Update ldap client implementation to github.com/go-ldap/ldap/v3
Add contexts to all relevant functions eg NewHandler
Provide backwards compatibility for sql handlers
customWriter is the sink for log output from libraries that emit
unstructured text. With structured logging enabled it bypassed the
logger and hand-rolled JSON straight to os.Stderr, which had two
consequences.
It escaped only double quotes, so backslashes and control characters
were emitted raw. A Windows path produced "path C:\Users\x", where \U
is not a valid JSON escape, and a message containing a newline split
one record across two lines. Anything parsing these logs saw malformed
records.
It also wrote to stderr regardless of where the logger pointed, so
library messages could not follow the logger to another sink.
zerolog already emits the same fields with correct escaping, so the
branch is removed and everything goes through e.logr. Output is
byte-identical for plain text and quoted strings.
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
v2.1.0 fails to cross-compile for all five linux targets in the xgo
container (C.RTLD_NEXT unresolvable without _GNU_SOURCE), so the
v2.5.3 release shipped darwin pam plugins only. v1.2.0 cross-compiles
cleanly with an identical API surface for this plugin.
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* build(deps): update core deps and align otel stack on 1.46.0
golang.org/x/crypto 0.18.0 -> 0.55.0
google.golang.org/grpc 1.59.0 -> 1.83.1
google.golang.org/protobuf 1.31.0 -> 1.36.12
golang.org/x/net 0.17.0 -> 0.58.0
github.com/gorilla/websocket 1.5.0 -> 1.5.3
The otel stack (core, sdk, trace, metric, all four exporters) plus
contrib/propagators/jaeger now sit together on 1.46.0. grpc 1.83.1
sets the floor for sdk and protobuf; the jaeger propagator's newest
release requires otel core 1.46.0, which in turn lifts crypto and net
above the versions originally targeted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP
* build: respect plugin go.mod versions when pulling dependencies
pull-plugin-dependencies now emits path@version from each plugin
manifest instead of the bare module path, so a dependency added to
the core module arrives at the version the plugin declares.
Pairs with the guard fix in the same line: the substitution was
redirected with &> so it was always empty and never skipped a module
already present. With the guard working, pinned versions only apply
to modules being added, never downgrading what the core already has.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP
* chore: bump plugin submodules to updated dependencies
go-sqlite3 1.14.52, mysql 1.10.1, lib/pq 1.12.3, msteinert/pam v2.1.0.
The pam plugin moves to the v2 major (import path only; the API it
uses is unchanged) and its logr and glauth/ldap entries now match the
core module. Corrects the module path in the mysql, postgres and pam
manifests, which all declared glauth-sqlite.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014L5EoqGWsuZWr8fCVM6izP
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix: reject disabled users on all backends in Bind
A user with disabled = true could still bind on the config backend, since
configHandler.FindUser and LDAPOpsHelper.Bind never checked Disabled while the
SQL backends drop such users at lookup. Enforce it in Bind so every backend
behaves the same.
* fix: use configHandler.Bind rather than helper.Bind in test harness
---------
Co-authored-by: kanywst <niwatakuma@icloud.com>
A user with disabled = true could still bind on the config backend, since
configHandler.FindUser and LDAPOpsHelper.Bind never checked Disabled while the
SQL backends drop such users at lookup. Enforce it in Bind so every backend
behaves the same.
* feat: introduce tls parameters in config to allow startTLS
* feat: pass tls config for startTLS to ldap server
* build: update libs to use newer ldap
* feat: allow tls config for startTLS
* feat: introduce new prometheus monitor object
* feat: add LDAPMonitorWatcher as a potential replacement for v0 Collector
* feat: pass monitor object as dependency and instrument core operations
* feat: instantiate monitor in main
* ci: exclude mock files
* ci: generate mocks before running tests and go vet
* ci: make vet command keep going in case of errors
reason is due to the following happening in the GetStats method of the ldap.Stats struct
```
internal/monitoring/mock_interfaces.go:92:13: assignment copies lock value to ret0: (github.com/nmcclain/ldap.Stats, bool) contains github.com/nmcclain/ldap.Stats contains sync.Mutex
internal/monitoring/mock_interfaces.go:93:9: return copies lock value: github.com/nmcclain/ldap.Stats contains sync.Mutex
internal/monitoring/ldap_test.go:23:56: call of mockLDAPServer.EXPECT().GetStats().MinTimes(1).Return copies lock value: github.com/nmcclain/ldap.Stats contains sync.Mutex
```
* deps: move to use go.uber.org/mock/gomock
* fix: offload prometheus logic to the monitoring package
* fix: offload ui logic to the asset package
* refactor: use handlers coming from assets and monitoring package
* ci: add unit test run and vet command
* fix: make vet happy and adjust code
* build: make build vars optional and passable via env
* build: use . for BUILD_FILES var to allow buildvcs flag
* build: create mkbindir, build and sha256 targets
* build: reuse build target for each platform specific compilation
* Ensure same go version for main and plugins
* chore: release 2.3.0
Release-As: 2.3.0
* release-please
* Fix(plugins)!: Rename the groups table to ldapgroups (#326)
The groups table name is a reserved keyword in mysql and requires that
the table name be escaped with backticks in order to use the groups
name. Other databases such as postgres do not support the use of the
backticks in the query statements. This change renames the groups table
to ldapgroups in oder to avoid this problem altogether.
