ci: release 2.4.0 (#423)

* fix: correctly fetch group names on all handlers

* chore: fix tests

.gitignore

@@ -13,6 +13,9 @@ v2/buildlogs
 /vendor/
 /Godeps/
 
+# Various
+go.work.sum
+
 # gomocks auto-generated
 **/mock_*.go
 

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018 Ned McClain & Ben Yanke
+Copyright (c) 2018 Ned McClain & Ben Yanke & Chris Ravenscroft
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

go.work

@@ -1,3 +1,5 @@
-go 1.21
+go 1.21.0
+
+toolchain go1.21.5
 
 use ./v2

v2/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [2.4.0](https://github.com/glauth/glauth/compare/v2.3.2...v2.4.0) (2024-08-04)
+
+
+### Features
+
+* proxying ldap paging compat ([#422](https://github.com/glauth/glauth/issues/422)) ([8476506](https://github.com/glauth/glauth/commit/8476506b8c51e993eb90c73d612f69fec5350b89))
+
+
+### Bug Fixes
+
+* config watcher now updates whenf ile added to dir ([#424](https://github.com/glauth/glauth/issues/424)) ([a90f37b](https://github.com/glauth/glauth/commit/a90f37b23b76af22c700392d68bf227b7aee1894))
+* update ldap library to fix [#389](https://github.com/glauth/glauth/issues/389) ([#430](https://github.com/glauth/glauth/issues/430)) ([a5ecc26](https://github.com/glauth/glauth/commit/a5ecc26e064cea9e4dab3dd234ebd5d5eb06be0e))
+
+## [2.3.2](https://github.com/glauth/glauth/compare/v2.3.1...v2.3.2) (2024-02-19)
+
+
+### Bug Fixes
+
+* remove spinlock in monitoring code ([#405](https://github.com/glauth/glauth/issues/405)) ([a2c151b](https://github.com/glauth/glauth/commit/a2c151b0d025332462369a846a51ef4deff5332b))
+
 ## [2.3.1](https://github.com/glauth/glauth/compare/v2.2.1...v2.3.1) (2024-02-12)
 
 

v2/Makefile

@@ -21,10 +21,12 @@ GIT_BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
 BUILD_VARS?=-s -w
 BUILD_FILES=.
 TRIM_FLAGS>?=-trimpath
+BUILD_TAGS?=noembed
 
 # Targets
 MAIN_TARGETS?=linux/amd64,linux/386,linux/arm64,linux/arm-7,darwin/amd64,darwin/arm64,windows/amd64,windows/386
 PLUGIN_TARGETS?=linux/amd64,linux/386,linux/arm64,linux/arm-7,darwin/amd64,darwin/arm64
+EMBED_TARGETS?=windows/amd64
 
 # For release process
 GO_RELEASE_V=$(shell go version | { read _ _ v _; echo $${v#go}; })
@@ -76,11 +78,26 @@ setup: getdeps format
 #####################
 # Subcommands
 #####################
+#	@echo \- removing any changes and pulling latest master && \
+#	git reset --hard HEAD >/dev/null 2>&1 && \
+#	git checkout master >/dev/null 2>&1 && \
+#	git pull >/dev/null 2>&1 && \
 
 prepbuild:
-	@if [ ! -e $M/.ignore ] ; \
-	then \
-		mkdir -p buildlogs;\
+	echo \- taking care of ignore files && \
+	sudo rm -rf bin/* >/dev/null && \
+	echo \- cleaning up plugins remnants && \
+	make forget-plugins && \
+	make remember-plugins
+
+forget-embed:
+	@if [ -f pkg/server/embed_sqlite.go ]; then \
+		mv pkg/server/embed_sqlite.go /tmp/; \
+	fi
+
+remember-embed:
+	@if [ ! -f pkg/server/embed_sqlite.go ]; then \
+		mv /tmp/embed_sqlite.go pkg/server/; \
 	fi
 
 # Run integration test
@@ -106,7 +123,7 @@ mkbindir:
 .PHONY: mkbindir
 
 build: mkbindir
-	@go build ${TRIM_FLAGS} -ldflags "${BUILD_VARS}" -o bin/$(GOOS)$(GOARCH)/glauth -buildvcs .
+	@go build ${TRIM_FLAGS} -tags ${BUILD_TAGS} -ldflags "${BUILD_VARS}" -o bin/$(GOOS)$(GOARCH)/glauth -buildvcs .
 	$(MAKE) sha256
 .PHONY: build
 
@@ -126,6 +143,13 @@ linuxarm:
 linuxarm64:
 	GOOS=linux GOARCH=arm64 $(MAKE) build
 
+testing:
+	mkdir -p pkg/embed && \
+	cat pkg/plugins/glauth-sqlite/sqlite.go | sed -e 's/func main() {}//' -e 's/^package main/package embed/' > pkg/embed/sqlite.go  && \
+	go mod tidy && \
+	GOOS=linux GOARCH=amd64 CGO_ENABLED=1 BUILD_TAGS=embedsqlite $(MAKE) build && \
+	rm -rf pkg/embed
+
 darwinamd64:
 	GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 $(MAKE) build
 
