add ldap thing
This commit is contained in:
parent
edf013502d
commit
c432c7dbf2
12 changed files with 664 additions and 0 deletions
13
ldap-auth-server/CHANGELOG.md
Normal file
13
ldap-auth-server/CHANGELOG.md
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
<!--
|
||||||
|
https://developers.home-assistant.io/docs/add-ons/presentation#keeping-a-changelog
|
||||||
|
-->
|
||||||
|
|
||||||
|
# Changelog
|
||||||
|
|
||||||
|
## [Unreleased]
|
||||||
|
|
||||||
|
## 0.1.0
|
||||||
|
|
||||||
|
### Added
|
||||||
|
|
||||||
|
- Initial release
|
||||||
62
ldap-auth-server/DOCS.md
Normal file
62
ldap-auth-server/DOCS.md
Normal file
|
|
@ -0,0 +1,62 @@
|
||||||
|
# Home Assistant Add-on: LDAP Auth Server
|
||||||
|
|
||||||
|
## How to use
|
||||||
|
|
||||||
|
1. Install the add-on.
|
||||||
|
2. Configure `LDAP Server URL` and `Bind DN Template` to match your LDAP
|
||||||
|
server.
|
||||||
|
3. (Optionally) Configure `Search Base DN` and `Search Filter Template` if you
|
||||||
|
want to hide some users from Home Assistant.
|
||||||
|
4. Copy the
|
||||||
|
[ldap_auth_command.sh](https://github.com/vqvu/home-assistant-addons/ldap-auth-server/ldap_auth_command.sh)
|
||||||
|
file to your Home Assistant config directory.
|
||||||
|
5. Add a custom [Command Line authentication
|
||||||
|
provider](https://www.home-assistant.io/docs/authentication/providers/#command-line)
|
||||||
|
to your configuration to call that script.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
homeassistant:
|
||||||
|
auth_providers:
|
||||||
|
- type: command_line
|
||||||
|
command: /config/ldap_auth_command.sh
|
||||||
|
args:
|
||||||
|
# Provide the hostname of the add-on as the first argument. You can
|
||||||
|
# the hostname on the add-on's Info page.
|
||||||
|
- 7860403f-ldap-auth-server
|
||||||
|
meta: true
|
||||||
|
# Optionally add the homeassistant provider as a fallback if you're
|
||||||
|
# concerned about a failed LDAP server locking you out of Home
|
||||||
|
# Assistant.
|
||||||
|
# - type: homeassistant
|
||||||
|
```
|
||||||
|
|
||||||
|
## Limitations
|
||||||
|
|
||||||
|
These limitations are current as of Home Assistant v2023.2.
|
||||||
|
|
||||||
|
1. The users created via the `command_line` provider are different from the
|
||||||
|
ones created via the `homeassistant` provider, even if their usernames are
|
||||||
|
the same. This means you will lose all user configurations when adopting a
|
||||||
|
new auth provider.
|
||||||
|
2. Users created by `command_line` provider are all Administrators, and it is
|
||||||
|
not possible to change this in the UI. You will need to manually modify the
|
||||||
|
`group_ids` field of the user in the `/config/.storage/auth` file to be
|
||||||
|
`system-users`. Example
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"id": "5de09f4cdcdb4d4fa2a39291147803df",
|
||||||
|
"group_ids": [
|
||||||
|
"system-users"
|
||||||
|
],
|
||||||
|
...
|
||||||
|
"name": "Non-admin User",
|
||||||
|
...
|
||||||
|
},
|
||||||
|
```
|
||||||
|
|
||||||
|
Don't forget to restart your Home Assistant afterwards.
|
||||||
|
3. This add-on is only tested with an [LLDAP
|
||||||
|
server](https://github.com/nitnelave/lldap), so it is possible (though
|
||||||
|
probably unlikely) that it doesn't work with other types of LDAP servers for
|
||||||
|
one reason or another.
