Dev (glauth#254)

* use functional options pattern to inject logr (glauth#124)

* use functional options pattern to inject logr

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* cleanup log formatting

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* allow clean shutdown (glauth#126)

* fix owncloud posix query, log message and provisioning api results (glauth#128)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* don't hardcode graphapi endpoint

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* add support for write handlers (glauth#135)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* config: match shadowaccount objectlcass (glauth#136)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* Makefile compatiblility (glauth#134)

Co-authored-by: Jörn Friedrich Dreyer <[email protected]>

* update travis.yml (glauth#154)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* check owncloud status code is ok (glauth#153)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* Bulid and push multiarch docker images (glauth#142)

Fix glauth#141.

With this change, a github action is added that builds a multiarch docker image on every commit, supporting x86_64, aarch64 and arm/v7.

When the action is triggered on a release or tag, it also uploads the versioned image to github container image registry.

Co-authored-by: Jörn Friedrich Dreyer <[email protected]>

* don't mix graph and provisioning api (glauth#157)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* Reuse http client as much as possible and allow insecure transport (glauth#160)

* Allow using configmaps when deploying in kubernetes (glauth#161)

* Ensure config watcher also works in kubernetes

When using configmaps in kubernetes, the file is a symlink, and then
file-watcher is not opdated with a write event. Instead it receives a
CHMOD and a REMOVE event.

This change adds two things
1) Removal of the current wacther and adding of a new watcher for the
same path
2) The do-reload conditional is updated to also include the remove
event.

* Align write and removed conditionals

* Fix API server json formating (glauth#163) (glauth#164)

* Update README.md (glauth#167)

Fixing bad port in quickstart

* Use port 3893 with ldapsearch in example (glauth#150)

* feat: add flags for ldap listen addresses (glauth#169)

Signed-off-by: Mark Sagi-Kazar <[email protected]>

* Assets build fix. (glauth#171)

* Docker build fix.

* Makefile fix.

* update readme, config and deps (glauth#170)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* Remove byanke's donation fields

* Database plugins (glauth#133)

This commit actually covers a few items. In future commits, I will keep features distinct. This is only happening this time around due to how long it took to merge this branch.

Covered:

- Database plugins (at this time: SQLite, MySQL, Postgres)
- Backends acting as middleware: added the [[Backends]] configuration directive while retaining backward compatibility with [Backend]
- Schema introspection (root DSE query with base scope)
- When proxying, insert queried attribute back in upstream response, if absent, so that the LDAP library does not filter out all entries
- When chaining backends, any backend can be used to inject OTP value in password, before reaching a non-OTP-aware backend (currently guarded by a True statement in case we find an issue (I did thoroughly test but you never know))
- Handling of special "1.1" attributes filter meaning "I do not want attributes" (RFC 4511, 4.5.1.8)
- Support for "want types only" queries, even when proxying

* Mac M1 Support and LDAP Req Attributes (glauth#192)

* Mac M1 Support

* Augmented root DSS and schema discovery based on content of schema directory

* LDAP workaround where req. attribute gets injected in response now works with combined filters

* SubSchema query can return a minimal set, freeipa or openldap's schemas

* Feature/upgrade ldap library version (glauth#194)

* Stronger, salted paswords using bcrypt. (glauth#195)

* Fixed badges in README file and added a couple improvements (glauth#196)

* fix lock for ownCloud / graph backend (glauth#198)

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* the config struct is only needed by the config backend (glauth#199)

* Variable "unixid" is now respectively "UIDNumber" and "GIDNumber" for… (glauth#201)

* fix: keep watch config file when changed,renamed,removed (glauth#189)

I will need to run `glauth.go` through `gofmt` myself but that is fine.

* Returning when unable to start config watcher (glauth#203)

* Introducing goconvey testing and refactoring of config and ... (glauth#204)

* Introducing goconvey testing and refactoring of config and plugin backends.

* gofmt, oops

* Refactored re-insertion of requested attributes

* Allow bind operations with no group provided (glauth#205)

* Support for userPrincipalName binding and browsing. (glauth#206)

* Support for userPrincipalName binding and browsing.

* Fixed travis CI test for userprincipalname

* fixing travis tests for more users

* Rate limit after failed binds (glauth#207)

* Capabilities -- part 2 (glauth#214) + do not dump config at startup

* Attempting migration from Travis to Github Actions

* Migration Step#2

* Migration Step#3

* Migration Step#4

* Migration Step#5

* Migration Step#6

* Migration Step#7

* Migration Step#8

* Migration Step#9

* Migration Step#9

* Migration dev...

* Migration dev...

* Migration dev...

* Migration dev...

* Docker with plugins, first step (glauth#215)

* Docker with plugins, first step

* Build better docker images, including plugins

* Merge back from dev to feature branch step glauth#2

* Added capabilities to CI

* - Now creating two docker images, including one with plugins
- Moving from Travis CI to GitHub Actions

* Plugins now run on distroless (glauth#217)

* Getting rid of Travis CI now that it doesn't support FOSS anymore.

* Internal Stats -- performance view (glauth#221)

* Local merge

* Update CI to forget about bindata

* Forgot to cleanup the cleanup...

* assets: use stdlib "embed" package (glauth#200)

This should make it easier to include GLAuth in other projects using `go get`

* 'Airgapping' web assets for security and preventing breakage (glauth#227)

* v2 -- V2 hierarchy (glauth#228)

* Search refactoring, tree traversal and scope correctness (glauth#229)

Search refactoring, tree traversal and scope correctness.

* Feature/multi cfg (glauth#233)

* Feature/custom attributes (glauth#240)

* Makefiles: platform releases (glauth#241)

* Feature/release script (glauth#242)

* Bug/fix docker build in v2 (glauth#244)

* Fix glauth#246 and glauth#252

Co-authored-by: Jörn Friedrich Dreyer <[email protected]>
Co-authored-by: Zhou Wenzong <[email protected]>
Co-authored-by: Jairo Llopis <[email protected]>
Co-authored-by: Benedikt Kulmann <[email protected]>
Co-authored-by: Nicolai Willems <[email protected]>
Co-authored-by: Thibault Soubiran <[email protected]>
Co-authored-by: Clement JACOB <[email protected]>
Co-authored-by: Lutz Horn <[email protected]>
Co-authored-by: Márk Sági-Kazár <[email protected]>
Co-authored-by: Peter Heise <[email protected]>
Co-authored-by: Ben Yanke <[email protected]>
Co-authored-by: fanlix <[email protected]>
Co-authored-by: Hank Donnay <[email protected]>

v2/pkg/handler/ldapopshelper.go

@@ -603,11 +603,14 @@ func (l LDAPOpsHelper) findUser(h LDAPOpsHandler, bindDN string, checkGroup bool
 		userName := ""
 		if len(parts) == 1 {
 			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
-		} else if len(parts) == 2 {
+		} else if len(parts) == 2 || (len(parts) == 3 && parts[2] == fmt.Sprintf("%s=users", h.GetBackend().GroupFormat)) {
 			userName = strings.TrimPrefix(parts[0], h.GetBackend().NameFormat+"=")
 			groupName = strings.TrimPrefix(parts[1], h.GetBackend().GroupFormat+"=")
 		} else {
 			h.GetLog().V(2).Info("BindDN should have only one or two parts", "binddn", bindDN, "numparts", len(parts))
+			for _, part := range parts {
+				h.GetLog().V(2).Info("Parts", "part", part)
+			}
 			return nil, ldap.LDAPResultInvalidCredentials
 		}