@@ -144,55 +168,103 @@ verify:
 pull-plugin-dependencies:
 	(for pkg in $$(cat $$M/go.mod | awk '/^require [a-z]/{print $$2} /^\)/{rblock=0} rblock{if($$4!="indirect" && $$1!~"glauth"){print $$1}} /^require \(/{rblock=1}'); do if [ "$$(grep $$pkg go.mod &>/dev/null)" = "" ]; then go get $$pkg; fi; done)
 
-#prepare-plugins-release: @ pull plugins dependencies for local building
-prepare-plugins-release:
+#prepare-plugins-buid: @ pull plugins dependencies for local building
+prepare-plugins-build:
 	@M=pkg/plugins/glauth-sqlite make pull-plugin-dependencies && \
 	M=pkg/plugins/glauth-mysql make pull-plugin-dependencies && \
 	M=pkg/plugins/glauth-postgres make pull-plugin-dependencies && \
 	M=pkg/plugins/glauth-pam make pull-plugin-dependencies
 
 forget-plugin:
-	rm -rf $M ../.git/modules/v2/$M && \
-	git config --remove-section submodule.v2/$M && \
-	git rm --cache $M && \
-	go mod tidy
+	rm -rf $M ../.git/modules/v2/$M; \
+	git config --remove-section submodule.v2/$M; \
+	git rm --cache $M; \
+	go mod tidy; \
+	true
 
 #forget-plugin: @ remove plugins, restoring original file structure
 forget-plugins:
-	for pkg in pkg/plugins/*/go.mod; do\
-		P=$$(echo $$pkg | cut -d'/' -f 3) M=$$(dirname $$pkg) make forget-plugin;\
-	done
+	for pkg in pkg/plugins/*; do \
+		if [ -d "$$pkg" ]; then \
+			P=$$(echo $$pkg | cut -d'/' -f 3) M=$$pkg make forget-plugin >/dev/null 2>&1;\
+		fi; \
+	done; \
+	rm -rf buildlogs
 
-#releasemain: @ build main binaries for distribution
-releasemain: prepbuild
+remember-plugins:
+	cd ../ && \
+	for module in $$(cat .gitmodules | awk '/path =/{P=$$3} /url =/{print $$3 "," P}'); do \
+		git submodule add $${module%%,*} $${module#*,}; \
+	done; \
+	git submodule update --init --recursive
+
+_buildmain:
 	@xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out glauth -dest bin -buildvcs=false --targets="${MAIN_TARGETS}" .
 
-releaseplugin: prepbuild
-	@echo "Building $P plugin"; \
-	if [ ! -e $M/.ignore ] ; \
-	then \
-		xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go . && \
-		(cd bin && for lib in $$(ls $$P-*); do sudo mv $$lib $$lib.so; done); \
+#buildmain: @ build main binaries for distribution
+buildmain: prepbuild _buildmain
+
+buildsingleembed:
+	git checkout -b build_embeds && \
+	mkdir -p pkg/embed && \
+	cat pkg/plugins/$P/$M | sed -e 's/func main() {}//' -e 's/^package main/package embed/' > pkg/embed/$M  && \
+	go mod tidy && \
+	git add pkg/embed/$M go.mod go.sum && \
+	git commit -m "build cruft" && \
+	git push -u origin build_embeds && \
+	xgo -v -ldflags="${BUILD_VARS}" --tags=$T -trimpath -go ${GO_RELEASE_V} -out glauth -dest bin -buildvcs=false --targets="${EMBED_TARGETS}" . && \
+	rm -rf pkg/embed && \
+	git checkout master && \
+	git push -d origin build_embeds && \
+	git branch -D build_embeds
+
+_buildmainembeds:
+	P=glauth-sqlite M=sqlite.go T=embedsqlite make buildsingleembed
+
+#buildmainembeds: @ build main binaries for distribution, including embedded plugins
+buildmainembeds: prepbuild _buildmainembeds
+
+buildplugin: 
+ifeq ($P,pam)
+	xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go --bringupcmd 'apt update && apt install -y libpam0g-dev' .
+else
+	xgo -v -ldflags="${BUILD_VARS}" -trimpath -go ${GO_RELEASE_V} -out $P -dest bin -buildvcs=false -buildmode=plugin --targets="${PLUGIN_TARGETS}" --pkg $M/$P.go . 
+endif
+	(cd bin && for lib in $$(ls $$P-* | grep -v \.so$$); do sudo mv $$lib $$lib.so; done); 
+
+_buildplugins: prepare-plugins-build
+	for pkg in pkg/plugins/*; do \
+		if [ -d "$$pkg" ]; then \
+			M=pkg/plugins/$$(echo $$pkg | cut -d'/' -f 3) && P=$$(echo $$M | grep -oP 'glauth-\K\w+') && M=$$M P=$$P make buildplugin;\
+		fi; \
+	done; \
+
+#buildplugins: @ build base plugins for distribution
+buildplugins: forget-embed _buildplugins remember-embed
+
+_checkdockerauth:
+	@if ! grep -q "index.docker.io" $(HOME)/.docker/config.json; then \
+		echo "❌ Not logged in to Docker Hub (index.docker.io not found in config)."; \
+		exit 1; \
+	fi; \
+	if ! grep -q "ghcr.io" $(HOME)/.docker/config.json; then \
+		echo "❌ Not logged in to GitHub Hub (ghcr.io not found in config)."; \
+		exit 1; \
 	fi
 
