2015-05-06 01:54:27 +00:00
|
|
|
package ldap
|
|
|
|
|
|
|
|
import (
|
2018-01-19 06:44:44 +00:00
|
|
|
"context"
|
2015-05-08 07:28:26 +00:00
|
|
|
"fmt"
|
2018-04-03 13:52:43 +00:00
|
|
|
"strings"
|
2016-05-31 23:42:54 +00:00
|
|
|
|
2015-07-27 18:24:12 +00:00
|
|
|
"github.com/hashicorp/vault/helper/mfa"
|
2019-04-13 07:44:06 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/framework"
|
|
|
|
"github.com/hashicorp/vault/sdk/helper/ldaputil"
|
2019-04-12 21:54:35 +00:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/strutil"
|
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2015-05-06 01:54:27 +00:00
|
|
|
)
|
|
|
|
|
2020-12-11 21:21:53 +00:00
|
|
|
const errUserBindFailed = `ldap operation failed: failed to bind as user`
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 17:28:40 +00:00
|
|
|
b := Backend()
|
2018-01-19 06:44:44 +00:00
|
|
|
if err := b.Setup(ctx, conf); err != nil {
|
Backend plugin system (#2874)
* Add backend plugin changes
* Fix totp backend plugin tests
* Fix logical/plugin InvalidateKey test
* Fix plugin catalog CRUD test, fix NoopBackend
* Clean up commented code block
* Fix system backend mount test
* Set plugin_name to omitempty, fix handleMountTable config parsing
* Clean up comments, keep shim connections alive until cleanup
* Include pluginClient, disallow LookupPlugin call from within a plugin
* Add wrapper around backendPluginClient for proper cleanup
* Add logger shim tests
* Add logger, storage, and system shim tests
* Use pointer receivers for system view shim
* Use plugin name if no path is provided on mount
* Enable plugins for auth backends
* Add backend type attribute, move builtin/plugin/package
* Fix merge conflict
* Fix missing plugin name in mount config
* Add integration tests on enabling auth backend plugins
* Remove dependency cycle on mock-plugin
* Add passthrough backend plugin, use logical.BackendType to determine lease generation
* Remove vault package dependency on passthrough package
* Add basic impl test for passthrough plugin
* Incorporate feedback; set b.backend after shims creation on backendPluginServer
* Fix totp plugin test
* Add plugin backends docs
* Fix tests
* Fix builtin/plugin tests
* Remove flatten from PluginRunner fields
* Move mock plugin to logical/plugin, remove totp and passthrough plugins
* Move pluginMap into newPluginClient
* Do not create storage RPC connection on HandleRequest and HandleExistenceCheck
* Change shim logger's Fatal to no-op
* Change BackendType to uint32, match UX backend types
* Change framework.Backend Setup signature
* Add Setup func to logical.Backend interface
* Move OptionallyEnableMlock call into plugin.Serve, update docs and comments
* Remove commented var in plugin package
* RegisterLicense on logical.Backend interface (#3017)
* Add RegisterLicense to logical.Backend interface
* Update RegisterLicense to use callback func on framework.Backend
* Refactor framework.Backend.RegisterLicense
* plugin: Prevent plugin.SystemViewClient.ResponseWrapData from getting JWTs
* plugin: Revert BackendType to remove TypePassthrough and related references
* Fix typo in plugin backends docs
2017-07-20 17:28:40 +00:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return b, nil
|
2015-05-06 01:54:27 +00:00
|
|
|
}
|
|
|
|
|
2016-06-10 19:53:02 +00:00
|
|
|
func Backend() *backend {
|
2015-05-06 01:54:27 +00:00
|
|
|
var b backend
|
|
|
|
b.Backend = &framework.Backend{
|
|
|
|
Help: backendHelp,
