buildvcs=false --targets="${MAIN_TARGETS}" .
+	@xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out glauth -dest bin -buildvcs=false --targets="${MAIN_TARGETS}" .
 
 releaseplugin:
-	@xgo -v -ldflags="${BUILD_VARS}" -trimpath -go 1.18.1 -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go . && \
-	(cd bin && for lib in $$(ls $$P-*); do mv $$lib $$lib.so; done)
+	@xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go . && \
+	(cd bin && for lib in $$(ls $$P-*); do sudo mv $$lib $$lib.so; done)
 
+#releaseplugins: @ build base plugins for distribution
 releaseplugins:
 	@for pkg in pkg/plugins/*/go.mod; do\
-		P=$$(echo $$pkg | cut -d'/' -f 3) && make release-$$P;\
+		M=pkg/plugins/$$(echo $$pkg | cut -d'/' -f 3) && P=$$(echo $$M | grep -oP 'glauth-\K\w+') && M=$$M P=$$P make releaseplugin;\
 	done
 
 releasedockermain:
@@ -154,6 +185,7 @@ releasedockerplugins:
 
 releasedocker: releasedockermain releasedockerplugins
 
+#testdocker: @ run integration test using docker
 testdocker:
 	$(if $(REPO),,$(error Must set REPO - glauth or other))
 	@echo "==> Cleaning up any existing image to be on the safe side..." && \

v2/glauth.go

@@ -17,9 +17,6 @@ import (
 	"github.com/rs/zerolog"
 	"gopkg.in/amz.v3/aws"
 	"gopkg.in/amz.v3/s3"
-	"io"
-	"io/ioutil"
-	"log/syslog"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -50,6 +47,7 @@ Options:
   -K <aws_key_id>           AWS Key ID.
   -S <aws_secret_key>       AWS Secret Key.
   -r <aws_region>           AWS Region [default: us-east-1].
+  --aws_endpoint_url <url>  Custom S3 endpoint.
   --ldap <address>          Listen address for the LDAP server.
   --ldaps <address>         Listen address for the LDAPS server.
   --ldaps-cert <cert-file>  Path to cert file for the LDAPS server.
@@ -271,10 +269,17 @@ func parseConfigFile(configFileLocation string) (*config.Config, error) {
 
 	// parse the config file
 	if strings.HasPrefix(configFileLocation, "s3://") {
-		if _, present := aws.Regions[args["-r"].(string)]; present == false {
+		region, present := aws.Regions[args["-r"].(string)]
+		if present == false {
 			return &cfg, fmt.Errorf("invalid AWS region: %s", args["-r"])
 		}
-		region := aws.Regions[args["-r"].(string)]
+		if args["--aws_endpoint_url"] != nil {
+			region = aws.Region{
+				Name:       "User defined",
+				S3Endpoint: args["--aws_endpoint_url"].(string),
+			}
+			present = true
+		}
 		auth, err := aws.EnvAuth()
 		if err != nil {
 			if args["-K"] == nil || args["-S"] == nil {
@@ -330,11 +335,11 @@ func parseConfigFile(configFileLocation string) (*config.Config, error) {
 				}
 			*/
 
-			files, _ := ioutil.ReadDir(configFileLocation)
+			files, _ := os.ReadDir(configFileLocation)
 			for _, f := range files {
 				canonicalName := filepath.Join(configFileLocation, f.Name())
 
-				bs, _ := ioutil.ReadFile(canonicalName)
+				bs, _ := os.ReadFile(canonicalName)
 				var curRawCfgStruct interface{}
 				if err := toml.Unmarshal(bs, &curRawCfgStruct); err != nil {
 					return &cfg, err
@@ -768,7 +773,7 @@ func doConfig(checkConfig bool) error {
 
 	// Handle logging settings for new config
 	// - we do this last to make sure we only respect a fully validated config
-	initLogging(activeConfig.Debug, activeConfig.Syslog, activeConfig.StructuredLog)
+	log = logging.InitLogging(activeConfig.Debug, activeConfig.Syslog, activeConfig.StructuredLog)
 
 	if !checkConfig {
 		if activeConfig.Debug {
@@ -781,40 +786,3 @@ func doConfig(checkConfig bool) error {
 