-#releaseplugins: @ build base plugins for distribution
-releaseplugins:
-	@for pkg in pkg/plugins/*/go.mod; do\
-		M=pkg/plugins/$$(echo $$pkg | cut -d'/' -f 3) && P=$$(echo $$M | grep -oP 'glauth-\K\w+') && M=$$M P=$$P make releaseplugin;\
-	done
-
-releasedockermain:
-	$(if $(TAG),,$(error Must set TAG))
-	$(if $(REPO),,$(error Must set REPO - glauth or other))
+builddockermain:
+	$(if $(TAG),,$(error ❌ Must set TAG))
+	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
 	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \
 	cp -f bin/glauth-linux-amd64 docker/assets/linux/amd64/glauth && \
 	cp -f bin/glauth-linux-arm64 docker/assets/linux/arm64/glauth && \
 	cp -f bin/glauth-linux-arm-7 docker/assets/linux/arm/v7/glauth && \
+	docker buildx build --tag ghcr.io/$$REPO/glauth:$$TAG -t ghcr.io/$$REPO/glauth:latest -f docker/Dockerfile-standalone --platform linux/amd64,linux/arm64,linux/arm/v7 --push docker && \
 	docker buildx build --tag $$REPO/glauth:$$TAG -t $$REPO/glauth:latest -f docker/Dockerfile-standalone --platform linux/amd64,linux/arm64,linux/arm/v7 --push docker
 
-releasedockerplugins:
-	$(if $(TAG),,$(error Must set TAG))
-	$(if $(REPO),,$(error Must set REPO - glauth or other))
+builddockerplugins:
+	$(if $(TAG),,$(error ❌ Must set TAG))
+	$(if $(REPO),,$(error ❌ Must set REPO - glauth or other))
 	@mkdir -p docker/assets/linux/amd64 docker/assets/linux/arm64 docker/assets/linux/arm/v7 && \
 	cp -f bin/sqlite-linux-amd64.so docker/assets/linux/amd64/sqlite.so && \
 	cp -f bin/sqlite-linux-arm64.so docker/assets/linux/arm64/sqlite.so && \
@@ -203,9 +275,12 @@ releasedockerplugins:
 	cp -f bin/postgres-linux-amd64.so docker/assets/linux/amd64/postgres.so && \
 	cp -f bin/postgres-linux-arm64.so docker/assets/linux/arm64/postgres.so && \
 	cp -f bin/postgres-linux-arm-7.so docker/assets/linux/arm/v7/postgres.so && \
+	docker buildx build --tag ghcr.io/$$REPO/glauth-plugins:$$TAG -t ghcr.io/$$REPO/glauth-plugins:latest -f docker/Dockerfile-plugins --platform linux/amd64,linux/arm64,linux/arm/v7 --push docker && \
 	docker buildx build --tag $$REPO/glauth-plugins:$$TAG -t $$REPO/glauth-plugins:latest -f docker/Dockerfile-plugins --platform linux/amd64,linux/arm64,linux/arm/v7 --push docker
 
-releasedocker: releasedockermain releasedockerplugins
+builddocker: _checkdockerauth builddockermain builddockerplugins
+
+buildeverything: prepbuild forget-embed _buildmain _buildplugins remember-embed _buildmainembeds builddocker
 
 #testdocker: @ run integration test using docker
 testdocker:
@@ -247,4 +322,8 @@ testdocker:
 	docker rm glauth-test && \
 	echo "==> Testing complete."
 
-.PHONY: all prepbuild run test fast binaries setup getdeps runtest updatetest format devrun linux386 linuxamd64 linuxarm linuxarm64 darwinamd64 darwinarm64 win386 winamd64 verify pull-plugin pull-base-plugins forget-plugin forget-plugins releasemain releaseplugin release releaseplugins releasedockermain releaserdockerplugins releasedocker testdocker
+.PHONY: all \
+	prepbuild run test fast binaries setup getdeps runtest updatetest format devrun \
+	linux386 linuxamd64 linuxarm linuxarm64 darwinamd64 darwinarm64 win386 winamd64 verify \
+	pull-plugin pull-base-plugins forget-plugin forget-plugins buildmain buildplugin build \
+	buildplugins builddockermain builddockerplugins builddocker testdocker buildeverything

v2/docker/Dockerfile-plugins

@@ -11,7 +11,16 @@ RUN apk add --no-cache git make busybox-static dumb-init
 #################
 
 FROM gcr.io/distroless/base-debian11 as run
-LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>"
+
+LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>" \
+      org.opencontainers.image.title="GLauth" \
+      org.opencontainers.image.description="A simple LDAP server for development, home use, or CI pipelines" \
+      org.opencontainers.image.authors="Ben Yanke, Jörn Friedrich Dreyer, Chris F Ravenscroft" \
+      org.opencontainers.image.source="https://github.com/glauth/glauth" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="latest" \
+      org.opencontainers.image.url="https://github.com/glauth/glauth"
+
 ARG TARGETPLATFORM
 
 # Copy docker specific scripts from build container

v2/docker/Dockerfile-standalone

@@ -11,7 +11,16 @@ RUN apk add --no-cache git make busybox-static dumb-init
 #################
 
