feat(ldap): add option to load ldap from file

Signed-off-by: Laurentiu Niculae <[email protected]>
project-zot · Nov 13, 2023 · 361c06a · 361c06a
1 parent 8609900
commit 361c06a
Show file tree

Hide file tree

Showing 10 changed files with 669 additions and 42 deletions.
diff --git a/examples/config-ldap-credentials.json b/examples/config-ldap-credentials.json
@@ -0,0 +1,4 @@
+{
+    "bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
+    "bindPassword":"ldap-searcher-password"
+}
diff --git a/examples/config-ldap.json b/examples/config-ldap.json
@@ -13,14 +13,13 @@
       },
       "auth": {
         "ldap": {
+          "credentialsFile": "examples/config-ldap-credentials.json",
           "address": "ldap.example.org",
           "port": 389,
           "startTLS": false,
           "baseDN":"ou=Users,dc=example,dc=org",
           "userAttribute": "uid",
           "userGroupAttribute": "memberOf",
-          "bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
-          "bindPassword":"ldap-searcher-password",
           "skipVerify": true,
           "subtreeSearch": true
         },

diff --git a/pkg/api/authn.go b/pkg/api/authn.go
@@ -266,9 +266,9 @@ func (amw *AuthnMiddleware) tryAuthnHandlers(ctlr *Controller) mux.MiddlewareFun
 			UseSSL:             !ldapConfig.Insecure,
 			SkipTLS:            !ldapConfig.StartTLS,
 			Base:               ldapConfig.BaseDN,
-			BindDN:             ldapConfig.BindDN,
+			BindDN:             ldapConfig.BindDN(),
+			BindPassword:       ldapConfig.BindPassword(),
 			UserGroupAttribute: ldapConfig.UserGroupAttribute, // from config
-			BindPassword:       ldapConfig.BindPassword,
 			UserFilter:         fmt.Sprintf("(%s=%%s)", ldapConfig.UserAttribute),
 			InsecureSkipVerify: ldapConfig.SkipVerify,
 			ServerName:         ldapConfig.Address,

diff --git a/pkg/api/config/config.go b/pkg/api/config/config.go
@@ -121,21 +121,47 @@ type SchedulerConfig struct {
 	NumWorkers int
 }
 
+type LDAPCredentials struct {
+	BindDN       string
+	BindPassword string
+}
+
 type LDAPConfig struct {
+	CredentialsFile    string
 	Port               int
 	Insecure           bool
 	StartTLS           bool // if !Insecure, then StartTLS or LDAPs
 	SkipVerify         bool
 	SubtreeSearch      bool
 	Address            string
-	BindDN             string
+	bindDN             string `json:"-"`
+	bindPassword       string `json:"-"`
 	UserGroupAttribute string
-	BindPassword       string
 	BaseDN             string
 	UserAttribute      string
 	CACert             string
 }
 
+func (ldapConf *LDAPConfig) BindDN() string {
+	return ldapConf.bindDN
+}
+
+func (ldapConf *LDAPConfig) SetBindDN(bindDN string) *LDAPConfig {
+	ldapConf.bindDN = bindDN
+
+	return ldapConf
+}
+
+func (ldapConf *LDAPConfig) BindPassword() string {
+	return ldapConf.bindPassword
+}
+
+func (ldapConf *LDAPConfig) SetBindPassword(bindPassword string) *LDAPConfig {
+	ldapConf.bindPassword = bindPassword
+
+	return ldapConf
+}
+
 type LogConfig struct {
 	Level  string
 	Output string
@@ -266,14 +292,14 @@ func (c *Config) Sanitize() *Config {
 		panic(err)
 	}
 
-	if c.HTTP.Auth != nil && c.HTTP.Auth.LDAP != nil && c.HTTP.Auth.LDAP.BindPassword != "" {
+	if c.HTTP.Auth != nil && c.HTTP.Auth.LDAP != nil && c.HTTP.Auth.LDAP.bindPassword != "" {
 		sanitizedConfig.HTTP.Auth.LDAP = &LDAPConfig{}
 
 		if err := DeepCopy(c.HTTP.Auth.LDAP, sanitizedConfig.HTTP.Auth.LDAP); err != nil {
 			panic(err)
 		}
 
-		sanitizedConfig.HTTP.Auth.LDAP.BindPassword = "******"
+		sanitizedConfig.HTTP.Auth.LDAP.bindPassword = "******"
 	}
 
 	return sanitizedConfig

diff --git a/pkg/api/config/config_test.go b/pkg/api/config/config_test.go
@@ -69,11 +69,11 @@ func TestConfig(t *testing.T) {
 	Convey("Test DeepCopy() & Sanitize()", t, func() {
 		conf := config.New()
 		So(conf, ShouldNotBeNil)
-		authConfig := &config.AuthConfig{LDAP: &config.LDAPConfig{BindPassword: "oina"}}
+		authConfig := &config.AuthConfig{LDAP: (&config.LDAPConfig{}).SetBindPassword("oina")}
 		conf.HTTP.Auth = authConfig
 		So(func() { conf.Sanitize() }, ShouldNotPanic)
 		conf = conf.Sanitize()
-		So(conf.HTTP.Auth.LDAP.BindPassword, ShouldEqual, "******")
+		So(conf.HTTP.Auth.LDAP.BindPassword(), ShouldEqual, "******")
 
 		// negative
 		obj := make(chan int)