|
||||||
16
ldap-auth-server/Dockerfile
Normal file
16
ldap-auth-server/Dockerfile
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
# # https://developers.home-assistant.io/docs/add-ons/configuration#add-on-dockerfile
|
||||||
|
ARG BUILD_FROM
|
||||||
|
FROM $BUILD_FROM AS build
|
||||||
|
|
||||||
|
COPY . /build
|
||||||
|
|
||||||
|
WORKDIR /build
|
||||||
|
|
||||||
|
# Execute during the build of the image
|
||||||
|
RUN apk add --no-cache go && go build
|
||||||
|
|
||||||
|
FROM $BUILD_FROM
|
||||||
|
|
||||||
|
COPY --from=build /build/ldap-auth-server /usr/bin
|
||||||
|
|
||||||
|
CMD ["/usr/bin/ldap-auth-server", "/data/options.json"]
|
||||||
24
ldap-auth-server/README.md
Normal file
24
ldap-auth-server/README.md
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Home Assistant Add-on: LDAP Authentication Server
|
||||||
|
|
||||||
|
![Supports aarch64 Architecture][aarch64-shield] ![Supports amd64
|
||||||
|
Architecture][amd64-shield] ![Supports armhf Architecture][armhf-shield]
|
||||||
|
![Supports armv7 Architecture][armv7-shield] ![Supports i386
|
||||||
|
Architecture][i386-shield]
|
||||||
|
|
||||||
|
This add-on runs a simple HTTP server that can authenticate users against an
|
||||||
|
LDAP server. It is meant to be used in conjunction with Home Assistant's
|
||||||
|
[Command Line authentication
|
||||||
|
provider](https://www.home-assistant.io/docs/authentication/providers/#command-line),
|
||||||
|
so it only implements the bare minimum functionality to support that.
|
||||||
|
|
||||||
|
This add-on is as an alternative to the shell script at
|
||||||
|
<https://github.com/bob1de/ldap-auth-sh> for containerized Home Assistant
|
||||||
|
installs. Unlike `ldap-auth-sh`, all LDAP functionality is wrapped in the add-on
|
||||||
|
and exposed via an HTTP endpoint. That way, only `curl` is needed from within
|
||||||
|
the Home Assistant container.
|
||||||
|
|
||||||
|
[aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg
|
||||||
|
[amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg
|
||||||
|
[armhf-shield]: https://img.shields.io/badge/armhf-yes-green.svg
|
||||||
|
[armv7-shield]: https://img.shields.io/badge/armv7-yes-green.svg
|
||||||
|
[i386-shield]: https://img.shields.io/badge/i386-yes-green.svg
|
||||||
42
ldap-auth-server/apparmor.txt
Normal file
42
ldap-auth-server/apparmor.txt
Normal file
|
|
@ -0,0 +1,42 @@
|
||||||
|
#include <tunables/global>
|
||||||
|
|
||||||
|
profile ldap-auth-server flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
# Capabilities
|
||||||
|
file,
|
||||||
|
signal (send) set=(kill,term,int,hup,cont),
|
||||||
|
|
||||||
|
# S6-Overlay
|
||||||
|
/init ix,
|
||||||
|
/bin/** ix,
|
||||||
|
/usr/bin/** ix,
|
||||||
|
/run/{s6,s6-rc*,service}/** ix,
|
||||||
|
/package/** ix,
|
||||||
|
/command/** ix,
|
||||||
|
/etc/services.d/** rwix,
|
||||||
|
/etc/cont-init.d/** rwix,
|
||||||
|
/etc/cont-finish.d/** rwix,
|
||||||
|
/run/{,**} rwk,
|
||||||
|
/dev/tty rw,
|
||||||
|
|
||||||
|