 FROM gcr.io/distroless/base-debian11 as run
-LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>"
+
+LABEL maintainers="Ben Yanke <ben@benyanke.com>, Jörn Friedrich Dreyer <jfd@butonic.de>, Chris F Ravenscroft <chris@voilaweb.com>" \
+      org.opencontainers.image.title="GLauth" \
+      org.opencontainers.image.description="A simple LDAP server for development, home use, or CI pipelines" \
+      org.opencontainers.image.authors="Ben Yanke, Jörn Friedrich Dreyer, Chris F Ravenscroft" \
+      org.opencontainers.image.source="https://github.com/glauth/glauth" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="latest" \
+      org.opencontainers.image.url="https://github.com/glauth/glauth"
+
 ARG TARGETPLATFORM
 
 # Copy docker specific scripts from build container

v2/glauth.go

@@ -224,6 +224,8 @@ func startConfigWatcher() {
 					isChanged = true
 				} else if event.Op&fsnotify.Remove == fsnotify.Remove { // vim edit file with rename/remove
 					isChanged, isRemoved = true, true
+				} else if event.Op&fsnotify.Create == fsnotify.Create { // only when watching a directory
+					isChanged = true
 				}
 			case err := <-watcher.Errors:
 				log.Error().Err(err).Msg("watcher error")

v2/go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/arl/statsviz v0.6.0
 	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/glauth/ldap v0.0.0-20231210225823-b9bf4d1baf6e
+	github.com/glauth/ldap v0.0.0-20240419171521-1f14f5c1b4ad
 	github.com/jinzhu/copier v0.4.0
 	github.com/pquerna/otp v1.4.0
 	github.com/prometheus/client_golang v1.18.0
@@ -34,7 +34,7 @@ require (
 	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/go-logr/logr v1.3.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect

v2/go.sum

@@ -14,17 +14,14 @@ github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/glauth/ldap v0.0.0-20231210225823-b9bf4d1baf6e h1:ohe1O2DUo198delHsQvA8O+CgAPP8wv1SmSxLPlO9ao=
-github.com/glauth/ldap v0.0.0-20231210225823-b9bf4d1baf6e/go.mod h1:EHMcFuVSIs0huelHOhaGtj9IKMB/Dmxo+jDheipjtYA=
-github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/glauth/ldap v0.0.0-20240419171521-1f14f5c1b4ad h1:2ERGXiofR9ISXg4evamCngs2EeuMhVJRuDwWGa6bS6s=
+github.com/glauth/ldap v0.0.0-20240419171521-1f14f5c1b4ad/go.mod h1:5ueZMujvJ5nuYPyBj6uQTPV4R1YshboRa/osaP4Emfs=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
 github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

v2/internal/monitoring/ldap.go

@@ -21,8 +21,6 @@ func (m *LDAPMonitorWatcher) sync() {
 		case tick := <-m.syncTicker.C:
 			m.logger.Debug().Time("value", tick).Msg("Tick")
 			m.storeMetrics()
-		default:
-			continue
 		}
 	}
 }

v2/internal/toml/config.go

@@ -179,11 +179,13 @@ func parseConfigFile(configFileLocation string, args map[string]interface{}) (*c
 	// Patch with default values where not specified
 	for i := range cfg.Backends {
 		if cfg.Backends[i].NameFormat == "" {
-			cfg.Backends[i].NameFormat = "cn"
+			cfg.Backends[i].NameFormat = "cn,uid"
 		}
+		cfg.Backends[i].NameFormatAsArray = strings.Split(cfg.Backends[i].NameFormat, ",")
 		if cfg.Backends[i].GroupFormat == "" {
-			cfg.Backends[i].GroupFormat = "ou"
+			cfg.Backends[i].GroupFormat = "ou,cn"
 		}
+		cfg.Backends[i].GroupFormatAsArray = strings.Split(cfg.Backends[i].GroupFormat, ",")
 		if cfg.Backends[i].SSHKeyAttr == "" {
 			cfg.Backends[i].SSHKeyAttr = "sshPublicKey"
 		}
@@ -221,9 +223,7 @@ func usersCustomAttributes(location string, config *config.Config) {
 			x := make(map[string]interface{})
 
 			for _, attribute := range user.CustomAttributes {
-				err := md.PrimitiveDecode(attribute, x)
-
-				fmt.Println(err, x)
+				_ = md.PrimitiveDecode(attribute, x)
 
 				for k, v := range x {
 
@@ -430,8 +430,9 @@ func validateConfig(cfg *config.Config) (*config.Config, error) {
 		case "ldap":
 		case "owncloud":
 		case "plugin":
+		case "embed":
 		default:
-			return cfg, fmt.Errorf("invalid backend %s - must be 'config', 'ldap', 'owncloud' or 'plugin'", cfg.Backends[i].Datastore)
+			return cfg, fmt.Errorf("invalid backend %s - must be 'config', 'ldap', 'owncloud', 'plugin' or 'embed", cfg.Backends[i].Datastore)
 		}
 	}
 

