diff options
| -rw-r--r-- | main.go | 212 |
1 files changed, 206 insertions, 6 deletions
@@ -27,6 +27,62 @@ func dnToConsul(dn string) string { return strings.Join(rdns, "/") } +func consulToDN(pair *consul.KVPair) (string, string, []byte) { + path := strings.Split(pair.Key, "/") + dn := "" + for _, cpath := range path { + if cpath == "" { + continue + } + kv := strings.Split(cpath, "=") + if len(kv) == 2 && kv[0] == "attribute" { + return dn, kv[1], pair.Value + } + if dn != "" { + dn = "," + dn + } + dn = cpath + dn + } + return dn, "", nil +} + +func parseConsulResult(data []*consul.KVPair) (map[string]Entry, error) { + aggregator := map[string]Entry{} + + for _, kv := range data { + log.Printf("%s %s", kv.Key, string(kv.Value)) + dn, attr, val := consulToDN(kv) + if attr == "" || val == nil { + continue + } + if _, exists := aggregator[dn]; !exists { + aggregator[dn] = Entry{} + } + var value interface{} + err := json.Unmarshal(val, &value) + if err != nil { + return nil, err + } + if vlist, ok := value.([]interface{}); ok { + vlist2 := []string{} + for _, v := range vlist { + if vstr, ok := v.(string); ok { + vlist2 = append(vlist2, vstr) + } else { + return nil, fmt.Errorf("Not a string: %#v", v) + } + } + aggregator[dn][attr] = vlist2 + } else if vstr, ok := value.(string); ok { + aggregator[dn][attr] = vstr + } else { + return nil, fmt.Errorf("Not a string or a list of strings: %#v", value) + } + } + + return aggregator, nil +} + type DNComponent struct { Type string Value string @@ -63,7 +119,7 @@ type State struct { bindDn string } -type Attributes map[string]interface{} +type Entry map[string]interface{} func main() { //ldap logger @@ -95,6 +151,7 @@ func main() { routes := ldap.NewRouteMux() routes.Bind(gobottin.handleBind) + routes.Search(gobottin.handleSearch) ldapserver.Handle(routes) // listen on 10389 @@ -120,7 +177,7 @@ func (server *Server) init() error { return nil } - base_attributes := Attributes{ + base_attributes := Entry{ "objectClass": []string{"top", "dcObject", "organization"}, "structuralObjectClass": "Organization", } @@ -141,7 +198,7 @@ func (server *Server) init() error { admin_pass_hash := SSHAEncode([]byte(admin_pass_str)) admin_dn := "cn=admin," + server.config.Suffix - admin_attributes := Attributes{ + admin_attributes := Entry{ "objectClass": []string{"simpleSecurityObject", "organizationalRole"}, "description": "LDAP administrator", "cn": "admin", @@ -164,7 +221,7 @@ func (server *Server) init() error { return nil } -func (server *Server) addElements(dn string, attrs Attributes) error { +func (server *Server) addElements(dn string, attrs Entry) error { prefix := dnToConsul(dn) for k, v := range attrs { json, err := json.Marshal(v) @@ -184,7 +241,7 @@ func (server *Server) handleBind(s ldap.UserState, w ldap.ResponseWriter, m *lda state := s.(*State) r := m.GetBindRequest() - result_code, err := server.handleBindInternal(state, w, r) + result_code, err := server.handleBindInternal(state, w, &r) res := ldap.NewBindResponse(result_code) if err != nil { @@ -194,7 +251,7 @@ func (server *Server) handleBind(s ldap.UserState, w ldap.ResponseWriter, m *lda w.Write(res) } -func (server *Server) handleBindInternal(state *State, w ldap.ResponseWriter, r message.BindRequest) (int, error) { +func (server *Server) handleBindInternal(state *State, w ldap.ResponseWriter, r *message.BindRequest) (int, error) { pair, _, err := server.kv.Get(dnToConsul(string(r.Name()))+"/attribute=userpassword", nil) if err != nil { @@ -219,3 +276,146 @@ func (server *Server) handleBindInternal(state *State, w ldap.ResponseWriter, r return ldap.LDAPResultInvalidCredentials, nil } } + +func (server *Server) handleSearch(s ldap.UserState, w ldap.ResponseWriter, m *ldap.Message) { + state := s.