# Access to options.json and other files within your addon
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
profile /usr/bin/ldap-auth-server flags=(attach_disconnected,mediate_deleted) {
|
||||||
|
#include <abstractions/base>
|
||||||
|
|
||||||
|
# Receive signals from S6-Overlay
|
||||||
|
signal (receive) peer=*_ldap-auth-server,
|
||||||
|
|
||||||
|
# Access to options.json and other files within your addon
|
||||||
|
/data/** rw,
|
||||||
|
|
||||||
|
# Access required for service functionality
|
||||||
|
# Note: List was built by doing the following:
|
||||||
|
# 1. Add what is obviously needed based on what is in the script
|
||||||
|
# 2. Add `complain` as a flag to this profile temporarily and run the addon
|
||||||
|
# 3. Review the audit log with `journalctl _TRANSPORT="audit" -g 'apparmor="ALLOWED"'` and add other access as needed
|
||||||
|
# Remember to remove the `complain` flag when you are done
|
||||||
|
}
|
||||||
|
}
|
||||||
14
ldap-auth-server/build.yaml
Normal file
14
ldap-auth-server/build.yaml
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
# https://developers.home-assistant.io/docs/add-ons/configuration#add-on-dockerfile
|
||||||
|
build_from:
|
||||||
|
aarch64: "ghcr.io/home-assistant/aarch64-base:3.15"
|
||||||
|
amd64: "ghcr.io/home-assistant/amd64-base:3.15"
|
||||||
|
armhf: "ghcr.io/home-assistant/armhf-base:3.15"
|
||||||
|
armv7: "ghcr.io/home-assistant/armv7-base:3.15"
|
||||||
|
i386: "ghcr.io/home-assistant/i386-base:3.15"
|
||||||
|
labels:
|
||||||
|
org.opencontainers.image.title: "Home Assistant Add-on: LDAP Authentication Server add-on"
|
||||||
|
org.opencontainers.image.description: "Add-on to add LDAP authentication to Home Assistant."
|
||||||
|
org.opencontainers.image.source: "https://github.com/vqvu/home-assistant-addons/ldap-auth-server"
|
||||||
|
org.opencontainers.image.licenses: "Apache License 2.0"
|
||||||
|
args:
|
||||||
|
TEMPIO_VERSION: "2021.09.0"
|
||||||
32
ldap-auth-server/config.yaml
Normal file
32
ldap-auth-server/config.yaml
Normal file
|
|
@ -0,0 +1,32 @@
|
||||||
|
# https://developers.home-assistant.io/docs/add-ons/configuration#add-on-config
|
||||||
|
name: LDAP Authentication Server
|
||||||
|
version: "0.1.2"
|
||||||
|
slug: ldap-auth-server
|
||||||
|
description: Add-on to add LDAP authentication to Home Assistant.
|
||||||
|
url: "https://github.com/BlackDragon-B/ldap-auth-server"
|
||||||
|
arch:
|
||||||
|
- armhf
|
||||||
|
- armv7
|
||||||
|
- aarch64
|
||||||
|
- amd64
|
||||||
|
- i386
|
||||||
|
startup: services
|
||||||
|
init: false
|
||||||
|
map:
|
||||||
|
- share:rw
|
||||||
|
ports:
|
||||||
|
80/tcp: null
|
||||||
|
options:
|
||||||
|
ldap_server_url: null
|
||||||
|
bind_dn_template: null
|
||||||
|
bind_dn_password: null
|
||||||
|
search_base_dn: ""
|
||||||
|
search_filter_template: ""
|
||||||
|
debug_mode: false
|
||||||
|
schema:
|
||||||
|
ldap_server_url: str
|
||||||
|
bind_dn_template: str
|
||||||
|
bind_dn_password: str
|
||||||
|
search_base_dn: str?
|
||||||
|
search_filter_template: str?