v2/pkg/config/config.go

@@ -9,8 +9,10 @@ type (
 		Datastore                 string
 		Insecure                  bool     // For LDAP and owncloud backend only
 		Servers                   []string // For LDAP and owncloud backend only
-		NameFormat                string
-		GroupFormat               string
+		NameFormat                string   // e.g. cn, ou, uid, or a comma separated list of them
+		NameFormatAsArray         []string // we will explode NameFormat on commas
+		GroupFormat               string   // e.g. cn, ou, gid, or a comma separated list of them
+		GroupFormatAsArray        []string // we will explode GroupFormat on commas
 		SSHKeyAttr                string
 		UseGraphAPI               bool   // For ownCloud backend only
 		Plugin                    string // Path to plugin library, for plugin backend only
@@ -111,6 +113,7 @@ type (
 		Name          string
 		UnixID        int // TODO: remove after deprecating UnixID on User and Group
 		GIDNumber     int
+		Capabilities  []Capability
 		IncludeGroups []int
 	}
 

v2/pkg/handler/config.go

@@ -183,8 +183,9 @@ func (h configHandler) FindPosixAccounts(ctx context.Context, hierarchy string)
 
 	for _, u := range h.cfg.Users {
 		attrs := []*ldap.EntryAttribute{}
-		attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.NameFormat, Values: []string{u.Name}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{u.Name}})
+		for _, nameAttr := range h.backend.NameFormatAsArray {
+			attrs = append(attrs, &ldap.EntryAttribute{Name: nameAttr, Values: []string{u.Name}})
+		}
 
 		if len(u.GivenName) > 0 {
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "givenName", Values: []string{u.GivenName}})
@@ -260,9 +261,9 @@ func (h configHandler) FindPosixAccounts(ctx context.Context, hierarchy string)
 		}
 		var dn string
 		if hierarchy == "" {
-			dn = fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), h.backend.BaseDN)
+			dn = fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), h.backend.BaseDN)
 		} else {
-			dn = fmt.Sprintf("%s=%s,%s=%s,%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), hierarchy, h.backend.BaseDN)
+			dn = fmt.Sprintf("%s=%s,%s=%s,%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), hierarchy, h.backend.BaseDN)
 		}
 		entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
 	}
@@ -280,8 +281,10 @@ func (h configHandler) FindPosixGroups(ctx context.Context, hierarchy string) (e
 
 	for _, g := range h.cfg.Groups {
 		attrs := []*ldap.EntryAttribute{}
-		attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.GroupFormat, Values: []string{g.Name}})
-		attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{g.Name}})
+		for _, groupAttr := range h.backend.GroupFormatAsArray {
+			attrs = append(attrs, &ldap.EntryAttribute{Name: groupAttr, Values: []string{g.Name}})
+		}
+
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s", g.Name)}})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.GIDNumber)}})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "uniqueMember", Values: h.getGroupMemberDNs(ctx, g.GIDNumber)})
@@ -291,7 +294,7 @@ func (h configHandler) FindPosixGroups(ctx context.Context, hierarchy string) (e
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: h.getGroupMemberIDs(ctx, g.GIDNumber)})
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup", "top"}})
 		}
-		dn := fmt.Sprintf("%s=%s,%s,%s", h.backend.GroupFormat, g.Name, hierarchy, h.backend.BaseDN)
+		dn := fmt.Sprintf("%s=%s,%s,%s", h.backend.GroupFormatAsArray[0], g.Name, hierarchy, h.backend.BaseDN)
 		entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
 	}
 
@@ -320,12 +323,12 @@ func (h configHandler) getGroupMemberDNs(ctx context.Context, gid int) []string
 	members := make(map[string]bool)
 	for _, u := range h.cfg.Users {
 		if u.PrimaryGroup == gid {
-			dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 			members[dn] = true
 		} else {
 			for _, othergid := range u.OtherGroups {
 				if othergid == gid {
-					dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
+					dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 					members[dn] = true
 				}
 			}
@@ -408,7 +411,7 @@ func (h configHandler) getGroupDNs(ctx context.Context, gids []int) []string {
 	for _, gid := range gids {
 		for _, g := range h.cfg.Groups {
 			if g.GIDNumber == gid {
-				dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormat, g.Name, h.backend.BaseDN)
+				dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormatAsArray[0], g.Name, h.backend.BaseDN)
 				groups[dn] = true
 			}
 

v2/pkg/handler/ldap.go

@@ -117,7 +117,7 @@ func (h ldapHandler) Bind(bindDN, bindSimplePw string, conn net.Conn) (result ld
 		lowerBindDN := strings.ToLower(bindDN)
 		baseDN := strings.ToLower("," + h.backend.BaseDN)
 		parts := strings.Split(strings.TrimSuffix(lowerBindDN, baseDN), ",")
-		userName := strings.TrimPrefix(parts[0], h.backend.NameFormat+"=")
+		userName := strings.TrimPrefix(parts[0], h.backend.NameFormatAsArray[0]+"=")
 
 		validotp := false
 
@@ -210,6 +210,20 @@ func (h ldapHandler) Search(boundDN string, searchReq ldap.SearchRequest, conn n
 		stats.Frontend.Add("search_ldapSession_errors", 1)
 		return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, nil
 	}
+	/*
+	   delete_idx := -1
+	   pagingSize := uint32(0)
+	   for idx, control := range searchReq.Controls {
+	       if control.GetControlType() == ldap.ControlTypePaging {
+	           fmt.Println(control.GetControlType())
+	           pagingSize = control.(*ldap.ControlPaging).PagingSize
+	           delete_idx = idx
+	       }
+	   }
+	   if delete_idx >= 0 {
+	       searchReq.Controls = append(searchReq.Controls[:delete_idx], searchReq.Controls[delete_idx+1:]...)
+	   }
+	*/
 	search := ldap.NewSearchRequest(
 		searchReq.BaseDN,
 		searchReq.Scope,
@@ -223,6 +237,15 @@ func (h ldapHandler) Search(boundDN string, searchReq ldap.SearchRequest, conn n
 	)
 
