mirror of https://github.com/grafana/grafana
More work on ldap auth, got memberOf working in the docker ldap test server, playing with config options and structures, #1450
Torkel Ödegaard
11 years ago
parent
a69086a718
commit
bfe7b77313
@ -1,33 +1,25 @@ |
||||
FROM phusion/baseimage:0.9.8 |
||||
MAINTAINER Nick Stenning <nick@whiteink.com> |
||||
FROM debian:jessie |
||||
|
||||
ENV HOME /root |
||||
MAINTAINER Christian Luginbühl <dinke@pimprecords.com> |
||||
|
||||
# Disable SSH |
||||
RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh |
||||
ENV OPENLDAP_VERSION 2.4.40 |
||||
|
||||
# Use baseimage-docker's init system. |
||||
CMD ["/sbin/my_init"] |
||||
RUN apt-get update && \ |
||||
DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \ |
||||
slapd=${OPENLDAP_VERSION}* && \ |
||||
apt-get clean && \ |
||||
rm -rf /var/lib/apt/lists/* |
||||
|
||||
# Configure apt |
||||
RUN echo 'deb http://us.archive.ubuntu.com/ubuntu/ precise universe' >> /etc/apt/sources.list |
||||
RUN apt-get -y update |
||||
|
||||
# Install slapd |
||||
RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd |
||||
|
||||
# Default configuration: can be overridden at the docker command line |
||||
ENV LDAP_ROOTPASS toor |
||||
ENV LDAP_ORG Acme Widgets Inc. |
||||
ENV LDAP_DOMAIN example.com |
||||
RUN mv /etc/ldap /etc/ldap.dist |
||||
|
||||
EXPOSE 389 |
||||
|
||||
RUN mkdir /etc/service/slapd |
||||
ADD slapd.sh /etc/service/slapd/run |
||||
VOLUME ["/etc/ldap", "/var/lib/ldap"] |
||||
|
||||
COPY modules/ /etc/ldap.dist/modules |
||||
|
||||
# To store the data outside the container, mount /var/lib/ldap as a data volume |
||||
COPY entrypoint.sh /entrypoint.sh |
||||
|
||||
RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* |
||||
ENTRYPOINT ["/entrypoint.sh"] |
||||
|
||||
# vim:ts=8:noet: |
||||
CMD ["slapd", "-d", "32768", "-u", "openldap", "-g", "openldap"] |
||||
|
||||
@ -1,42 +0,0 @@ |
||||
#!/bin/sh |
||||
|
||||
set -eu |
||||
|
||||
status () { |
||||
echo "---> ${@}" >&2 |
||||
} |
||||
|
||||
set -x |
||||
: LDAP_ROOTPASS=${LDAP_ROOTPASS} |
||||
: LDAP_DOMAIN=${LDAP_DOMAIN} |
||||
: LDAP_ORGANISATION=${LDAP_ORGANISATION} |
||||
|
||||
if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then |
||||
status "configuring slapd for first run" |
||||
|
||||
cat <<EOF | debconf-set-selections |
||||
slapd slapd/internal/generated_adminpw password ${LDAP_ROOTPASS} |
||||
slapd slapd/internal/adminpw password ${LDAP_ROOTPASS} |
||||
slapd slapd/password2 password ${LDAP_ROOTPASS} |
||||
slapd slapd/password1 password ${LDAP_ROOTPASS} |
||||
slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION |
||||
slapd slapd/domain string ${LDAP_DOMAIN} |
||||
slapd shared/organization string ${LDAP_ORGANISATION} |
||||
slapd slapd/backend string HDB |
||||
slapd slapd/purge_database boolean true |
||||
slapd slapd/move_old_database boolean true |
||||
slapd slapd/allow_ldap_v2 boolean false |
||||
slapd slapd/no_configuration boolean false |
||||
slapd slapd/dump_database select when needed |
||||
EOF |
||||
|
||||
dpkg-reconfigure -f noninteractive slapd |
||||
|
||||
touch /var/lib/ldap/docker_bootstrapped |
||||
else |
||||
status "found already-configured slapd" |
||||
fi |
||||
|
||||
status "starting slapd" |
||||
set -x |
||||
exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0 |
||||
@ -1,56 +0,0 @@ |
||||
package ldapauth |
||||
|
||||
import ( |
||||
"errors" |
||||
"fmt" |
||||
"net/url" |
||||
|
||||
"github.com/go-ldap/ldap" |
||||
"github.com/grafana/grafana/pkg/log" |
||||
"github.com/grafana/grafana/pkg/setting" |
||||
) |
||||
|
||||
var ( |
||||
ErrInvalidCredentials = errors.New("Invalid Username or Password") |
||||
) |
||||
|
||||
func Login(username, password string) error { |
||||
url, err := url.Parse(setting.LdapHosts[0]) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
|
||||
log.Info("Host: %v", url.Host) |
||||
conn, err := ldap.Dial("tcp", url.Host) |
||||
if err != nil { |
||||
return err |
||||
} |
||||
|
||||
defer conn.Close() |
||||
|
||||
bindFormat := "cn=%s,dc=grafana,dc=org" |
||||
|
||||
nx := fmt.Sprintf(bindFormat, username) |
||||
err = conn.Bind(nx, password) |
||||
|
||||
if err != nil { |
||||
if ldapErr, ok := err.(*ldap.Error); ok { |
||||
if ldapErr.ResultCode == 49 { |
||||
return ErrInvalidCredentials |
||||
} |
||||
} |
||||
return err |
||||
} |
||||
return nil |
||||
|
||||
// search := ldap.NewSearchRequest(url.Path,
|
||||
// ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
|
||||
// fmt.Sprintf(ls.Filter, name),
|
||||
// []string{ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail},
|
||||
// nil)
|
||||
// sr, err := l.Search(search)
|
||||
// if err != nil {
|
||||
// log.Debug("LDAP Authen OK but not in filter %s", name)
|
||||
// return "", "", "", "", false
|
||||
// }
|
||||
} |
||||
@ -1,19 +1,25 @@ |
||||
package setting |
||||
|
||||
type LdapFilterToOrg struct { |
||||
Filter string |
||||
OrgId int |
||||
OrgRole string |
||||
type LdapMemberToOrgRole struct { |
||||
LdapMemberPattern string |
||||
OrgId int |
||||
OrgRole string |
||||
} |
||||
|
||||
type LdapSettings struct { |
||||
Enabled bool |
||||
Hosts []string |
||||
type LdapServerConf struct { |
||||
Host string |
||||
Port string |
||||
UseSSL bool |
||||
BindDN string |
||||
BindPassword string |
||||
AttrUsername string |
||||
AttrName string |
||||
AttrSurname string |
||||
AttrMail string |
||||
Filters []LdapFilterToOrg |
||||
AttrMemberOf string |
||||
|
||||
SearchFilter []string |
||||
SearchBaseDNs []string |
||||
|
||||
LdapMemberMap []LdapMemberToOrgRole |
||||
} |
||||
|
||||
Loading…
Reference in new issue