 	return nil
 }
-
-// initLogging sets up logging to stderr
-func initLogging(reqdebug bool, reqsyslog bool, reqstructlog bool) {
-	var level zerolog.Level
-	if reqdebug {
-		level = zerolog.DebugLevel
-	} else {
-		level = zerolog.InfoLevel
-	}
-
-	var mainWriter io.Writer
-	if reqstructlog {
-		// Vroom vroom
-		mainWriter = os.Stderr
-		zerolog.TimeFieldFormat = time.RFC1123Z
-	} else {
-		// This is the inefficient writer
-		mainWriter = zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.RFC1123Z}
-	}
-
-	if reqsyslog {
-		s, err := syslog.New(syslog.LOG_INFO, "glauth")
-		if err != nil {
-			fmt.Println("Unable to write to syslog: ignoring...")
-			reqsyslog = false
-		} else {
-			writers := zerolog.MultiLevelWriter(mainWriter, zerolog.SyslogLevelWriter(s))
-			log = zerolog.New(writers).Level(level).With().Timestamp().Logger()
-		}
-	}
-
-	if !reqsyslog {
-		log = zerolog.New(mainWriter).Level(level).With().Timestamp().Logger()
-	}
-
-	logging.RewireLogging(log, reqstructlog)
-}

v2/go.mod

@@ -1,6 +1,6 @@
 module github.com/glauth/glauth/v2
 
-go 1.16
+go 1.19
 
 // Do not mistake /vendored for /vendor!
 replace github.com/hydronica/toml => ./vendored/toml
@@ -8,20 +8,37 @@ replace github.com/hydronica/toml => ./vendored/toml
 require (
 	github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e
 	github.com/arl/statsviz v0.4.0
-	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
 	github.com/fsnotify/fsnotify v1.4.9
-	github.com/go-logr/logr v0.4.0
 	github.com/hydronica/toml v0.4.2
 	github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a
 	github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba
-	github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
 	github.com/pquerna/otp v1.3.0
 	github.com/prometheus/client_golang v1.13.0
 	github.com/rs/zerolog v1.28.0
 	github.com/smartystreets/goconvey v1.6.4
 	github.com/yaegashi/msgraph.go v0.1.1-0.20200221123608-2d438cf2a7cc
-	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
+	golang.org/x/crypto v0.1.0
 	gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/boombuler/barcode v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.1.2 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 // indirect
+	github.com/gorilla/websocket v1.4.2 // indirect
+	github.com/jtolds/gls v4.20.0+incompatible // indirect
+	github.com/mattn/go-colorable v0.1.12 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 // indirect
+	github.com/prometheus/client_model v0.2.0 // indirect
+	github.com/prometheus/common v0.37.0 // indirect
+	github.com/prometheus/procfs v0.8.0 // indirect
+	github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d // indirect
+	golang.org/x/sys v0.6.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 )

v2/go.sum

@@ -81,8 +81,6 @@ github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
-github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc=
-github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
@@ -126,7 +124,6 @@ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -188,8 +185,6 @@ github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 h1:D9EvfGQvlkKaD
 github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484/go.mod h1:O1EljZ+oHprtxDDPHiMWVo/5dBT6PlvWX5PSwj80aBA=
 github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba h1:DO8NFYdcRv1dnyAINJIBm6Bw2XibtLvQniNFGzf2W8E=
 github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba/go.mod h1:4S0XndRL8HNOaQBfdViJ2F/GPCgL524xlXRuXFH12/U=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 h1:lDH9UUVJtmYCjyT0CI4q8xvlXPxeZ0gYCVvWbmPlp88=
-github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -255,8 +250,8 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=
-golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
+golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -315,7 +310,6 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -335,7 +329,6 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -377,8 +370,8 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a h1:dGzPydgVsqGcTRVwiLJ1jVbufYwmzD3LfVPLKsKg+0k=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

v2/pkg/assets/embed.go

@@ -3,5 +3,6 @@ package assets
 import "embed"
 
 // Content is the embedded assets.
+//
 //go:embed *.tgz js/* css/* *.html
 var Content embed.FS

v2/pkg/config/config.go

@@ -60,6 +60,7 @@ type Behaviors struct {
 	BlockFailedBindsFor   time.Duration
 	PruneSourceTableEvery time.Duration
 	PruneSourcesOlderThan time.Duration
+	LegacyVersion         int
 }
 type Capability struct {
 	Action string

v2/pkg/frontend/webapi.go

@@ -6,7 +6,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/rs/zerolog"
-	"io/ioutil"
+	"io"
 	"log"
 	"net/http"
 	"regexp"
@@ -100,7 +100,7 @@ func (c *collector) Collect(ch chan<- prometheus.Metric) {
 		return
 	}
 