|
|
|
|
|
|
|
|
PathsSpecial: &logical.Paths{
|
2016-05-31 23:42:54 +00:00
|
|
|
Root: mfa.MFARootPaths(),
|
2015-05-06 01:54:27 +00:00
|
|
|
|
|
|
|
Unauthenticated: []string{
|
2015-05-09 19:07:52 +00:00
|
|
|
"login/*",
|
2015-05-06 01:54:27 +00:00
|
|
|
},
|
2017-11-03 15:43:31 +00:00
|
|
|
|
|
|
|
SealWrapStorage: []string{
|
|
|
|
"config",
|
|
|
|
},
|
2015-05-06 01:54:27 +00:00
|
|
|
},
|
|
|
|
|
|
|
|
Paths: append([]*framework.Path{
|
|
|
|
pathConfig(&b),
|
2015-05-06 23:48:59 +00:00
|
|
|
pathGroups(&b),
|
2016-05-14 23:56:49 +00:00
|
|
|
pathGroupsList(&b),
|
2015-07-14 22:46:15 +00:00
|
|
|
pathUsers(&b),
|
2016-05-14 23:56:49 +00:00
|
|
|
pathUsersList(&b),
|
2015-07-27 18:24:12 +00:00
|
|
|
},
|
|
|
|
mfa.MFAPaths(b.Backend, pathLogin(&b))...,
|
|
|
|
),
|
2015-05-06 01:54:27 +00:00
|
|
|
|
2017-07-28 18:04:46 +00:00
|
|
|
AuthRenew: b.pathLoginRenew,
|
|
|
|
BackendType: logical.TypeCredential,
|
2015-05-06 01:54:27 +00:00
|
|
|
}
|
|
|
|
|
2016-06-10 19:53:02 +00:00
|
|
|
return &b
|
2015-05-06 01:54:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type backend struct {
|
|
|
|
*framework.Backend
|
|
|
|
}
|
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
func (b *backend) Login(ctx context.Context, req *logical.Request, username string, password string) ([]string, *logical.Response, []string, error) {
|
2015-05-08 07:28:26 +00:00
|
|
|
|
2018-01-19 06:44:44 +00:00
|
|
|
cfg, err := b.Config(ctx, req)
|
2015-05-08 07:28:26 +00:00
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, nil, nil, err
|
2015-05-08 07:28:26 +00:00
|
|
|
}
|
|
|
|
if cfg == nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse("ldap backend not configured"), nil, nil
|
2015-05-08 07:28:26 +00:00
|
|
|
}
|
|
|
|
|
2018-06-05 15:23:10 +00:00
|
|
|
if cfg.DenyNullBind && len(password) == 0 {
|
|
|
|
return nil, logical.ErrorResponse("password cannot be of zero length when passwordless binds are being denied"), nil, nil
|
|
|
|
}
|
|
|
|
|
2018-05-10 21:12:42 +00:00
|
|
|
ldapClient := ldaputil.Client{
|
|
|
|
Logger: b.Logger(),
|
|
|
|
LDAP: ldaputil.NewLDAP(),
|
|
|
|
}
|
|
|
|
|
2019-07-01 20:16:23 +00:00
|
|
|
c, err := ldapClient.DialLDAP(cfg.ConfigEntry)
|
2015-05-08 07:28:26 +00:00
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse(err.Error()), nil, nil
|
2015-05-08 07:28:26 +00:00
|
|
|
}
|
2016-03-29 13:59:28 +00:00
|
|
|
if c == nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse("invalid connection returned from LDAP dial"), nil, nil
|
2016-03-29 13:59:28 +00:00
|
|
|
}
|
2016-03-21 14:55:38 +00:00
|
|
|
|
2016-11-28 17:31:36 +00:00
|
|
|
// Clean connection
|
|
|
|
defer c.Close()
|
|
|
|
|
2019-07-01 20:16:23 +00:00
|
|
|
userBindDN, err := ldapClient.GetUserBindDN(cfg.ConfigEntry, c, username)
|
2016-04-27 15:17:54 +00:00
|
|
|
if err != nil {
|
2018-06-05 15:23:10 +00:00
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("error getting user bind DN", "error", err)
|
|
|
|
}
|
2020-12-11 21:21:53 +00:00
|
|
|
return nil, logical.ErrorResponse(errUserBindFailed), nil, nil
|
2016-04-27 12:00:26 +00:00
|
|
|
}
|
|
|
|
|
2016-08-19 20:45:17 +00:00
|
|
|
if b.Logger().IsDebug() {
|
2018-04-03 00:46:59 +00:00
|
|
|
b.Logger().Debug("user binddn fetched", "username", username, "binddn", userBindDN)
|
2016-08-19 20:45:17 +00:00
|
|
|
}
|
2016-05-09 00:21:44 +00:00
|
|
|
|
|
|
|
// Try to bind as the login user. This is where the actual authentication takes place.
