updateInterfaceLdapFilters saved the matched users with SaveInterface,
which creates the interface when it is missing.
On first start that panics. The sync runs immediately (main.go:85) and
the importer later (main.go:116), so the sync creates a stub row for
every interface_filter key, and the importer, which snapshotted the
interface list before its device round-trips, then fails with "interface
already exists". The window is GetInterfaces plus GetPeers, so a
directory on localhost loses the race and a slower one hides it.
The stub rows are wrong anyway. They have no backend, so a typo in an
interface_filter key quietly created an interface attached to no
controller.
Look the interface up and skip with a warning when it is absent. The
filter is applied on the next sync once the importer has created it. A
lookup error that is not ErrNotFound also skips.
Signed-off-by: clark-ja <37738506+clark-ja@users.noreply.github.com>
disable_missing tested absence against the raw sync result without
checking that the search returned anything usable, so a search that
succeeds and yields nothing looked like "every user has been removed".
Connection and search errors were already safe, since synchronizeLdapUsers
returns before the disable phase. The gap is the successful-but-empty
case: a base_dn or sync_filter that stops matching, an unpopulated
replica, a field_map user_identifier naming an attribute the server does
not return, or a bind account that lost read access to the user subtree.
LDAP gives nothing to tell those apart from a directory that is genuinely
empty; they all answer success with zero entries.
Acting on it is not a database flag. TopicUserDisabled removes each
user's peers from the WireGuard device, the successful search means no
error is logged, and every message on the path was Debug while log_level
defaults to info, so the whole event was silent. It also repeats every
sync interval.
Refuse to disable anyone when no usable identifier came back, logging the
provider, entry count and identifier field. The guard counts identifiers,
not entries, so it covers the field_map case too. The per-user disable
line moves from Debug to Warn so a mass disable is audible even where the
guard does not fire.
The cost is that a directory intentionally emptied of users now disables
nobody. That is documented, along with the workaround: leave one account
matching sync_filter and everyone else is disabled as before.
Signed-off-by: clark-ja <37738506+clark-ja@users.noreply.github.com>
Before this fix, a too early `return` statement terminated the
`updateLdapUsers()` function, whenever one not already existing user was
created. Therefore, in each LDAP sync a maximum of one new user could be
created (i.e., it took x LDAP sync cycles until x new LDAP users are
registered in wg-portal). Depending on the LDAP `sync_interval` this can
take a long time and produces unecessary long waiting times until users
are available in wg-portal.
Removing the early return statement, and move the remainder of the
function into an `else` statement, so that all new users can be
added in a single LDAP sync.
Also adding a debug statement to better trace the behavior.
Signed-off-by: klmmr <35450576+klmmr@users.noreply.github.com>
Public REST API implementation to handle peers, interfaces and users. It also includes some simple provisioning endpoints.
The Swagger API documentation is available under /api/v1/doc.html
Initial alpha codebase for version 2 of WireGuard Portal.
This version is considered unstable and incomplete (for example, no public REST API)!
Use with care!
Fixes/Implements the following issues:
- OAuth support #154, #1
- New Web UI with internationalisation support #98, #107, #89, #62
- Postgres Support #49
- Improved Email handling #47, #119
- DNS Search Domain support #46
- Bugfixes #94, #48
---------
Co-authored-by: Fabian Wechselberger <wechselbergerf@hotmail.com>
Jacopo ClarkandGitHub
klmmrandGitHub
Dmytro BondarandGitHub
sh0rch