 	h.log.Debug().Interface("request", search).Msg("Search request to backend")
+	/*
+			var sr *ldap.SearchResult
+			if pagingSize > 0 {
+			    fmt.Printf("Searching with page size == %d\n", pagingSize)
+		        sr, err = s.ldap.SearchWithPaging(search, pagingSize)
+		    } else {
+		        sr, err = s.ldap.Search(search)
+		    }
+	*/
 	sr, err := s.ldap.Search(search)
 	h.log.Debug().Interface("result", sr).Msg("Backend Search result")
 
@@ -286,9 +309,10 @@ func (h ldapHandler) Search(boundDN string, searchReq ldap.SearchRequest, conn n
 	}
 
 	ssr := ldap.ServerSearchResult{
-		Entries:   sr.Entries,
-		Referrals: sr.Referrals,
-		Controls:  sr.Controls,
+		Entries:    sr.Entries,
+		Referrals:  sr.Referrals,
+		Controls:   sr.Controls,
+		ResultCode: ldap.LDAPResultSuccess,
 	}
 	h.log.Debug().Interface("result", ssr).Msg("Frontend Search result")
 	if err != nil {

v2/pkg/handler/ldapopshelper.go

@@ -359,6 +359,7 @@ func (l LDAPOpsHelper) searchMaybeRootDSEQuery(ctx context.Context, h LDAPOpsHan
 	// unfortunately, objectClass is not to be included so we will respect that
 	// attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"*"}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedSASLMechanisms", Values: []string{}})
+	//attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedSASLMechanisms", Values: []string{"GSSAPI", "PLAIN", "EXTERNAL"}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedLDAPVersion", Values: []string{"3"}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedControl", Values: []string{}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "supportedCapabilities", Values: []string{}})
@@ -659,10 +660,10 @@ func (l LDAPOpsHelper) findUser(ctx context.Context, h LDAPOpsHandler, bindDN st
 		groupName := ""
 		userName := ""
 		if len(parts) == 1 {
-			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
+			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormatAsArray[0]+"=")
 		} else if len(parts) == 2 || (len(parts) == 3 && parts[2] == "ou=users") {
-			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
-			groupName = strings.TrimPrefix(parts[1], h.GetBackend().GroupFormat+"=")
+			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormatAsArray[0]+"=")
+			groupName = strings.TrimPrefix(parts[1], h.GetBackend().GroupFormatAsArray[0]+"=")
 		} else {
 			h.GetLog().Info().Str("binddn", bindDN).Int("numparts", len(parts)).Msg("BindDN should have only one or two parts")
 			for _, part := range parts {
@@ -702,6 +703,7 @@ func (l LDAPOpsHelper) findUser(ctx context.Context, h LDAPOpsHandler, bindDN st
 }
 
 func (l LDAPOpsHelper) checkCapability(ctx context.Context, user config.User, action string, objects []string) bool {
+	// User-level?
 	for _, capability := range user.Capabilities {
 		if capability.Action == action {
 			for _, object := range objects {

v2/pkg/handler/owncloud.go

@@ -167,7 +167,9 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 		}
 		for _, g := range groups {
 			attrs := []*ldap.EntryAttribute{}
-			attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.GroupFormat, Values: []string{*g.ID}})
+			for _, groupAttr := range h.backend.GroupFormatAsArray {
+				attrs = append(attrs, &ldap.EntryAttribute{Name: groupAttr, Values: []string{*g.ID}})
+			}
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *g.ID)}})
 			//			attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.GIDNumber)}})
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}})
@@ -179,7 +181,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 
 				attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: members})
 			}
-			dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormat, *g.ID, h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormatAsArray[0], *g.ID, h.backend.BaseDN)
 			entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
 		}
 	case "posixaccount", "":
@@ -197,8 +199,9 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 		}
 		for _, u := range users {
 			attrs := []*ldap.EntryAttribute{}
-			attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.NameFormat, Values: []string{*u.ID}})
-			attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{*u.ID}})
+			for _, nameAttr := range h.backend.NameFormatAsArray {
+				attrs = append(attrs, &ldap.EntryAttribute{Name: nameAttr, Values: []string{*u.ID}})
+			}
 			if u.DisplayName != nil {
 				attrs = append(attrs, &ldap.EntryAttribute{Name: "givenName", Values: []string{*u.DisplayName}})
 			}
@@ -209,7 +212,7 @@ func (h ownCloudHandler) Search(bindDN string, searchReq ldap.SearchRequest, con
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixAccount"}})
 
 			attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *u.ID)}})
-			dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, *u.ID, h.backend.GroupFormat, "users", h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormatAsArray[0], *u.ID, h.backend.GroupFormatAsArray[0], "users", h.backend.BaseDN)
 			entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
 		}
 	}

