diff options
| -rw-r--r-- | acl.go | 10 | ||||
| -rw-r--r-- | gobottin.hcl.example | 2 | ||||
| -rw-r--r-- | main.go | 11 | ||||
| -rw-r--r-- | read.go | 2 | ||||
| -rw-r--r-- | write.go | 3 |
5 files changed, 16 insertions, 12 deletions
@@ -87,8 +87,14 @@ func (entry *ACLEntry) Check(login *Login, action string, target string, attribu } } - rule_target_with_self := strings.ReplaceAll(entry.target, "SELF", login.user) - if !match(rule_target_with_self, target) { + matchTarget := match(entry.target, target) + if !matchTarget && len(target) >= len(login.user) { + start := len(target) - len(login.user) + if target[start:] == login.user { + matchTarget = match(entry.target, target[:start]+"SELF") + } + } + if !matchTarget { return false } diff --git a/gobottin.hcl.example b/gobottin.hcl.example index b522245..6132f68 100644 --- a/gobottin.hcl.example +++ b/gobottin.hcl.example @@ -12,7 +12,7 @@ job "directory" { task "server" { driver = "docker" config { - image = "lxpz/gobottin_amd64:3" + image = "lxpz/gobottin_amd64:5" readonly_rootfs = true port_map { ldap_port = 1389 @@ -205,6 +205,9 @@ func (server *Server) init() error { base_attributes := Entry{ "objectClass": []string{"top", "dcObject", "organization"}, "structuralObjectClass": []string{"Organization"}, + ATTR_CREATORSNAME: []string{server.config.Suffix}, + ATTR_CREATETIMESTAMP: []string{genTimestamp()}, + ATTR_ENTRYUUID: []string{genUuid()}, } suffix_dn, err := parseDN(server.config.Suffix) if err != nil { @@ -227,9 +230,11 @@ func (server *Server) init() error { "objectClass": []string{"simpleSecurityObject", "organizationalRole"}, "description": []string{"LDAP administrator"}, "cn": []string{"admin"}, - ATTR_USERPASSWORD: []string{admin_pass_hash}, "structuralObjectClass": []string{"organizationalRole"}, - "permissions": []string{"read", "write"}, + ATTR_USERPASSWORD: []string{admin_pass_hash}, + ATTR_CREATORSNAME: []string{server.config.Suffix}, + ATTR_CREATETIMESTAMP: []string{genTimestamp()}, + ATTR_ENTRYUUID: []string{genUuid()}, } err = server.addElements(admin_dn, admin_attributes) @@ -373,5 +378,3 @@ func (server *Server) handleBindInternal(state *State, r *message.BindRequest) ( } return ldap.LDAPResultInvalidCredentials, nil } - - @@ -8,7 +8,6 @@ import ( message "github.com/vjeantet/goldap/message" ) - // Compare request ------------------------- func (server *Server) handleCompare(s ldap.UserState, w ldap.ResponseWriter, m *ldap.Message) { @@ -62,7 +61,6 @@ func (server *Server) handleCompareInternal(state *State, r *message.CompareRequ return ldap.LDAPResultCompareFalse, nil } - // Search request ------------------------- func (server *Server) handleSearch(s ldap.UserState, w ldap.ResponseWriter, m *ldap.Message) { @@ -8,7 +8,6 @@ import ( message "github.com/vjeantet/goldap/message" ) - // Add request ------------------------ func (server *Server) handleAdd(s ldap.UserState, w ldap.ResponseWriter, m *ldap.Message) { @@ -149,7 +148,6 @@ func (server *Server) handleAddInternal(state *State, r *message.AddRequest) (in return ldap.LDAPResultSuccess, nil } - // Delete request ------------------------ func (server *Server) handleDelete(s ldap.UserState, w ldap.ResponseWriter, m *ldap.Message) { @@ -279,7 +277,6 @@ func (server *Server) handleDeleteInternal(state *State, r *message.DelRequest) return ldap.LDAPResultSuccess, nil } - // Modify request ------------------------ func (server *Server) handleModify(s ldap.UserState, w ldap.ResponseWriter, m *ldap.Message) { |