sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

split LDAP filters (#399)

Browse Source 
* split LDAP filters

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* use uid attribute for testing

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This commit is contained in:
Jörn Friedrich Dreyer
2020-07-27 13:47:39 +02:00
committed by GitHub
parent ef92a0b3ff
commit 5e5ae356df
10 changed files with 66 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/command/authbasic.go
+1 -2
View File
@@ -97,8 +97,7 @@ func AuthBasic(cfg *config.Config) *cli.Command {
"hostname": cfg.Reva.LDAP.Hostname,
"port": cfg.Reva.LDAP.Port,
"base_dn": cfg.Reva.LDAP.BaseDN,
"userfilter": cfg.Reva.LDAP.UserFilter,
"groupfilter": cfg.Reva.LDAP.GroupFilter,
"loginfilter": cfg.Reva.LDAP.LoginFilter,
"bind_username": cfg.Reva.LDAP.BindDN,
"bind_password": cfg.Reva.LDAP.BindPassword,
"idp": cfg.Reva.LDAP.IDP,
pkg/command/users.go
+1
View File
@@ -97,6 +97,7 @@ func Users(cfg *config.Config) *cli.Command {
"port": cfg.Reva.LDAP.Port,
"base_dn": cfg.Reva.LDAP.BaseDN,
"userfilter": cfg.Reva.LDAP.UserFilter,
"findfilter": cfg.Reva.LDAP.FindFilter,
"groupfilter": cfg.Reva.LDAP.GroupFilter,
"bind_username": cfg.Reva.LDAP.BindDN,
"bind_password": cfg.Reva.LDAP.BindPassword,
pkg/config/config.go
+2
View File
@@ -206,7 +206,9 @@ type LDAP struct {
Hostname string
Port int
BaseDN string
LoginFilter string
UserFilter string
FindFilter string
GroupFilter string
BindDN string
BindPassword string
pkg/flagset/authbasic.go
+7 -14
View File
@@ -123,18 +123,11 @@ func AuthBasicWithConfig(cfg *config.Config) []cli.Flag {
Destination: &cfg.Reva.LDAP.BaseDN,
},
&cli.StringFlag{
Name: "ldap-userfilter",
Value: "(&(objectclass=posixAccount)(cn=%s))",
Usage: "LDAP userfilter",
EnvVars: []string{"REVA_LDAP_USERFILTER"},
Destination: &cfg.Reva.LDAP.UserFilter,
},
&cli.StringFlag{
Name: "ldap-groupfilter",
Value: "(&(objectclass=posixGroup)(cn=%s))",
Usage: "LDAP groupfilter",
EnvVars: []string{"REVA_LDAP_GROUPFILTER"},
Destination: &cfg.Reva.LDAP.GroupFilter,
Name: "ldap-loginfilter",
Value: "(&(objectclass=posixAccount)(|(cn={{login}})(mail={{login}})))",
Usage: "LDAP login filter",
EnvVars: []string{"REVA_LDAP_LOGINFILTER"},
Destination: &cfg.Reva.LDAP.LoginFilter,
},
&cli.StringFlag{
Name: "ldap-bind-dn",
@@ -160,7 +153,7 @@ func AuthBasicWithConfig(cfg *config.Config) []cli.Flag {
// ldap dn is always the dn
&cli.StringFlag{
Name: "ldap-schema-uid",
Value: "uid",
Value: "ownclouduuid",
Usage: "LDAP schema uid",
EnvVars: []string{"REVA_LDAP_SCHEMA_UID"},
Destination: &cfg.Reva.LDAP.Schema.UID,
@@ -174,7 +167,7 @@ func AuthBasicWithConfig(cfg *config.Config) []cli.Flag {
},
&cli.StringFlag{
Name: "ldap-schema-displayName",
Value: "sn",
Value: "displayname",
Usage: "LDAP schema displayName",
EnvVars: []string{"REVA_LDAP_SCHEMA_DISPLAYNAME"},
Destination: &cfg.Reva.LDAP.Schema.DisplayName,
pkg/flagset/users.go
+16 -7
View File
@@ -107,15 +107,24 @@ func UsersWithConfig(cfg *config.Config) []cli.Flag {
},
&cli.StringFlag{
Name: "ldap-userfilter",
Value: "(&(objectclass=posixAccount)(cn=%s*))",
Usage: "LDAP userfilter",
Value: "(&(objectclass=posixAccount)(|(ownclouduuid={{.OpaqueId}})(cn={{.OpaqueId}})))",
Usage: "LDAP filter used when getting a user. The CS3 userid properties {{.OpaqueId}} and {{.Idp}} are available.",
EnvVars: []string{"REVA_LDAP_USERFILTER"},
Destination: &cfg.Reva.LDAP.UserFilter,
},
&cli.StringFlag{
Name: "ldap-groupfilter",
Value: "(&(objectclass=posixGroup)(cn=%s*))",
Usage: "LDAP groupfilter",
Name: "ldap-findfilter",
Value: "(&(objectclass=posixAccount)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))",
Usage: "LDAP filter used when searching for recipients. {{query}} will be replaced with the search query",
EnvVars: []string{"REVA_LDAP_FINDFILTER"},
Destination: &cfg.Reva.LDAP.FindFilter,
},
&cli.StringFlag{
Name: "ldap-groupfilter",
// FIXME the reva implementation needs to use the memberof overlay to get the cn when it only has the uuid,
// because the ldap schema either uses the dn or the member(of) attributes to establish membership
Value: "(&(objectclass=posixGroup)(ownclouduuid={{.OpaqueId}}*))", // This filter will never work
Usage: "LDAP filter used when getting the groups of a user. The CS3 userid properties {{.OpaqueId}} and {{.Idp}} are available.",
EnvVars: []string{"REVA_LDAP_GROUPFILTER"},
Destination: &cfg.Reva.LDAP.GroupFilter,
},
@@ -143,7 +152,7 @@ func UsersWithConfig(cfg *config.Config) []cli.Flag {
// ldap dn is always the dn
&cli.StringFlag{
Name: "ldap-schema-uid",
Value: "uid",
Value: "ownclouduuid",
Usage: "LDAP schema uid",
EnvVars: []string{"REVA_LDAP_SCHEMA_UID"},
Destination: &cfg.Reva.LDAP.Schema.UID,
@@ -157,7 +166,7 @@ func UsersWithConfig(cfg *config.Config) []cli.Flag {
},
&cli.StringFlag{
Name: "ldap-schema-displayName",
Value: "sn",
Value: "displayname",
Usage: "LDAP schema displayName",
EnvVars: []string{"REVA_LDAP_SCHEMA_DISPLAYNAME"},
Destination: &cfg.Reva.LDAP.Schema.DisplayName,