#################
# glauth.conf

#################
# General configuration.
debug = true
#syslog = true

#################
# The frontend section controls how clients connect to the proxy.
[frontend]
  tls = false # enable TLS for production!!

  # Using a nonstandard port to ensure there are no 
  # conflicts if running a test alongside a prod instance
  listen = "localhost:3893"
  cert = "cert.pem"
  key = "key.pem"

#################
# The backend section controls the data store.
[backend]
  datastore = "config"
  baseDN = "dc=glauth,dc=com"

#################
# The users section contains a hardcoded list of valid users.
#   to create a passSHA256:   echo -n "mysecret" | openssl dgst -sha256
[[users]]
  name = "hackers"
  uidnumber = 5001
  primarygroup = 5501
  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
    [[users.capabilities]]
    action = "search"
    object = "ou=superheros,dc=glauth,dc=com"

# This user record shows all of the possible fields available
[[users]]
  name = "johndoe"
  givenname="John"
  sn="Doe"
  mail = "jdoe@example.com"
  uidnumber = 5002
  primarygroup = 5501
  loginShell = "/bin/sh"
  homeDir = "/root"
  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
  sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"]
    [[users.capabilities]]
    action = "search"
    object = "ou=superheros,dc=glauth,dc=com"

# This user record tests lots of groups, including group inheritence
[[users]]
  name = "jamesdoe"
  givenname="James"
  sn="Doe"
  mail = "jdoe2@example.com"
  uidnumber = 5003
  primarygroup = 5501
  loginShell = "/bin/sh"
  otherGroups = [5505,5507]
  homeDir = "/home/jamesdoe"
  passsha256 = "ff522a502031e5f37054892d642c2c0f36af6c4e8f62225470d4a1a99f3c9c2a" # dogood1
  sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"]

# 2FA test user
[[users]]
  name = "alexdoe"
  givenname="Alex"
  sn="Doe"
  mail = "adoe@example.com"
  uidnumber = 5004
  primarygroup = 5501
  loginShell = "/bin/sh"
  otherGroups = [5505,5507]
  otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
  passsha256 = "b1cae08a1fd8b0bd0855e48f74ba2f8548904dd5de72311e6234617a3f661e16" # ThisAloneWontWork!
    [[users.capabilities]]
    action = "search"
    object = "dc=glauth,dc=com"



# App PW test user without OTP
[[users]]
  name = "jackdoe"
  givenname="Jack"
  sn="Doe"
  mail = "jdoe3@example.com"
  uidnumber = 5005
  primarygroup = 5501
  loginShell = "/bin/sh"
  otherGroups = [5505,5507]
  passsha256 = "ff522a502031e5f37054892d642c2c0f36af6c4e8f62225470d4a1a99f3c9c2a" #dogood1
  passappsha256 = [
    "c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa", # TestAppPw1
    "c9853d5f2599e90497e9f8cc671bd2022b0fb5d1bd7cfff92f079e8f8f02b8d3", # TestAppPw2
    "4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88", # TestAppPw3
  ]
    [[users.capabilities]]
    action = "search"
    object = "dc=glauth,dc=com"

# App PW test user with OTP
[[users]]
  name = "sarahdoe"
  givenname="Sarah"
  sn="Doe"
  mail = "sdoe@example.com"
  uidnumber = 5006
  primarygroup = 5501
  loginShell = "/bin/sh"
  otherGroups = [5505,5507]
  otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
  passsha256 = "ff522a502031e5f37054892d642c2c0f36af6c4e8f62225470d4a1a99f3c9c2a" #dogood1
  passappsha256 = [
    "c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa", # TestAppPw1
    "c9853d5f2599e90497e9f8cc671bd2022b0fb5d1bd7cfff92f079e8f8f02b8d3", # TestAppPw2
    "4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88", # TestAppPw3
  ]
    [[users.capabilities]]
    action = "search"
    object = "dc=glauth,dc=com"


[[users]]
  name = "serviceuser"
  uidnumber = 5003
  primarygroup = 5502
  passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
    [[users.capabilities]]
    action = "search"
    object = "*"

#################
# The groups section contains a hardcoded list of valid users.
[[groups]]
  name = "superheros"
  gidnumber = 5501

[[groups]]
  name = "svcaccts"
  gidnumber = 5502


[[groups]]
  name = "vpnaccess"
  gidnumber = 5503
  includegroups = [ 5501 ]

[[groups]]
  name = "allaccs"
  gidnumber = 5504
  includegroups = [ 5501, 5502 ]

[[groups]]
  name = "mailadmin"
  gidnumber = 5505

[[groups]]
  name = "webmail"
  gidnumber = 5506


[[groups]]
  name = "fulltime"
  gidnumber = 5507

#################
# Enable and configure the optional REST API here.
[api]
  enabled = false
  tls = false # enable TLS for production!!
  listen = "localhost:5555"
  cert = "cert.pem"
  key = "key.pem"