(*State) + r := m.GetSearchRequest() + + code, err := server.handleSearchInternal(state, w, &r) + + res := ldap.NewResponse(code) + if err != nil { + res.SetDiagnosticMessage(err.Error()) + } + w.Write(message.SearchResultDone(res)) +} + +func (server *Server) handleSearchInternal(state *State, w ldap.ResponseWriter, r *message.SearchRequest) (int, error) { + + log.Printf("-- SEARCH REQUEST: --") + log.Printf("Request BaseDn=%s", r.BaseObject()) + log.Printf("Request Filter=%s", r.Filter()) + log.Printf("Request FilterString=%s", r.FilterString()) + log.Printf("Request Attributes=%s", r.Attributes()) + log.Printf("Request TimeLimit=%d", r.TimeLimit().Int()) + + // TODO check authorizations + + basePath := dnToConsul(string(r.BaseObject())) + "/" + data, _, err := server.kv.List(basePath, nil) + if err != nil { + return ldap.LDAPResultOperationsError, err + } + + entries, err := parseConsulResult(data) + if err != nil { + return ldap.LDAPResultOperationsError, err + } + log.Printf("in %s: %#v", basePath, data) + log.Printf("%#v", entries) + + for dn, entry := range entries { + // TODO filter out if no permission to read this + matched, err := applyFilter(entry, r.Filter()) + if err != nil { + return ldap.LDAPResultOperationsError, err + } + if !matched { + continue + } + + e := ldap.NewSearchResultEntry(dn) + for attr, val := range entry { + // If attribute is not in request, exclude it from returned entry + if len(r.Attributes()) > 0 { + found := false + for _, need := range r.Attributes() { + if string(need) == attr { + found = true + break + } + } + if !found { + continue + } + } + // Send result + if val_str, ok := val.(string); ok { + e.AddAttribute(message.AttributeDescription(attr), + message.AttributeValue(val_str)) + } else if val_strlist, ok := val.([]string); ok { + for _, v := range val_strlist { + e.AddAttribute(message.AttributeDescription(attr), + message.AttributeValue(v)) + } + } else { + panic(fmt.Sprintf("Invalid value: %#v", val)) + } + } + w.Write(e) + } + + return ldap.LDAPResultSuccess, nil +} + +func applyFilter(entry Entry, filter message.Filter) (bool, error) { + if fAnd, ok := filter.(message.FilterAnd); ok { + for _, cond := range fAnd { + res, err := applyFilter(entry, cond) + if err != nil { + return false, err + } + if !res { + return false, nil + } + } + return true, nil + } else if fOr, ok := filter.(message.FilterOr); ok { + for _, cond := range fOr { + res, err := applyFilter(entry, cond) + if err != nil { + return false, err + } + if res { + return true, nil + } + } + return false, nil + } else if fNot, ok := filter.(message.FilterNot); ok { + res, err := applyFilter(entry, fNot.Filter) + if err != nil { + return false, err + } + return !res, nil + } else if fPresent, ok := filter.(message.FilterPresent); ok { + what := string(fPresent) + log.Printf("Present filter: %s", what) + if _, ok := entry[what]; ok { + return true, nil + } + return false, nil + } else if fEquality, ok := filter.(message.FilterEqualityMatch); ok { + desc := string(fEquality.AttributeDesc()) + target := string(fEquality.AssertionValue()) + if value, ok := entry[desc]; ok { + if vstr, ok := value.(string); ok { + // If we have one value for the key, match exactly + return vstr == target, nil + } else if vlist, ok := value.([]string); ok { + // If we have several values for the key, one must match + for _, val := range vlist { + if val == target { + return true, nil + } + } + return false, nil + } else { + panic(fmt.Sprintf("Invalid value: %#v", value)) + } + } else { + return false, nil + } + } else { + return false, fmt.Errorf("Unsupported filter: %#v %T", filter, filter) + } +} |