v2/pkg/plugins/basesqlhandler.go

@@ -454,13 +454,13 @@ func (h databaseHandler) getGroupMemberDNs(ctx context.Context, gid int) []strin
 			return []string{}
 		}
 		if u.PrimaryGroup == gid {
-			dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
+			dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 			members[dn] = true
 		} else {
 			u.OtherGroups = h.commaListToIntTable(ctx, otherGroups)
 			for _, othergid := range u.OtherGroups {
 				if othergid == gid {
-					dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
+					dn := fmt.Sprintf("%s=%s,%s=%s%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), insertOuUsers, h.backend.BaseDN)
 					members[dn] = true
 				}
 			}
@@ -562,7 +562,7 @@ func (h databaseHandler) getGroupDNs(ctx context.Context, gids []int) []string {
 	for _, gid := range gids {
 		for _, g := range h.MemGroups {
 			if g.GIDNumber == gid {
-				dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormat, g.Name, h.backend.BaseDN)
+				dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormatAsArray[0], g.Name, h.backend.BaseDN)
 				groups[dn] = true
 			}
 
@@ -609,7 +609,9 @@ func (h databaseHandler) getGroup(ctx context.Context, hierarchy string, g confi
 	asGroupOfUniqueNames := hierarchy == "ou=groups"
 
 	attrs := []*ldap.EntryAttribute{}
-	attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.GroupFormat, Values: []string{g.Name}})
+	for _, groupAttr := range h.backend.GroupFormatAsArray {
+		attrs = append(attrs, &ldap.EntryAttribute{Name: groupAttr, Values: []string{g.Name}})
+	}
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s via LDAP", g.Name)}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "gidNumber", Values: []string{fmt.Sprintf("%d", g.GIDNumber)}})
 	attrs = append(attrs, &ldap.EntryAttribute{Name: "uniqueMember", Values: h.getGroupMemberDNs(ctx, g.GIDNumber)})
@@ -619,7 +621,7 @@ func (h databaseHandler) getGroup(ctx context.Context, hierarchy string, g confi
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: h.getGroupMemberIDs(ctx, g.GIDNumber)})
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup", "top"}})
 	}
-	dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormat, g.Name, h.backend.BaseDN)
+	dn := fmt.Sprintf("%s=%s,ou=groups,%s", h.backend.GroupFormatAsArray[0], g.Name, h.backend.BaseDN)
 	return &ldap.Entry{DN: dn, Attributes: attrs}
 }
 
@@ -628,8 +630,9 @@ func (h databaseHandler) getAccount(ctx context.Context, hierarchy string, u con
 	defer span.End()
 
 	attrs := []*ldap.EntryAttribute{}
-	attrs = append(attrs, &ldap.EntryAttribute{Name: h.backend.NameFormat, Values: []string{u.Name}})
-	attrs = append(attrs, &ldap.EntryAttribute{Name: "uid", Values: []string{u.Name}})
+	for _, nameAttr := range h.backend.NameFormatAsArray {
+		attrs = append(attrs, &ldap.EntryAttribute{Name: nameAttr, Values: []string{u.Name}})
+	}
 
 	if len(u.GivenName) > 0 {
 		attrs = append(attrs, &ldap.EntryAttribute{Name: "givenName", Values: []string{u.GivenName}})
@@ -676,9 +679,9 @@ func (h databaseHandler) getAccount(ctx context.Context, hierarchy string, u con
 	}
 	var dn string
 	if hierarchy == "" {
-		dn = fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), h.backend.BaseDN)
+		dn = fmt.Sprintf("%s=%s,%s=%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), h.backend.BaseDN)
 	} else {
-		dn = fmt.Sprintf("%s=%s,%s=%s,%s,%s", h.backend.NameFormat, u.Name, h.backend.GroupFormat, h.getGroupName(ctx, u.PrimaryGroup), hierarchy, h.backend.BaseDN)
+		dn = fmt.Sprintf("%s=%s,%s=%s,%s,%s", h.backend.NameFormatAsArray[0], u.Name, h.backend.GroupFormatAsArray[0], h.getGroupName(ctx, u.PrimaryGroup), hierarchy, h.backend.BaseDN)
 	}
 	return &ldap.Entry{DN: dn, Attributes: attrs}
 }

v2/pkg/plugins/bogus/Makefile

@@ -1,3 +0,0 @@
-
-release-glauth-bogus:
-	@echo Ignoring bogus plugin

v2/pkg/server/embed_noembed.go

@@ -0,0 +1,13 @@
+//go:build !(embedsqlite || embedmysql)
+
+package server
+
+import (
+	"errors"
+
+	"github.com/glauth/glauth/v2/pkg/handler"
+)
+
+func NewEmbed(opts ...handler.Option) (handler.Handler, error) {
+	return nil, errors.New("GLAuth was not built with support for an embedded plugin")
+}

v2/pkg/server/embed_sqlite.go

@@ -0,0 +1,12 @@
+//go:build embedsqlite
+
+package server
+
+import (
+	"github.com/glauth/glauth/v2/pkg/embed"
+	"github.com/glauth/glauth/v2/pkg/handler"
+)
+
+func NewEmbed(opts ...handler.Option) (handler.Handler, error) {
+	return embed.NewSQLiteHandler(opts...), nil
+}