|
||||||
|
debug_mode: bool
|
||||||
37
ldap-auth-server/go.mod
Normal file
37
ldap-auth-server/go.mod
Normal file
|
|
@ -0,0 +1,37 @@
|
||||||
|
module github.com/vqvu/home-assistant-addons/ldap-auth-server
|
||||||
|
|
||||||
|
go 1.19
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/gin-gonic/gin v1.9.0
|
||||||
|
github.com/go-ldap/ldap/v3 v3.4.4
|
||||||
|
github.com/sirupsen/logrus v1.9.0
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
|
||||||
|
github.com/bytedance/sonic v1.8.2 // indirect
|
||||||
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
|
||||||
|
github.com/gin-contrib/sse v0.1.0 // indirect
|
||||||
|
github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
|
||||||
|
github.com/go-playground/locales v0.14.1 // indirect
|
||||||
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
||||||
|
github.com/go-playground/validator/v10 v10.11.2 // indirect
|
||||||
|
github.com/goccy/go-json v0.10.0 // indirect
|
||||||
|
github.com/json-iterator/go v1.1.12 // indirect
|
||||||
|
github.com/klauspost/cpuid/v2 v2.2.4 // indirect
|
||||||
|
github.com/leodido/go-urn v1.2.1 // indirect
|
||||||
|
github.com/mattn/go-isatty v0.0.17 // indirect
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
||||||
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||||
|
github.com/pelletier/go-toml/v2 v2.0.6 // indirect
|
||||||
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
||||||
|
github.com/ugorji/go/codec v1.2.10 // indirect
|
||||||
|
golang.org/x/arch v0.2.0 // indirect
|
||||||
|
golang.org/x/crypto v0.6.0 // indirect
|
||||||
|
golang.org/x/net v0.7.0 // indirect
|
||||||
|
golang.org/x/sys v0.5.0 // indirect
|
||||||
|
golang.org/x/text v0.7.0 // indirect
|
||||||
|
google.golang.org/protobuf v1.28.1 // indirect
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
||||||
|
)
|
||||||
104
ldap-auth-server/go.sum
Normal file
104
ldap-auth-server/go.sum
Normal file
|
|
@ -0,0 +1,104 @@
|
||||||
|
github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
|
||||||
|
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
|
||||||
|
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
|
||||||
|
github.com/bytedance/sonic v1.5.0/go.mod h1:ED5hyg4y6t3/9Ku1R6dU/4KyJ48DZ4jPhfY1O2AihPM=
|
||||||
|
github.com/bytedance/sonic v1.8.2 h1:Eq1oE3xWIBE3tj2ZtJFK1rDAx7+uA4bRytozVhXMHKY=
|
||||||
|
github.com/bytedance/sonic v1.8.2/go.mod h1:i736AoUSYt75HyZLoJW9ERYxcy6eaN6h4BZXU064P/U=
|
||||||
|
github.com/chenzhuoyu/base64x v0.0.0-20211019084208-fb5309c8db06/go.mod h1:DH46F32mSOjUmXrMHnKwZdA8wcEefY7UVqBKYGjpdQY=
|
||||||
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 h1:qSGYFH7+jGhDF8vLC+iwCD4WpbV1EBDSzWkJODFLams=
|
||||||
|
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311/go.mod h1:b583jCggY9gE99b6G5LEC39OIiVsWj+R97kbl5odCEk=
|
||||||
|
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||||
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
|
||||||
|
github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
|
||||||
|
github.com/gin-gonic/gin v1.9.0 h1:OjyFBKICoexlu99ctXNR2gg+c5pKrKMuyjgARg9qeY8=
|
||||||
|
github.com/gin-gonic/gin v1.9.0/go.mod h1:W1Me9+hsUSyj3CePGrd1/QrKJMSJ1Tu/0hFEH89961k=
|
||||||
|
github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
|
||||||
|
github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
|
||||||
|
github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
|
||||||
|
github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
|
||||||
|
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
|
||||||
|
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
|
||||||
|
github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
|
||||||
|
github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
|
||||||
|
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
|
||||||
|
github.com/go-playground/validator/v10 v10.11.2 h1:q3SHpufmypg+erIExEKUmsgmhDTyhcJ38oeKGACXohU=
|
||||||
|
github.com/go-playground/validator/v10 v10.11.2/go.mod h1:NieE624vt4SCTJtD87arVLvdmjPAeV8BQlHtMnw9D7s=
|
||||||
|
github.com/goccy/go-json v0.10.0 h1:mXKd9Qw4NuzShiRlOXKews24ufknHO7gx30lsDyokKA=
|
||||||
|
github.com/goccy/go-json v0.10.0/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
|
||||||
|
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
|
||||||
|
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
|
||||||
|
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
|
||||||
|
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
|
||||||
|
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
|
||||||
|
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
|
||||||
|
github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
|
||||||
|
github.com/klauspost/cpuid/v2 v2.2.4 h1:acbojRNwl3o09bUq+yDCtZFc1aiwaAAxtcn8YkZXnvk=
|
||||||
|
github.com/klauspost/cpuid/v2 v2.2.4/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
|
||||||
|
github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
|
||||||
|
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
|
||||||
|
github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
|
||||||
|