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		log.Printf("Error reading body of %q: %v", c.url, err)
 		return

v2/pkg/handler/config.go

@@ -116,7 +116,7 @@ func (h configHandler) FindPosixAccounts(hierarchy string) (entrylist []*ldap.En
 
 	for _, u := range h.cfg.Users {
 		attrs := []*ldap.EntryAttribute{}
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{u.Name}})
+		attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.NameFormat, Values: []string{u.Name}})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{u.Name}})
 
 		if len(u.GivenName) > 0 {
@@ -210,7 +210,7 @@ func (h configHandler) FindPosixGroups(hierarchy string) (entrylist []*ldap.Entr
 
 	for _, g := range h.cfg.Groups {
 		attrs := []*ldap.EntryAttribute{}
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{g.Name}})
+		attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.GroupFormat, Values: []string{g.Name}})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{g.Name}})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s", g.Name)}})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.GIDNumber)}})
@@ -235,15 +235,21 @@ func (h configHandler) Close(boundDn string, conn net.Conn) error {
 }
 
 func (h configHandler) getGroupMemberDNs(gid int) []string {
+	var insertOuUsers string
+	if h.cfg.Behaviors.LegacyVersion > 0 && h.cfg.Behaviors.LegacyVersion <= 20100 {
+		insertOuUsers = ""
+	} else {
+		insertOuUsers = ",ou=users"
+	}
 	members := make(map[string]bool)
 	for _, u := range h.cfg.Users {
 		if u.PrimaryGroup == gid {
-			dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 			members[dn] = true
 		} else {
 			for _, othergid := range u.OtherGroups {
 				if othergid == gid {
-					dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
+					dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 					members[dn] = true
 				}
 			}

v2/pkg/handler/ldap.go

@@ -88,7 +88,6 @@ func NewLdapHandler(opts ...Option) Handler {
 	return handler
 }
 
-//
 func (h ldapHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resultCode ldap.LDAPResultCode, err error) {
 	h.log.Debug().Str("binddn", bindDN).Str("src", conn.RemoteAddr().String()).Msg("Bind request")
 
@@ -154,7 +153,6 @@ func (h ldapHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (resultCod
 	return ldap.LDAPResultSuccess, nil
 }
 
-//
 func (h ldapHandler) Search(boundDN string, searchReq ldap.SearchRequest, conn net.Conn) (result ldap.ServerSearchResult, err error) {
 	wantAttributes := true
 	wantTypesOnly := false
@@ -362,7 +360,6 @@ func (h *ldapHandler) monitorServers() {
 	}()
 }
 
-//
 func (h ldapHandler) getSession(conn net.Conn) (ldapSession, error) {
 	id := connID(conn)
 	h.lock.Lock()
@@ -399,7 +396,6 @@ func (h ldapHandler) getSession(conn net.Conn) (ldapSession, error) {
 	return s, nil
 }
 
-//
 func (h ldapHandler) ping() error {
 	healthy := false
 	for k, s := range h.servers {
@@ -442,7 +438,6 @@ func (h ldapHandler) ping() error {
 	return nil
 }
 
-//
 func (h ldapHandler) getBestServer() (ldapBackend, error) {
 	favorite := ldapBackend{}
 	forever, err := time.ParseDuration("30m")

v2/pkg/handler/ldapopshelper.go

@@ -6,7 +6,6 @@ import (
 	"encoding/hex"
 	"fmt"
 	"github.com/rs/zerolog"
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -371,7 +370,7 @@ func (l LDAPOpsHelper) searchMaybeSchemaQuery(h LDAPOpsHandler, baseDN string, s
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "modifiersName", Values: []string{"cn=Directory Manager"}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "modifyTimeStamp", Values: []string{"Mar 8, 2021, 12:46:29 PM PST (20210308204629Z)"}})
 	// Iterate through schema attributes provided in schema/ directory
-	filenames, _ := ioutil.ReadDir("schema")
+	filenames, _ := os.ReadDir("schema")
 	for _, filename := range filenames {
 		attributename := new(string)
 		*attributename = filename.Name()
@@ -530,10 +529,19 @@ func (l LDAPOpsHelper) searchMaybePosixAccounts(h LDAPOpsHandler, baseDN string,
 		hierarchyString = "ou=users"
 	}
 