v2/pkg/server/server.go

@@ -133,7 +133,7 @@ func NewServer(opts ...Option) (*LdapSvc, error) {
 		case "plugin":
 			plug, err := plugin.Open(backend.Plugin)
 			if err != nil {
-				return nil, errors.New(fmt.Sprintf("Unable to load specified backend plugin: %s", err))
+				return nil, fmt.Errorf("unable to load specified backend plugin: %s", err)
 			}
 			nph, err := plug.Lookup(backend.PluginHandler)
 			if err != nil {
@@ -155,6 +155,19 @@ func NewServer(opts ...Option) (*LdapSvc, error) {
 				handler.Monitor(s.monitor),
 				handler.Tracer(s.tracer),
 			)
+		case "embed":
+			h, err = NewEmbed(
+				handler.Backend(backend),
+				handler.Logger(&s.log),
+				handler.Config(s.c),
+				handler.YubiAuth(s.yubiAuth),
+				handler.LDAPHelper(loh),
+				handler.Monitor(s.monitor),
+				handler.Tracer(s.tracer),
+			)
+			if err != nil {
+				return nil, err
+			}
 		default:
 			return nil, fmt.Errorf("unsupported backend %s - must be one of 'config', 'ldap','owncloud' or 'plugin'", backend.Datastore)
 		}

v2/sample-simple.cfg

@@ -3,7 +3,7 @@
 
 #################
 # General configuration.
-debug = true
+debug = false
 # syslog = true
 # structuredlog = true
 #
@@ -28,7 +28,7 @@ debug = true
 [ldaps]
 # to enable ldaps generate a certificate, eg. with:
 # openssl req -x509 -newkey rsa:4096 -keyout glauth.key -out glauth.crt -days 365 -nodes -subj '/CN=`hostname`'
-  enabled = false
+  enabled = true
   listen = "0.0.0.0:3894"
   cert = "glauth.crt"
   key = "glauth.key"
@@ -48,12 +48,10 @@ debug = true
 [backend]
   datastore = "config"
   baseDN = "dc=glauth,dc=com"
-  nameformat = "cn"
-  groupformat = "ou"
 
   # If you are using a client that requires reading the root DSE first
   # such as SSSD
-  # anonymousdse = true
+  anonymousdse = false
 
   ## Configure dn format to use structures like 
   ## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN"
@@ -147,6 +145,11 @@ debug = true
   # passappbcrypt = "243261243130244B62463462656F7265504F762E794F324957746D656541326B4B46596275674A79336A476845764B616D65446169784E41384F4432" # dogood
   otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
 
+[[users]]
+  name = "danger"
+  uidnumber = 5006
+  primarygroup = 5503
+  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
 
 #################
 # The groups section contains a hardcoded list of valid users.
@@ -159,9 +162,16 @@ debug = true
   gidnumber = 5502
 
 [[groups]]
-  name = "vpn"
+  name = "umbrella"
   gidnumber = 5503
-  includegroups = [ 5501 ]
+  includegroups = [ 5504 ]
+
+[[groups]]
+  name = "danger"
+  gidnumber = 5504
+    [[groups.capabilities]]
+    action = "search"
+    object = "dc=glauth,dc=com"
 
 #################
 # Enable and configure the optional REST API here.

v2/scripts/ci/good-results/posixGroupList0

@@ -1,6 +1,6 @@
 dn: ou=superheros,ou=users,dc=glauth,dc=com
 ou: superheros
-uid: superheros
+cn: superheros
 description: superheros
 gidNumber: 5501
 uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
@@ -20,7 +20,7 @@ objectClass: top
 
 dn: ou=svcaccts,ou=users,dc=glauth,dc=com
 ou: svcaccts
-uid: svcaccts
+cn: svcaccts
 description: svcaccts
 gidNumber: 5502
 uniqueMember: cn=serviceuser,ou=svcaccts,ou=users,dc=glauth,dc=com
@@ -30,7 +30,7 @@ objectClass: top
 
 dn: ou=vpnaccess,ou=users,dc=glauth,dc=com
 ou: vpnaccess
-uid: vpnaccess
+cn: vpnaccess
 description: vpnaccess
 gidNumber: 5503
 uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
@@ -50,7 +50,7 @@ objectClass: top
 
 dn: ou=allaccs,ou=users,dc=glauth,dc=com
 ou: allaccs
-uid: allaccs
+cn: allaccs
 description: allaccs
 gidNumber: 5504
 uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
@@ -72,7 +72,7 @@ objectClass: top
 
 dn: ou=mailadmin,ou=users,dc=glauth,dc=com
 ou: mailadmin
-uid: mailadmin
+cn: mailadmin
 description: mailadmin
 gidNumber: 5505
 uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com
@@ -88,7 +88,7 @@ objectClass: top
 
 dn: ou=webmail,ou=users,dc=glauth,dc=com
 ou: webmail
-uid: webmail
+cn: webmail
 description: webmail
 gidNumber: 5506
 objectClass: posixGroup
@@ -96,7 +96,7 @@ objectClass: top
 
 dn: ou=fulltime,ou=users,dc=glauth,dc=com
 ou: fulltime
-uid: fulltime
+cn: fulltime
 description: fulltime
 gidNumber: 5507
 uniqueMember: cn=alexdoe,ou=superheros,ou=users,dc=glauth,dc=com