|
2017-09-07 12:46:43 +00:00
|
|
|
if len(password) > 0 {
|
|
|
|
err = c.Bind(userBindDN, password)
|
|
|
|
} else {
|
|
|
|
err = c.UnauthenticatedBind(userBindDN)
|
|
|
|
}
|
|
|
|
if err != nil {
|
2018-06-05 15:23:10 +00:00
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("ldap bind failed", "error", err)
|
|
|
|
}
|
2020-12-11 21:21:53 +00:00
|
|
|
return nil, logical.ErrorResponse(errUserBindFailed), nil, nil
|
2016-04-27 12:00:26 +00:00
|
|
|
}
|
|
|
|
|
2017-04-18 19:52:05 +00:00
|
|
|
// We re-bind to the BindDN if it's defined because we assume
|
|
|
|
// the BindDN should be the one to search, not the user logging in.
|
|
|
|
if cfg.BindDN != "" && cfg.BindPassword != "" {
|
|
|
|
if err := c.Bind(cfg.BindDN, cfg.BindPassword); err != nil {
|
2018-06-05 15:23:10 +00:00
|
|
|
if b.Logger().IsDebug() {
|
|
|
|
b.Logger().Debug("error while attempting to re-bind with the BindDN User", "error", err)
|
|
|
|
}
|
2020-04-14 20:08:07 +00:00
|
|
|
return nil, logical.ErrorResponse("ldap operation failed: failed to re-bind with the BindDN user"), nil, nil
|
2017-04-18 19:52:05 +00:00
|
|
|
}
|
|
|
|
if b.Logger().IsDebug() {
|
2018-04-03 00:46:59 +00:00
|
|
|
b.Logger().Debug("re-bound to original binddn")
|
2017-04-18 19:52:05 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-02-14 18:26:30 +00:00
|
|
|
userDN, err := ldapClient.GetUserDN(cfg.ConfigEntry, c, userBindDN, username)
|
2016-04-27 15:17:54 +00:00
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse(err.Error()), nil, nil
|
2016-04-27 12:00:26 +00:00
|
|
|
}
|
|
|
|
|
2020-03-06 18:27:09 +00:00
|
|
|
if cfg.AnonymousGroupSearch {
|
|
|
|
c, err = ldapClient.DialLDAP(cfg.ConfigEntry)
|
|
|
|
if err != nil {
|
2020-04-14 20:08:07 +00:00
|
|
|
return nil, logical.ErrorResponse("ldap operation failed: failed to connect to LDAP server"), nil, nil
|
2020-03-06 18:27:09 +00:00
|
|
|
}
|
|
|
|
defer c.Close() // Defer closing of this connection as the deferal above closes the other defined connection
|
|
|
|
}
|
|
|
|
|
2019-07-01 20:16:23 +00:00
|
|
|
ldapGroups, err := ldapClient.GetLdapGroups(cfg.ConfigEntry, c, userDN, username)
|
2016-04-27 15:17:54 +00:00
|
|
|
if err != nil {
|
2017-11-02 20:05:48 +00:00
|
|
|
return nil, logical.ErrorResponse(err.Error()), nil, nil
|
2016-04-27 12:00:26 +00:00
|
|
|
}
|
2016-08-19 20:45:17 +00:00
|
|
|
if b.Logger().IsDebug() {
|
2018-04-03 00:46:59 +00:00
|
|
|
b.Logger().Debug("groups fetched from server", "num_server_groups", len(ldapGroups), "server_groups", ldapGroups)
|
2016-08-19 20:45:17 +00:00
|
|
|
}
|
2016-04-27 12:00:26 +00:00
|
|
|
|
|
|
|
ldapResponse := &logical.Response{
|
|
|
|
Data: map[string]interface{}{},
|
|
|
|
}
|
|
|
|
if len(ldapGroups) == 0 {
|
|
|
|
errString := fmt.Sprintf(
|
2016-05-09 00:21:44 +00:00
|
|
|