-	entries, err := h.FindPosixAccounts(hierarchyString)
+	unscopedEntries, err := h.FindPosixAccounts(hierarchyString)
 	if err != nil {
 		return nil, ldap.LDAPResultOperationsError
 	}
+
+	// Filter out entries, that are not in the search base dn
+	entries := []*ldap.Entry{}
+	for _, e := range unscopedEntries {
+		if strings.HasSuffix(e.DN, searchBaseDN) {
+			entries = append(entries, e)
+		}
+	}
+
 	stats.Frontend.Add("search_successes", 1)
 	h.GetLog().Info().Str("filter", searchReq.Filter).Msg("AP: Account Search OK")
 	return entries, ldap.LDAPResultSuccess
@@ -614,7 +622,7 @@ func (l LDAPOpsHelper) findUser(h LDAPOpsHandler, bindDN string, checkGroup bool
 		userName := ""
 		if len(parts) == 1 {
 			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
-		} else if len(parts) == 2 || (len(parts) == 3 && parts[2] == fmt.Sprintf("%s=users", h.GetBackend().GroupFormat)) {
+		} else if len(parts) == 2 || (len(parts) == 3 && parts[2] == "ou=users") {
 			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
 			groupName = strings.TrimPrefix(parts[1], h.GetBackend().GroupFormat+"=")
 		} else {

v2/pkg/handler/owncloud.go

@@ -7,7 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"github.com/rs/zerolog"
-	"io/ioutil"
+	"io"
 	"net"
 	"net/http"
 	"strings"
@@ -121,7 +121,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 		}
 		for _, g := range groups {
 			attrs := []*ldap.EntryAttribute{}
-			attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{*g.ID}})
+			attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.GroupFormat, Values: []string{*g.ID}})
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *g.ID)}})
 			//			attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}})
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}})
@@ -133,7 +133,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 
 				attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: members})
 			}
-			dn := fmt.Sprintf("cn=%s,%s=groups,%s", *g.ID, h.backend.GroupFormat, h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormat, *g.ID, h.backend.BaseDN)
 			entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
 		}
 	case "posixaccount", "":
@@ -151,7 +151,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 		}
 		for _, u := range users {
 			attrs := []*ldap.EntryAttribute{}
-			attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{*u.ID}})
+			attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.NameFormat, Values: []string{*u.ID}})
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{*u.ID}})
 			if u.DisplayName != nil {
 				attrs = append(attrs, &ldap.EntryAttribute{Name: "givenName", Values: []string{*u.DisplayName}})
@@ -255,7 +255,7 @@ func (s ownCloudSession) getGroups() ([]msgraph.Group, error) {
 		return nil, err
 	}
 	defer resp.Body.Close()
-	b, err := ioutil.ReadAll(resp.Body)
+	b, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -326,7 +326,7 @@ func (s ownCloudSession) getUsers(userName string) ([]msgraph.User, error) {
 		return nil, err
 	}
 	defer resp.Body.Close()
-	b, err := ioutil.ReadAll(resp.Body)
+	b, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}