github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
|
||||||
|
github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
|
||||||
|
github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
|
||||||
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
|
||||||
|
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
|
||||||
|
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
|
||||||
|
github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
|
||||||
|
github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/rogpeppe/go-internal v1.8.0 h1:FCbCCtXNOY3UtUuHUYaghJg4y7Fd14rXifAYUAtL9R8=
|
||||||
|
github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
|
||||||
|
github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
|
||||||
|
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||||
|
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
|
||||||
|
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
|
||||||
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||||
|
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
|
||||||
|
github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
|
||||||
|
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
|
||||||
|
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
|
||||||
|
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||||
|
github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
|
||||||
|
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
|
||||||
|
github.com/ugorji/go/codec v1.2.10 h1:eimT6Lsr+2lzmSZxPhLFoOWFmQqwk0fllJJ5hEbTXtQ=
|
||||||
|
github.com/ugorji/go/codec v1.2.10/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
|
||||||
|
golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
|
||||||
|
golang.org/x/arch v0.2.0 h1:W1sUEHXiJTfjaFJ5SLo0N6lZn+0eO5gWD1MFeTGqQEY=
|
||||||
|
golang.org/x/arch v0.2.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
|
||||||
|
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||||
|
golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
|
||||||
|
golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
|
||||||
|
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||||
|
golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
|
||||||
|
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||||
|
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
|
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
|
||||||
|
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
|
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||||
|
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
|
golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
|
||||||
|
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
|
||||||
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
|
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
|
||||||
|
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||||
|
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
|
||||||
|
google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
|
||||||
|
google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||||
|
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
|
rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
|
||||||
16
ldap-auth-server/ldap_auth_command.sh
Normal file
16
ldap-auth-server/ldap_auth_command.sh
Normal file
|
|
@ -0,0 +1,16 @@
|
||||||
|
#!/bin/bash
|
||||||
|
set -o errexit
|
||||||
|
set -o pipefail
|
||||||
|
set -o nounset
|
||||||
|
|
||||||
|
HOST="${1:-localhost:8080}"
|
||||||
|
ESCAPED_USERNAME="$(jq --raw-input <<< "${username}")"
|
||||||
|
ESCAPED_PASSWORD="$(jq --raw-input <<< "${password}")"
|
||||||
|
curl http://${HOST}/hass_authenticate \
|
||||||
|
-X POST \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
--fail-with-body \
|
||||||
|
-d "$(cat << EOF
|
||||||
|
{"username": ${ESCAPED_USERNAME},"password": ${ESCAPED_PASSWORD}}
|
||||||
|
EOF
|
||||||
|
)"
|
||||||
265
ldap-auth-server/main.go
Normal file
265
ldap-auth-server/main.go
Normal file
|
|
@ -0,0 +1,265 @@
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"net/http"
|
||||||
|
"os"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/gin-gonic/gin"
|
||||||
|
ldap "github.com/go-ldap/ldap/v3"
|
||||||
|
log "github.com/sirupsen/logrus"
|
||||||
|
)
|
||||||
|
|
||||||
|
var configFile = flag.String("config", "/data/options.json", "The path to the server's config file")
|
||||||
|
|
||||||
|
// LDAPOptions holds the opotions for an `LDAPAuthenticator`.
|
||||||
|
type LDAPOptions struct {
|
||||||
|
ServerURL string
|
||||||
|
BindDNTemplate string
|
||||||
|
BindDNPassword string
|
||||||
|
SearchBaseDN string
|
||||||
|
SearchFilterTemplate string
|
||||||
|
}
|
||||||
|
|
||||||
|
// LDAPUser holds metadata about a user from an LDAP server.
|
||||||
|
type LDAPUser struct {
|
||||||
|
DisplayName string
|
||||||
|
}
|
||||||
|
|
||||||
|
// LDAPAuthenticator is a client for authenticating users against an LDAP server.
|
||||||
|
type LDAPAuthenticator struct {
|
||||||
|
Options LDAPOptions
|
||||||
|
}
|
||||||
|
|
||||||
|
// Authenticate authenticates a user given their username and password.