This does have a dependency on the backend sql plugins to alter the
schema to match the new name.
Signed-off-by: Billy Olsen <billy.olsen@gmail.com>
Co-authored-by: Chris F Ravenscroft <chris@voilaweb.com>
* chore: update docker sqlite with ldapgroups (#338)
* feat: Update migration code to support table names (#339)
* chore(dev): release 2.3.0 (#337)
---------
Signed-off-by: Billy Olsen <billy.olsen@gmail.com>
Co-authored-by: shipperizer <alexcabb@gmail.com>
Co-authored-by: Billy Olsen <wolsen@users.noreply.github.com>
Before:
dn: ou=vpn,ou=users,dc=glauth,dc=com
cn: vpn
After:
dn: ou=vpn,ou=users,dc=glauth,dc=com
ou: vpn <<< THIS HAS CHANGED
NOTE: whereas previously a search filter (cn=vpn) would have found the
group, now you need (ou=vpn)
* Better plugin build for darwin
* add link to documentation, only discovered it while perusing issues list (#276)
* Plugin: Unix PAM Authentication (https://github.com/glauth/glauth/pull/263) (#277)
* Plugin: Unix PAM Authentication (#263)
* Add plugin using pam authentication
Adds an additional plugin which us authenticating against
the PAM unix backend and exposing users and groups local
to the machine glauth is running on.
This can be used to expose local users for authentication
in other services which support ldap only.
* plugins: pam: Rewrite Bind() to use ldapopshelper
Modernizes the implementation of Bind() to make use of the helper
functions provided by LDAPOpsHelper.
In order to support custom authentication the existing config.User
has received an additional PassAppCustom property which allows to
specify a custom authentication callback for a user.
In case of the PAM backend this will be used to authenticate against
the local PAM database.
* plugins: pam: Rewrite Search() to use ldapopshelper
Modernizes the implementation of Search() to make use of the helper
functions provided by LDAPOpsHelper.
* plugins: pam: Capability through group membership
Adds a configuration option which decides if a user gets the search
capability or not based on the group memberships of a user.
* plugins: pam: Apply formatting
Runs gofmt and go get on all changes done earlier
* plugins: pam: Address feedback from CodeClimate
- reduce code similarity
- document new exports
- address casing of variables and functions
- reduce complexity of FindPosixGroups()
- reduce complexity of FindPosixAccounts()
- fix else branch in ldapopshelper
Co-authored-by: Marius Zwicker <marius.zwicker@mlba-team.de>
* Updated README for pam plugin
* Updated README for pam plugin
Co-authored-by: Marius Zwicker <marius@mlba-team.de>
Co-authored-by: Marius Zwicker <marius.zwicker@mlba-team.de>
* Removing db plugins
* Changing plugind package
* Remove main frmo plugin
* Move plugins to their own repos (#283)
* Plugins release build delegated to plugin Makefile
* Build and push docker containers
* README points to documentation
* Shortened README
* Prometheus exported (#284)
* Prometheus exporter
* Feature/zerolog (#285)
* Zerolog
* Adjusted logging levels
* Structured logging including ldap library
* Feature/check config (#286)
Add config check `--check-config`
Co-authored-by: Jörn Friedrich Dreyer <jfd@butonic.de>
Co-authored-by: Zhou Wenzong <wenzong@users.noreply.github.com>
Co-authored-by: Jairo Llopis <Yajo@users.noreply.github.com>
Co-authored-by: Benedikt Kulmann <benedikt@kulmann.biz>
Co-authored-by: Nicolai Willems <172633+nwillems@users.noreply.github.com>
Co-authored-by: Thibault Soubiran <soubi.thibault@gmail.com>
Co-authored-by: Clement JACOB <clems71@gmail.com>
Co-authored-by: Lutz Horn <code@lhorn.de>
Co-authored-by: Márk Sági-Kazár <sagikazarmark@users.noreply.github.com>
Co-authored-by: Peter Heise <pheise@koprolalie.com>
Co-authored-by: Ben Yanke <ben@benyanke.com>
Co-authored-by: fanlix <fanlix@gmail.com>
Co-authored-by: Hank Donnay <hdonnay@gmail.com>
Co-authored-by: dlitster <davidlitster@gmail.com>
Co-authored-by: Marius Zwicker <marius@mlba-team.de>
Co-authored-by: Marius Zwicker <marius.zwicker@mlba-team.de>
gwelch
timmy
Chris F RavenscroftandClaude Opus 5
kt
Neha Oudin
José Julián Espina
Marcel Heers
Alessandro Cabbia
guangwu
NW
Brian Candler