v2/pkg/logging/loghandler_other.go

@@ -0,0 +1,84 @@
+//go:build !windows
+// +build !windows
+
+package logging
+
+import (
+	"fmt"
+	"github.com/rs/zerolog"
+	"io"
+	"log"
+	"log/syslog"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+)
+
+// We will use this package to wrap log messages coming from libraries who have no interest
+// in generating structured output.
+
+var (
+	ldapliblogmatcher = regexp.MustCompile(`^\d{4}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2} `)
+)
+
+func InitLogging(reqdebug bool, reqsyslog bool, reqstructlog bool) zerolog.Logger {
+	var level zerolog.Level
+	if reqdebug {
+		level = zerolog.DebugLevel
+	} else {
+		level = zerolog.InfoLevel
+	}
+
+	var mainWriter io.Writer
+	if reqstructlog {
+		// Vroom vroom
+		mainWriter = os.Stderr
+		zerolog.TimeFieldFormat = time.RFC1123Z
+	} else {
+		// This is the inefficient writer
+		mainWriter = zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.RFC1123Z}
+	}
+
+	var logr zerolog.Logger
+	if reqsyslog {
+		s, err := syslog.New(syslog.LOG_INFO, "glauth")
+		if err != nil {
+			fmt.Println("Unable to write to syslog: ignoring...")
+			reqsyslog = false
+		} else {
+			writers := zerolog.MultiLevelWriter(mainWriter, zerolog.SyslogLevelWriter(s))
+			logr = zerolog.New(writers).Level(level).With().Timestamp().Logger()
+		}
+	}
+
+	if !reqsyslog {
+		logr = zerolog.New(mainWriter).Level(level).With().Timestamp().Logger()
+	}
+
+	log.SetOutput(customWriter{logr: logr, structlog: reqstructlog})
+
+	return logr
+}
+
+type customWriter struct {
+	logr      zerolog.Logger
+	structlog bool
+}
+
+func (e customWriter) Write(p []byte) (int, error) {
+	submatchall := ldapliblogmatcher.FindAllString(string(p), 1)
+	var msg string
+	for _, element := range submatchall {
+		msg = strings.TrimSpace(string(p[len(element):]))
+	}
+	if msg == "" {
+		msg = strings.TrimSpace(string(p))
+	}
+	if e.structlog {
+		fmt.Fprintf(os.Stderr, "{\"level\":\"info\",\"time\":\"%s\",\"message\":\"%s\"}\n", time.Now().Format(time.RFC1123Z), strings.Replace(strings.TrimSpace(msg), `"`, `\"`, -1))
+	} else {
+		e.logr.Info().Msg(msg)
+	}
+	return len(p), nil
+}

v2/pkg/logging/loghandler_windows.go

@@ -1,8 +1,12 @@
+//go:build windows
+// +build windows
+
 package logging
 
 import (
 	"fmt"
 	"github.com/rs/zerolog"
+	"io"
 	"log"
 	"os"
 	"regexp"
@@ -17,8 +21,29 @@ var (
 	ldapliblogmatcher = regexp.MustCompile(`^\d{4}\/\d{1,2}\/\d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2} `)
 )
 
-func RewireLogging(logr zerolog.Logger, reqstructlog bool) {
+func InitLogging(reqdebug bool, reqsyslog bool, reqstructlog bool) zerolog.Logger {
+	var level zerolog.Level
+	if reqdebug {
+		level = zerolog.DebugLevel
+	} else {
+		level = zerolog.InfoLevel
+	}
+
+	var mainWriter io.Writer
+	if reqstructlog {
+		// Vroom vroom
+		mainWriter = os.Stderr
+		zerolog.TimeFieldFormat = time.RFC1123Z
+	} else {
+		// This is the inefficient writer
+		mainWriter = zerolog.ConsoleWriter{Out: os.Stderr, TimeFormat: time.RFC1123Z}
+	}
+
+	logr := zerolog.New(mainWriter).Level(level).With().Timestamp().Logger()
+
 	log.SetOutput(customWriter{logr: logr, structlog: reqstructlog})
+
+	return logr
 }
 
 type customWriter struct {

v2/pkg/plugins/basesqlhandler.go

@@ -28,7 +28,7 @@ type SqlBackend interface {
 	// Create db/schema if necessary
 	CreateSchema(db *sql.DB)
 	// Migrate schema if necessary
-	MigrateSchema(db *sql.DB, checker func(*sql.DB, string) bool)
+	MigrateSchema(db *sql.DB, checker func(*sql.DB, string, string) bool)
 	//
 	GetPrepareSymbol() string
 }
@@ -88,14 +88,11 @@ func NewDatabaseHandler(sqlBackend SqlBackend, opts ...handler.Option) handler.H
 	return handler
 }
 
-func ColumnExists(db *sql.DB, columnName string) bool {
+func ColumnExists(db *sql.DB, tableName string, columnName string) bool {
 	var found string
-	err := db.QueryRow(fmt.Sprintf(`SELECT COUNT(%s) FROM users`, columnName)).Scan(
+	err := db.QueryRow(fmt.Sprintf(`SELECT COUNT(%s) FROM %s`, columnName, tableName)).Scan(
 		&found)
-	if err != nil {
-		return false
-	}
-	return true
+	return err == nil
 }
 
 func (h databaseHandler) GetBackend() config.Backend {
@@ -184,7 +181,7 @@ func (h databaseHandler) FindGroup(groupName string) (f bool, g config.Group, er
 	found := false
 
