1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
package main
import (
"errors"
"fmt"
"github.com/msteinert/pam"
"github.com/nmcclain/ldap"
"log"
"net"
"os"
"os/user"
"strings"
)
type Backend struct {
ldap.Binder
ldap.Searcher
ldap.Closer
logger *log.Logger
BaseDN string
PAMServiceName string
}
var logger = log.New(os.Stdout, "", log.LstdFlags)
func main() {
logger.Println("start")
l := ldap.NewServer()
l.EnforceLDAP = true
var handler = Backend{
PAMServiceName: "password-auth",
logger: logger,
BaseDN: "dc=example,dc=com",
}
l.BindFunc("", handler)
l.SearchFunc("", handler)
l.CloseFunc("", handler)
if err := l.ListenAndServe("0.0.0.0:10893"); err != nil {
logger.Fatalf("LDAP serve failed: %s", err.Error())
}
}
func (b Backend) Bind(bindDN, bindSimplePw string, conn net.Conn) (resultCode ldap.LDAPResultCode, err error) {
b.logger.Printf("Bind attempt addr=%s bindDN=%s", conn.RemoteAddr().String(), bindDN)
var username string
if username, err = b.getUserNameFromBindDN(bindDN); err != nil {
return ldap.LDAPResultInvalidCredentials, err
}
if err := PAMAuth(b.PAMServiceName, username, bindSimplePw); err != nil {
return ldap.LDAPResultInvalidCredentials, err
}
return ldap.LDAPResultSuccess, nil
}
func (b Backend) Search(bindDN string, req ldap.SearchRequest, conn net.Conn) (result ldap.ServerSearchResult, err error) {
b.logger.Printf("Search bindDN=%s baseDN=%s filter=%s addr=%s", bindDN, req.BaseDN, req.Filter, conn.RemoteAddr().String())
var username string
if username, err = b.getUserNameFromBindDN(bindDN); err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, err
}
filterEntity, err := ldap.GetFilterObjectClass(req.Filter)
if err != nil {
b.logger.Printf("Search Error: error parsing filter: %s", req.Filter)
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: error parsing filter: %s", req.Filter)
}
if filterEntity == "posixaccount" || filterEntity == "" {
var entry *ldap.Entry
if entry, err = b.makeSearchEntry(bindDN, username); err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, err
}
return ldap.ServerSearchResult{[]*ldap.Entry{entry}, []string{}, []ldap.Control{}, ldap.LDAPResultSuccess}, nil
} else {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("filter entity could be: posixaccount")
}
return ldap.ServerSearchResult{make([]*ldap.Entry, 0), []string{}, []ldap.Control{}, ldap.LDAPResultSuccess}, nil
}
func (b Backend) Close(bindDN string, conn net.Conn) (err error) {
b.logger.Printf("Close addr=%s bindDN=%s", conn.RemoteAddr().String(), bindDN)
return nil
}
func PAMAuth(serviceName, userName, passwd string) error {
t, err := pam.StartFunc(serviceName, userName, func(s pam.Style, msg string) (string, error) {
switch s {
case pam.PromptEchoOff:
return passwd, nil
case pam.PromptEchoOn, pam.ErrorMsg, pam.TextInfo:
return "", nil
}
return "", errors.New("Unrecognized PAM message style")
})
if err != nil {
return err
}
if err = t.Authenticate(0); err != nil {
return err
}
return nil
}
func (b Backend) getUserNameFromBindDN(bindDN string) (username string, err error) {
if bindDN == "" {
return "", errors.New("bindDN not specified")
}
if !strings.HasSuffix(bindDN, ","+b.BaseDN) {
return "", errors.New("bindDN not matched")
}
rest := strings.TrimSuffix(bindDN, ","+b.BaseDN)
if rest == "" {
return "", errors.New("bindDN format error")
}
if strings.Contains(rest, ",") {
return "", errors.New("bindDN has too much entities")
}
if !strings.HasPrefix(rest, "uid=") {
return "", errors.New("bindDN contains no uid entry")
}
username = strings.TrimPrefix(rest, "uid=")
return username, nil
}
func (b Backend) makeSearchEntry(dn string, username string) (entry *ldap.Entry, err error) {
attrs := []*ldap.EntryAttribute{}
var u *user.User
if u, err = user.Lookup(username); err != nil {
return entry, err
}
attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}})
attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{username}})
attrs = append(attrs, &ldap.EntryAttribute{"uid", []string{username}})
attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{u.Uid}})
attrs = append(attrs, &ldap.EntryAttribute{"givenName", []string{u.Name}})
attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{u.Gid}})
attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{u.HomeDir}})
entry = &ldap.Entry{dn, attrs}
return entry, nil
}
|