|
||||||
|
//
|
||||||
|
// If authentication is successful, it also returns metadata about the
|
||||||
|
// authenticated user.
|
||||||
|
func (a *LDAPAuthenticator) Authenticate(username, password string) (bool, LDAPUser, error) {
|
||||||
|
if password == "" {
|
||||||
|
return false, LDAPUser{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
conn, err := ldap.DialURL(a.Options.ServerURL)
|
||||||
|
if err != nil {
|
||||||
|
return false, LDAPUser{}, fmt.Errorf("could not dial server at %q: %w", a.Options.ServerURL, err)
|
||||||
|
}
|
||||||
|
defer conn.Close()
|
||||||
|
|
||||||
|
bindDN := a.Options.BindDNTemplate
|
||||||
|
log.Debugf("Binding to DN: %q", bindDN)
|
||||||
|
if err := conn.Bind(a.Options.BindDNTemplate, a.Options.BindDNPassword); err != nil {
|
||||||
|
log.Debugf("Could not bind to user %q: %q with password %q", bindDN, err, a.Options.BindDNPassword)
|
||||||
|
return false, LDAPUser{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
searchFilter := fmt.Sprintf(a.Options.SearchFilterTemplate, username)
|
||||||
|
log.Debugf("Searching with filter: %q", searchFilter)
|
||||||
|
res, err := conn.Search(ldap.NewSearchRequest(
|
||||||
|
a.Options.SearchBaseDN,
|
||||||
|
ldap.ScopeWholeSubtree,
|
||||||
|
ldap.NeverDerefAliases,
|
||||||
|
/* SizeLimit= */ 2,
|
||||||
|
/* TimeLimit= */ 1,
|
||||||
|
/* TypesOnly= */ false,
|
||||||
|
searchFilter,
|
||||||
|
/* Attribuutes= */ nil,
|
||||||
|
/* Controls= */ nil,
|
||||||
|
))
|
||||||
|
if err != nil {
|
||||||
|
log.Warnf("Search failed: %v", err)
|
||||||
|
return false, LDAPUser{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(res.Entries) == 0 {
|
||||||
|
log.Debugf("No matches found for filter: %q", searchFilter)
|
||||||
|
return false, LDAPUser{}, nil
|
||||||
|
}
|
||||||
|
if len(res.Entries) > 1 {
|
||||||
|
log.Debugf("More than one (%d) matches found for filter: %q", len(res.Entries), searchFilter)
|
||||||
|
return false, LDAPUser{}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
entry := res.Entries[0]
|
||||||
|
if log.IsLevelEnabled(log.DebugLevel) {
|
||||||
|
var entryStr strings.Builder
|
||||||
|
fmt.Fprintf(&entryStr, "DN: %q\n", entry.DN)
|
||||||
|
for _, attr := range entry.Attributes {
|
||||||
|
fmt.Fprintf(&entryStr, "%s: %q\n", attr.Name, attr.Values)
|
||||||
|
}
|
||||||
|
log.Debugf("User entry:\n%v", entryStr.String())
|
||||||
|
}
|
||||||
|
return true, LDAPUser{
|
||||||
|
DisplayName: entry.GetAttributeValue("cn"),
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var ErrUserAuthnFailed = errors.New("could not authenticate user")
|
||||||
|
|
||||||
|
type ServerOptions struct {
|
||||||
|
LDAPOptions LDAPOptions
|
||||||
|
}
|
||||||
|
|
||||||
|
type HASSAuthenticateRequest struct {
|
||||||
|
Username string `json:"username" binding:"required"`
|
||||||
|
Password string `json:"password" binding:"required"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type ErrorResponse struct {
|
||||||
|
StatusCode int
|
||||||
|
PublicError string
|
||||||
|
Error error
|
||||||
|
}
|
||||||
|
|
||||||
|
type Server struct {
|
||||||
|
options ServerOptions
|
||||||
|
authenticator LDAPAuthenticator
|
||||||
|
router *gin.Engine
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewServer creates a new Server.