 	err = h.database.cnx.QueryRow(fmt.Sprintf(`
-			SELECT g.gidnumber FROM groups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan(
+			SELECT g.gidnumber FROM ldapgroups g WHERE lower(name)=%s`, h.sqlBackend.GetPrepareSymbol()), groupName).Scan(
 		&group.GIDNumber)
 	if err == nil {
 		found = true
@@ -313,10 +310,10 @@ func (h databaseHandler) commaListToStringTable(commaList string) []string {
 func (h databaseHandler) memoizeGroups() ([]config.Group, error) {
 	workMemGroups := make([]*config.Group, 0)
 	rows, err := h.database.cnx.Query(`
-		SELECT g1.name,g1.gidnumber,ig.includegroupid
-		FROM groups g1 
+		SELECT g1.name,g1.gidnumber,ig.includegroupid 
+		FROM ldapgroups g1 
 		LEFT JOIN includegroups ig ON g1.gidnumber=ig.parentgroupid 
-		LEFT JOIN groups g2 ON ig.includegroupid=g2.gidnumber`)
+		LEFT JOIN ldapgroups g2 ON ig.includegroupid=g2.gidnumber`)
 	if err != nil {
 		return nil, errors.New("Unable to memoize groups list")
 	}
@@ -350,6 +347,12 @@ func (h databaseHandler) memoizeGroups() ([]config.Group, error) {
 }
 
 func (h databaseHandler) getGroupMemberDNs(gid int) []string {
+	var insertOuUsers string
+	if h.cfg.Behaviors.LegacyVersion > 0 && h.cfg.Behaviors.LegacyVersion <= 20100 {
+		insertOuUsers = ""
+	} else {
+		insertOuUsers = ",ou=users"
+	}
 	members := make(map[string]bool)
 
 	rows, err := h.database.cnx.Query(`
@@ -369,13 +372,13 @@ func (h databaseHandler) getGroupMemberDNs(gid int) []string {
 			return []string{}
 		}
 		if u.PrimaryGroup == gid {
-			dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 			members[dn] = true
 		} else {
 			u.OtherGroups = h.commaListToIntTable(otherGroups)
 			for _, othergid := range u.OtherGroups {
 				if othergid == gid {
-					dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), h.backend.BaseDN)
+					dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 					members[dn] = true
 				}
 			}
@@ -510,7 +513,7 @@ func (h databaseHandler) getGroup(hierarchy string, g config.Group) *ldap.Entry
 	asGroupOfUniqueNames := hierarchy == "ou=groups"
 
 	attrs := []*ldap.EntryAttribute{}
-	attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{g.Name}})
+	attrs = append(attrs, &ldap.EntryAttribute{h.backend.GroupFormat, []string{g.Name}})
 	attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", g.Name)}})
 	attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}})
 	attrs = append(attrs, &ldap.EntryAttribute{"uniqueMember", h.getGroupMemberDNs(g.GIDNumber)})
@@ -526,7 +529,7 @@ func (h databaseHandler) getGroup(hierarchy string, g config.Group) *ldap.Entry
 
 func (h databaseHandler) getAccount(hierarchy string, u config.User) *ldap.Entry {
 	attrs := []*ldap.EntryAttribute{}
-	attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{u.Name}})
+	attrs = append(attrs, &ldap.EntryAttribute{h.backend.NameFormat, []string{u.Name}})
 	attrs = append(attrs, &ldap.EntryAttribute{"uid", []string{u.Name}})
 
 	if len(u.GivenName) > 0 {

v2/sample-simple.cfg

@@ -23,7 +23,7 @@ debug = true
   listen = "0.0.0.0:3893"
 
 [ldaps]
-# to enable ldaps genrerate a certificate, eg. with:
+# to enable ldaps generate a certificate, eg. with:
 # openssl req -x509 -newkey rsa:4096 -keyout glauth.key -out glauth.crt -days 365 -nodes -subj '/CN=`hostname`'
   enabled = false
   listen = "0.0.0.0:3894"
@@ -37,7 +37,11 @@ debug = true
   baseDN = "dc=glauth,dc=com"
   nameformat = "cn"
   groupformat = "ou"
-  
+
+  # If you are using a client that requires reading the root DSE first
+  # such as SSSD
+  # anonymousdse = true
+
   ## Configure dn format to use structures like 
   ## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN"
   ## to help ease migrations from other LDAP systems