"no LDAP groups found in groupDN '%s'; only policies from locally-defined groups available",
|
2016-04-27 12:00:26 +00:00
|
|
|
cfg.GroupDN)
|
|
|
|
ldapResponse.AddWarning(errString)
|
|
|
|
}
|
|
|
|
|
|
|
|
var allGroups []string
|
2018-04-03 13:52:43 +00:00
|
|
|
canonicalUsername := username
|
|
|
|
cs := *cfg.CaseSensitiveNames
|
|
|
|
if !cs {
|
|
|
|
canonicalUsername = strings.ToLower(username)
|
|
|
|
}
|
2016-04-27 12:00:26 +00:00
|
|
|
// Import the custom added groups from ldap backend
|
2018-04-03 13:52:43 +00:00
|
|
|
user, err := b.User(ctx, req.Storage, canonicalUsername)
|
2016-05-09 00:21:44 +00:00
|
|
|
if err == nil && user != nil && user.Groups != nil {
|
2016-08-19 20:45:17 +00:00
|
|
|
if b.Logger().IsDebug() {
|
2018-04-03 00:46:59 +00:00
|
|
|
b.Logger().Debug("adding local groups", "num_local_groups", len(user.Groups), "local_groups", user.Groups)
|
2016-08-19 20:45:17 +00:00
|
|
|
}
|
2016-04-27 12:00:26 +00:00
|
|
|
allGroups = append(allGroups, user.Groups...)
|
|
|
|
}
|
2016-05-09 00:21:44 +00:00
|
|
|
// Merge local and LDAP groups
|
2016-04-27 12:00:26 +00:00
|
|
|
allGroups = append(allGroups, ldapGroups...)
|
|
|
|
|
2018-04-03 13:52:43 +00:00
|
|
|
canonicalGroups := allGroups
|
|
|
|
// If not case sensitive, lowercase all
|
|
|
|
if !cs {
|
|
|
|
canonicalGroups = make([]string, len(allGroups))
|
|
|
|
for i, v := range allGroups {
|
|
|
|
canonicalGroups[i] = strings.ToLower(v)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-04-27 12:00:26 +00:00
|
|
|
// Retrieve policies
|
|
|
|
var policies []string
|
2018-04-03 13:52:43 +00:00
|
|
|
for _, groupName := range canonicalGroups {
|
2018-01-19 06:44:44 +00:00
|
|
|
group, err := b.Group(ctx, req.Storage, groupName)
|
2016-04-27 12:00:26 +00:00
|
|
|
if err == nil && group != nil {
|
|
|
|
policies = append(policies, group.Policies...)
|
|
|
|
}
|
|
|
|
}
|
2017-04-04 15:54:18 +00:00
|
|
|
if user != nil && user.Policies != nil {
|
2016-11-29 13:35:49 +00:00
|
|
|
policies = append(policies, user.Policies...)
|
|
|
|
}
|
2016-10-14 21:20:50 +00:00
|
|
|
// Policies from each group may overlap
|
2017-04-04 15:54:18 +00:00
|
|
|
policies = strutil.RemoveDuplicates(policies, true)
|
2016-10-14 21:20:50 +00:00
|
|
|
|
2017-11-02 20:05:48 +00:00
|
|
|
return policies, ldapResponse, allGroups, nil
|
2016-04-27 12:00:26 +00:00
|
|
|
}
|
|
|
|
|
2015-05-06 01:54:27 +00:00
|
|
|
const backendHelp = `
|
|
|
|
The "ldap" credential provider allows authentication querying
|
|
|
|
a LDAP server, checking username and password, and associating groups
|
|
|
|
to set of policies.
|
|
|
|
|
|
|
|
Configuration of the server is done through the "config" and "groups"
|
|
|
|
endpoints by a user with root access. Authentication is then done
|
2018-03-20 18:54:10 +00:00
|
|
|
by supplying the two fields for "login".
|
2015-05-06 01:54:27 +00:00
|
|
|
`
|