|
||||||
|
func NewServer(options ServerOptions) *Server {
|
||||||
|
server := &Server{
|
||||||
|
options: options,
|
||||||
|
authenticator: LDAPAuthenticator{
|
||||||
|
Options: options.LDAPOptions,
|
||||||
|
},
|
||||||
|
router: gin.Default(),
|
||||||
|
}
|
||||||
|
if err := server.router.SetTrustedProxies(nil); err != nil {
|
||||||
|
panic("Not possible")
|
||||||
|
}
|
||||||
|
server.router.POST("/hass_authenticate", server.hassAuthenticate)
|
||||||
|
return server
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Server) writeError(c *gin.Context, err ErrorResponse) {
|
||||||
|
if err.StatusCode >= 400 && err.StatusCode < 500 {
|
||||||
|
log.Infof(err.Error.Error())
|
||||||
|
} else {
|
||||||
|
log.Warnf(err.Error.Error())
|
||||||
|
}
|
||||||
|
|
||||||
|
if gin.Mode() == gin.DebugMode {
|
||||||
|
c.JSON(err.StatusCode, gin.H{"error": err.Error.Error()})
|
||||||
|
} else {
|
||||||
|
c.JSON(err.StatusCode, gin.H{"error": err.PublicError})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Server) hassAuthenticate(c *gin.Context) {
|
||||||
|
var req HASSAuthenticateRequest
|
||||||
|
if err := c.BindJSON(&req); err != nil {
|
||||||
|
s.writeError(c, ErrorResponse{
|
||||||
|
StatusCode: http.StatusBadRequest,
|
||||||
|
PublicError: err.Error(),
|
||||||
|
Error: err,
|
||||||
|
})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
ok, user, err := s.authenticator.Authenticate(req.Username, req.Password)
|
||||||
|
if err != nil {
|
||||||
|
s.writeError(c, ErrorResponse{
|
||||||
|
StatusCode: http.StatusBadRequest,
|
||||||
|
PublicError: fmt.Sprintf("Could not authenticate user %q", req.Username),
|
||||||
|
Error: fmt.Errorf("when authenticating: %w", err),
|
||||||
|
})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if !ok {
|
||||||
|
s.writeError(c, ErrorResponse{
|
||||||
|
StatusCode: http.StatusBadRequest,
|
||||||
|
PublicError: fmt.Sprintf("Could not authenticate user: %q", req.Username),
|
||||||
|
Error: fmt.Errorf("when authenticating %q: %w", req.Username, ErrUserAuthnFailed),
|
||||||
|
})
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if user.DisplayName != "" {
|
||||||
|
safeDN := strings.ReplaceAll(user.DisplayName, "\n", "")
|
||||||
|
fmt.Fprintf(c.Writer, "name = %v", safeDN)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Serve starts the server listening to requests.
|
||||||
|
func (s *Server) Serve() error {
|
||||||
|
addr := ":80"
|
||||||
|
log.Infof("Starting server at: %q", addr)
|
||||||
|
return s.router.Run(addr)
|
||||||
|
}
|
||||||
|
|
||||||
|
// AddOnConfig is the struct representing the add-on's configuration.
|
||||||
|
type AddOnConfig struct {
|
||||||
|
LDAPServerURL string `json:"ldap_server_url"`
|
||||||
|
BindDNTemplate string `json:"bind_dn_template"`
|
||||||
|
BindDNPassword string `json:"bind_dn_password"`
|
||||||
|
SearchBaseDN string `json:"search_base_dn"`
|
||||||
|
SearchFilterTemplate string `json:"search_filter_template"`
|
||||||
|
DebugMode bool `json:"debug_mode"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// parseAddOnConfig parses the `AddOnConfig` from a JSON file.