v2/scripts/ci/good-results/posixGroupList0

@@ -1,14 +1,14 @@
 dn: ou=superheros,ou=users,dc=glauth,dc=com
-cn: superheros
+ou: superheros
 uid: superheros
 description: superheros
 gidNumber: 5501
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
+uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=johndoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com
 memberUid: alexdoe
 memberUid: hackers
 memberUid: jackdoe
@@ -19,26 +19,26 @@ objectClass: posixGroup
 objectClass: top
 
 dn: ou=svcaccts,ou=users,dc=glauth,dc=com
-cn: svcaccts
+ou: svcaccts
 uid: svcaccts
 description: svcaccts
 gidNumber: 5502
-uniqueMember: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com
+uniqueMember: cn=serviceuser,ou=svcaccts,ou=users,dc=glauth,dc=com
 memberUid: serviceuser
 objectClass: posixGroup
 objectClass: top
 
 dn: ou=vpnaccess,ou=users,dc=glauth,dc=com
-cn: vpnaccess
+ou: vpnaccess
 uid: vpnaccess
 description: vpnaccess
 gidNumber: 5503
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
+uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=johndoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com
 memberUid: alexdoe
 memberUid: hackers
 memberUid: jackdoe
@@ -49,17 +49,17 @@ objectClass: posixGroup
 objectClass: top
 
 dn: ou=allaccs,ou=users,dc=glauth,dc=com
-cn: allaccs
+ou: allaccs
 uid: allaccs
 description: allaccs
 gidNumber: 5504
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=hackers,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=johndoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=serviceuser,ou=svcaccts,dc=glauth,dc=com
+uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=johndoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=serviceuser,ou=svcaccts,ou=users,dc=glauth,dc=com
 memberUid: alexdoe
 memberUid: hackers
 memberUid: jackdoe
@@ -71,14 +71,14 @@ objectClass: posixGroup
 objectClass: top
 
 dn: ou=mailadmin,ou=users,dc=glauth,dc=com
-cn: mailadmin
+ou: mailadmin
 uid: mailadmin
 description: mailadmin
 gidNumber: 5505
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
+uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com
 memberUid: alexdoe
 memberUid: jackdoe
 memberUid: jamesdoe
@@ -87,7 +87,7 @@ objectClass: posixGroup
 objectClass: top
 
 dn: ou=webmail,ou=users,dc=glauth,dc=com
-cn: webmail
+ou: webmail
 uid: webmail
 description: webmail
 gidNumber: 5506
@@ -95,14 +95,14 @@ objectClass: posixGroup
 objectClass: top
 
 dn: ou=fulltime,ou=users,dc=glauth,dc=com
-cn: fulltime
+ou: fulltime
 uid: fulltime
 description: fulltime
 gidNumber: 5507
-uniqueMember: cn=alexdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jackdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=jamesdoe,ou=superheros,dc=glauth,dc=com
-uniqueMember: cn=sarahdoe,ou=superheros,dc=glauth,dc=com
+uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jackdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=jamesdoe,ou=superheros,ou=users,dc=glauth,dc=com
+uniqueMember: cn=sarahdoe,ou=superheros,ou=users,dc=glauth,dc=com
 memberUid: alexdoe
 memberUid: jackdoe
 memberUid: jamesdoe

v2/vendored/toml/decode.go

@@ -88,7 +88,7 @@ func (md *MetaData) PrimitiveDecode(primValue Primitive, v interface{}) error {
 // a byte string and given to the value's UnmarshalText method. See the
 // Unmarshaler example for a demonstration with time duration strings.
 //
-// Key mapping
+// # Key mapping
 //
 // TOML keys can map to either keys in a Go map or field names in a Go
 // struct. The special `toml` struct tag may be used to map TOML keys to

v2/vendored/toml/doc.go

@@ -10,7 +10,7 @@ The sub-command github.com/BurntSushi/toml/cmd/tomlv can be used to verify
 whether a file is a valid TOML document. It can also be used to print the
 type of each key in a TOML document.
 
-Testing
+# Testing
 
 There are two important types of tests used for this package. The first is
 contained inside '*_test.go' files and uses the standard Go unit testing

v2/vendored/toml/lex.go

@@ -642,7 +642,7 @@ func lexRawString(lx *lexer) stateFn {
 }
 
 // lexMultilineRawString consumes a raw string. Nothing can be escaped in such
-// a string. It assumes that the beginning "'''" has already been consumed and
+// a string. It assumes that the beginning "”'" has already been consumed and
 // ignored.
 func lexMultilineRawString(lx *lexer) stateFn {
 	switch lx.next() {