Mirrors/wg-portal
1
0
Fork 0
mirror of https://github.com/h44z/wg-portal.git synced 2025-11-03 23:56:18 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix nested LDAP group resolution

Browse Source
This commit is contained in:
Fabian Schultis
2022-12-07 05:01:06 +01:00
parent 6f463ac9a5
commit a2ab5c9301
2 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
internal/server/configuration.go
View File

@@ -114,7 +114,7 @@ func NewConfig() *Config {
cfg.LDAP.AdminLdapGroup = "CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL" cfg.LDAP.AdminLdapGroup = "CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL"
cfg.LDAP.LoginFilter = "(&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2))" cfg.LDAP.LoginFilter = "(&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2))"
cfg.LDAP.SyncFilter = "(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))" cfg.LDAP.SyncFilter = "(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))"
cfg.LDAP.SyncGroupFilter = "(&(objectCategory=group))" cfg.LDAP.SyncGroupFilter = "(&(objectClass=group))"
cfg.WG.DeviceNames = []string{"wg0"} cfg.WG.DeviceNames = []string{"wg0"}
cfg.WG.DefaultDeviceName = "wg0" cfg.WG.DefaultDeviceName = "wg0"

23
internal/server/ldapsync.go
View File

@@ -4,14 +4,13 @@ import (
"strings" "strings"
"time" "time"
gldap "github.com/go-ldap/ldap/v3"
"github.com/h44z/wg-portal/internal/wireguard" "github.com/h44z/wg-portal/internal/wireguard"
"github.com/h44z/wg-portal/internal/ldap" "github.com/h44z/wg-portal/internal/ldap"
"github.com/h44z/wg-portal/internal/users" "github.com/h44z/wg-portal/internal/users"
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
"gorm.io/gorm" "gorm.io/gorm"
gldap "github.com/go-ldap/ldap/v3"
) )
func (s *Server) SyncLdapWithUserDatabase() { func (s *Server) SyncLdapWithUserDatabase() {
@@ -48,21 +47,33 @@ func (s *Server) SyncLdapWithUserDatabase() {
logrus.Info("ldap user synchronization stopped") logrus.Info("ldap user synchronization stopped")
} }
func (s Server) userIsInAdminGroup(ldapData *ldap.RawLdapData, ldapGroupData []ldap.RawLdapData) bool { func (s Server) userIsInAdminGroup(ldapData *ldap.RawLdapData, ldapGroupData []ldap.RawLdapData, layer int) bool {
if s.config.LDAP.EveryoneAdmin { if s.config.LDAP.EveryoneAdmin {
return true return true
} }
if s.config.LDAP.AdminLdapGroup_ == nil { if s.config.LDAP.AdminLdapGroup_ == nil {
return false return false
} }
//fmt.Printf("%+v\n", ldapData.Attributes)
var prefix string
for i := 0; i < layer; i++ {
prefix += "+"
}
logrus.Tracef("%s Group layer: %d\n", prefix, layer)
for _, group := range ldapData.RawAttributes[s.config.LDAP.GroupMemberAttribute] { for _, group := range ldapData.RawAttributes[s.config.LDAP.GroupMemberAttribute] {
logrus.Tracef("%s%s\n", prefix, string(group))
var dn, _ = gldap.ParseDN(string(group)) var dn, _ = gldap.ParseDN(string(group))
if s.config.LDAP.AdminLdapGroup_.Equal(dn) { if s.config.LDAP.AdminLdapGroup_.Equal(dn) {
logrus.Tracef("%sFOUND: %s\n", prefix, string(group))
return true return true
} }
for _, group2 := range ldapGroupData { for _, group2 := range ldapGroupData {
if group2.DN == string(group) { if group2.DN == string(group) {
return s.userIsInAdminGroup(&group2, ldapGroupData) logrus.Tracef("%sChecking nested: %s\n", prefix, group2.DN)
isAdmin := s.userIsInAdminGroup(&group2, ldapGroupData, layer+1)
if isAdmin {
return true
}
} }
} }
} }
@@ -90,7 +101,7 @@ func (s Server) userChangedInLdap(user *users.User, ldapData *ldap.RawLdapData,
return true return true
} }
if user.IsAdmin != s.userIsInAdminGroup(ldapData, ldapGroupData) { if user.IsAdmin != s.userIsInAdminGroup(ldapData, ldapGroupData, 0) {
return true return true
} }
@@ -165,7 +176,7 @@ func (s *Server) updateLdapUsers(ldapUsers []ldap.RawLdapData, ldapGroups []ldap
user.Lastname = ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute] user.Lastname = ldapUsers[i].Attributes[s.config.LDAP.LastNameAttribute]
user.Email = ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute] user.Email = ldapUsers[i].Attributes[s.config.LDAP.EmailAttribute]
user.Phone = ldapUsers[i].Attributes[s.config.LDAP.PhoneAttribute] user.Phone = ldapUsers[i].Attributes[s.config.LDAP.PhoneAttribute]
user.IsAdmin = s.userIsInAdminGroup(&ldapUsers[i], ldapGroups) user.IsAdmin = s.userIsInAdminGroup(&ldapUsers[i], ldapGroups, 0)
user.Source = users.UserSourceLdap user.Source = users.UserSourceLdap
user.DeletedAt = gorm.DeletedAt{} // Not deleted user.DeletedAt = gorm.DeletedAt{} // Not deleted