|
||||||
|
func parseAddOnConfig(configFile string) (AddOnConfig, error) {
|
||||||
|
jsonBytes, err := os.ReadFile(configFile)
|
||||||
|
if err != nil {
|
||||||
|
return AddOnConfig{}, fmt.Errorf("could not read config file: %q: %w", configFile, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var config AddOnConfig
|
||||||
|
err = json.Unmarshal(jsonBytes, &config)
|
||||||
|
if err != nil {
|
||||||
|
return AddOnConfig{}, fmt.Errorf("could not parse config file: %q: %w", configFile, err)
|
||||||
|
}
|
||||||
|
return config, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var ErrInvalidServerOptions = errors.New("invalid server options")
|
||||||
|
|
||||||
|
func toServerOptions(config AddOnConfig) (ServerOptions, error) {
|
||||||
|
if (config.SearchBaseDN == "") != (config.SearchFilterTemplate == "") {
|
||||||
|
return ServerOptions{}, fmt.Errorf("search_base_dn (%q) and search_filter (%q) must both be set or both be unset: %w", config.SearchBaseDN, config.SearchFilterTemplate, ErrInvalidServerOptions)
|
||||||
|
}
|
||||||
|
|
||||||
|
log.Infof("Loaded config: %+v", config)
|
||||||
|
return ServerOptions{
|
||||||
|
LDAPOptions: LDAPOptions{
|
||||||
|
ServerURL: config.LDAPServerURL,
|
||||||
|
BindDNTemplate: config.BindDNTemplate,
|
||||||
|
SearchBaseDN: config.SearchBaseDN,
|
||||||
|
SearchFilterTemplate: config.SearchFilterTemplate,
|
||||||
|
},
|
||||||
|
}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
log.SetReportCaller(true)
|
||||||
|
log.SetLevel(log.InfoLevel)
|
||||||
|
}
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
flag.Parse()
|
||||||
|
config, err := parseAddOnConfig(*configFile)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Invalid config: %v", err)
|
||||||
|
}
|
||||||
|
if config.DebugMode {
|
||||||
|
gin.SetMode(gin.DebugMode)
|
||||||
|
log.SetLevel(log.DebugLevel)
|
||||||
|
} else {
|
||||||
|
gin.SetMode(gin.ReleaseMode)
|
||||||
|
}
|
||||||
|
|
||||||
|
options, err := toServerOptions(config)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("Invalid config: %v", err)
|
||||||
|
}
|
||||||
|
server := NewServer(options)
|
||||||
|
if err := server.Serve(); err != nil {
|
||||||
|
log.Fatalf("Error while serving: %v", err)
|
||||||
|
}
|
||||||
|
log.Info("Server terminated.")
|
||||||
|
}
|
||||||
39
ldap-auth-server/translations/en.yaml
Normal file
39
ldap-auth-server/translations/en.yaml
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
configuration:
|
||||||
|
ldap_server_url:
|
||||||
|
name: LDAP Server URL
|
||||||
|
description: |
|
||||||
|
The URL of the server to connect to. Prefix with ldap:// or ldaps://.
|
||||||
|
|
||||||
|
Example: ldaps://ldap.example.com:636
|
||||||
|
bind_dn_template:
|
||||||
|
name: Bind DN Template
|
||||||
|
description: |
|
||||||
|
The template for the DN of the user. The first instance of `%s` will be replaced
|
||||||
|
with the username.
|
||||||
|
|
||||||
|
Example: cn=%s,ou=people,dc=example,dc=com
|
||||||
|
bind_dn_password:
|
||||||
|
name: Bind DN Password
|
||||||
|
description: |
|
||||||
|
Password to use for Bind DN
|
||||||
|
search_base_dn:
|
||||||
|
name: Search Base DN
|
||||||
|
description: |
|
||||||
|
The base DN for user searches. Only necessary when using a search filter.
|
||||||
|
|
||||||
|
Example: ou=people,dc=example,dc=com
|
||||||
|
search_filter_template:
|
||||||
|
name: Search Filter Template
|
||||||
|
description: |
|
||||||
|
The template for the search filter to apply when searching for users. The first
|
||||||
|
`%s` will be replaced with the username. This option can be used to only allow
|
||||||
|
members of specific groups.
|
||||||
|
|
||||||
|
Example: (&(uid=%s)(memberof=cn=home_assistant,ou=groups,dc=example,dc=com))
|
||||||
|
debug_mode:
|
||||||
|
name: Debug Mode
|
||||||
|
description: |
|
||||||
|
Run the server in debug mode.
|
||||||
|
|
||||||
|
network:
|
||||||
|
80/tcp: "The server's port. Generally not necessary, but it can be mapped for debugging."
|
||||||
Loading…
Reference in a new issue