179 lines
5.2 KiB
INI
179 lines
5.2 KiB
INI
#################
|
|
# glauth.conf
|
|
|
|
#################
|
|
# General configuration.
|
|
debug = true
|
|
#syslog = true
|
|
|
|
#################
|
|
# The frontend section controls how clients connect to the proxy.
|
|
[frontend]
|
|
tls = false # enable TLS for production!!
|
|
|
|
# Using a nonstandard port to ensure there are no
|
|
# conflicts if running a test alongside a prod instance
|
|
listen = "localhost:3893"
|
|
cert = "cert.pem"
|
|
key = "key.pem"
|
|
|
|
#################
|
|
# The backend section controls the data store.
|
|
[backend]
|
|
datastore = "config"
|
|
baseDN = "dc=glauth,dc=com"
|
|
|
|
#################
|
|
# The users section contains a hardcoded list of valid users.
|
|
# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256
|
|
[[users]]
|
|
name = "hackers"
|
|
uidnumber = 5001
|
|
primarygroup = 5501
|
|
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "ou=superheros,dc=glauth,dc=com"
|
|
|
|
# This user record shows all of the possible fields available
|
|
[[users]]
|
|
name = "johndoe"
|
|
givenname="John"
|
|
sn="Doe"
|
|
mail = "jdoe@example.com"
|
|
uidnumber = 5002
|
|
primarygroup = 5501
|
|
loginShell = "/bin/sh"
|
|
homeDir = "/root"
|
|
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
|
|
sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"]
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "ou=superheros,dc=glauth,dc=com"
|
|
|
|
# This user record tests lots of groups, including group inheritence
|
|
[[users]]
|
|
name = "jamesdoe"
|
|
givenname="James"
|
|
sn="Doe"
|
|
mail = "jdoe2@example.com"
|
|
uidnumber = 5003
|
|
primarygroup = 5501
|
|
loginShell = "/bin/sh"
|
|
otherGroups = [5505,5507]
|
|
homeDir = "/home/jamesdoe"
|
|
passsha256 = "ff522a502031e5f37054892d642c2c0f36af6c4e8f62225470d4a1a99f3c9c2a" # dogood1
|
|
sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"]
|
|
|
|
# 2FA test user
|
|
[[users]]
|
|
name = "alexdoe"
|
|
givenname="Alex"
|
|
sn="Doe"
|
|
mail = "adoe@example.com"
|
|
uidnumber = 5004
|
|
primarygroup = 5501
|
|
loginShell = "/bin/sh"
|
|
otherGroups = [5505,5507]
|
|
otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
|
|
passsha256 = "b1cae08a1fd8b0bd0855e48f74ba2f8548904dd5de72311e6234617a3f661e16" # ThisAloneWontWork!
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "dc=glauth,dc=com"
|
|
|
|
|
|
|
|
# App PW test user without OTP
|
|
[[users]]
|
|
name = "jackdoe"
|
|
givenname="Jack"
|
|
sn="Doe"
|
|
mail = "jdoe3@example.com"
|
|
uidnumber = 5005
|
|
primarygroup = 5501
|
|
loginShell = "/bin/sh"
|
|
otherGroups = [5505,5507]
|
|
passsha256 = "ff522a502031e5f37054892d642c2c0f36af6c4e8f62225470d4a1a99f3c9c2a" #dogood1
|
|
passappsha256 = [
|
|
"c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa", # TestAppPw1
|
|
"c9853d5f2599e90497e9f8cc671bd2022b0fb5d1bd7cfff92f079e8f8f02b8d3", # TestAppPw2
|
|
"4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88", # TestAppPw3
|
|
]
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "dc=glauth,dc=com"
|
|
|
|
# App PW test user with OTP
|
|
[[users]]
|
|
name = "sarahdoe"
|
|
givenname="Sarah"
|
|
sn="Doe"
|
|
mail = "sdoe@example.com"
|
|
uidnumber = 5006
|
|
primarygroup = 5501
|
|
loginShell = "/bin/sh"
|
|
otherGroups = [5505,5507]
|
|
otpsecret = "3hnvnk4ycv44glzigd6s25j4dougs3rk"
|
|
passsha256 = "ff522a502031e5f37054892d642c2c0f36af6c4e8f62225470d4a1a99f3c9c2a" #dogood1
|
|
passappsha256 = [
|
|
"c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa", # TestAppPw1
|
|
"c9853d5f2599e90497e9f8cc671bd2022b0fb5d1bd7cfff92f079e8f8f02b8d3", # TestAppPw2
|
|
"4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88", # TestAppPw3
|
|
]
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "dc=glauth,dc=com"
|
|
|
|
|
|
[[users]]
|
|
name = "serviceuser"
|
|
uidnumber = 5003
|
|
primarygroup = 5502
|
|
passsha256 = "652c7dc687d98c9889304ed2e408c74b611e86a40caa51c4b43f1dd5913c5cd0" # mysecret
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "*"
|
|
|
|
#################
|
|
# The groups section contains a hardcoded list of valid users.
|
|
[[groups]]
|
|
name = "superheros"
|
|
gidnumber = 5501
|
|
|
|
[[groups]]
|
|
name = "svcaccts"
|
|
gidnumber = 5502
|
|
|
|
|
|
[[groups]]
|
|
name = "vpnaccess"
|
|
gidnumber = 5503
|
|
includegroups = [ 5501 ]
|
|
|
|
[[groups]]
|
|
name = "allaccs"
|
|
gidnumber = 5504
|
|
includegroups = [ 5501, 5502 ]
|
|
|
|
[[groups]]
|
|
name = "mailadmin"
|
|
gidnumber = 5505
|
|
|
|
[[groups]]
|
|
name = "webmail"
|
|
gidnumber = 5506
|
|
|
|
|
|
[[groups]]
|
|
name = "fulltime"
|
|
gidnumber = 5507
|
|
|
|
#################
|
|
# Enable and configure the optional REST API here.
|
|
[api]
|
|
enabled = false
|
|
tls = false # enable TLS for production!!
|
|
listen = "localhost:5555"
|
|
cert = "cert.pem"
|
|
key = "key.pem"
|