summaryrefslogtreecommitdiff
path: root/internal/authentication/ldap_user_provider_test.go
AgeCommit message (Collapse)Author
2025-03-08refactor(handlers): add more detailed errors for password-change failures ↵Brynn Crowley
(#8899) Adds some more helpful log information to the change password feature. Signed-off-by: Brynn Crowley <littlehill723@gmail.com> Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com> Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-03-09feat(embed): make authelia embedable (#8841)James Elliott
This adds a highly experimental option for developers looking to embed Authelia within another go binary. Closes #5803 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-02-23feat(authentication): ldap connection pooling (#7217)James Elliott
This implements optional LDAP connection pooling to optimize the speed of LDAP transactions. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2025-02-22feat(authentication): additional and custom attributes (#8078)James Elliott
This facilitates adding additional attributes to the Authelia authentication backends as well as custom attributes based on the Common Expression Language. This will be utilized in the future to facilitate additional features. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2024-03-04build(deps): use go.uber.org/mockJames Elliott
Use the new go.uber.org/mock which is currently maintained. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-10-08refactor: clock newups (#6101)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-10-08refactor: clock package (#6100)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-09-17test: misc lint updates (#6004)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-09-03docs: jsonschema (#5493)James Elliott
Adds a JSON Schema for the configuration, user database, and most exports. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-06-18feat(authentication): ldap memberof group search (#5418)James Elliott
Introduces the concept of group search mode into the LDAP configuration. This also adds the filter and memberof search modes. The full description of these is included in the docs but the filter mode is the same mode as previous which is also the default and recommended value. The memberof mode should only be used by users who are aware of how the concept works as per the docs. Closes #2161 Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-25test(authentication): add missing type tests (#5483)James Elliott
Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2023-05-07feat(authentication): suport ldap over unix socket (#5397)James Elliott
This adds support for LDAP unix sockets using the ldapi scheme. In addition it improves all of the address related parsing significantly deprecating old options. Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>
2022-12-22docs: fix misc mistakes and adjust placeholders (#4614)James Elliott
2022-12-21feat(authentication): ldap time replacements (#4483)James Elliott
This adds and utilizes several time replacements for both specialized LDAP implementations. Closes #1964, Closes #1284
2022-10-28fix(authentication): erroneously escaped group base dn (#4288)James Elliott
The BaseDN for groups was escaped improperly and failed on any BaseDN with special characters. This fixes the issue.
2022-10-17feat(authentication): file password algorithms (#3848)James Elliott
This adds significant enhancements to the file auth provider including multiple additional algorithms.
2022-10-05refactor: any (#4133)James Elliott
* refactor: any * refactor: fix test
2022-10-02feat(authentication): permit feature detection failures (#4061)James Elliott
This adds a configuration option which permits the failure of feature detection (control type OIDs and extension OIDs).
2022-05-15fix(authentication): err when user/display name same ldap attribute (#3364)James Elliott
This fixes an issue when both the username and display name attributes are the same. If the username attribute is the same as the display name attribute previously we only set the display name profile value which is incorrect. We should set the username profile value instead and allow the display name to be blank.
2022-05-10fix(authentication): utilize msad password history control (#3256)James Elliott
This fixes an issue where the Microsoft Active Directory Server Policy Hints control was not being used to prevent avoidance of the PSO / FGPP applicable to the user.
2022-05-02fix(authentication): follow ldap referrals (#3251)James Elliott
This ensures we are able to follow referrals for LDAP password modify operations when permit_referrals is true. Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2022-03-17refactor(authentication): simplify ldap connection interface (#3026)James Elliott
This simplifies the interface to just expose the methods from the underlying connection that we need. The addition of gen.go makes creating the generated mocks easy go generate.
2022-01-31refactor: apply godot recommendations (#2839)James Elliott
2021-12-02refactor(web): only fetch totp conf if required (#2663)James Elliott
Prevents the TOTP user config from being requested when the user has not registered or is already authenticated 2FA.
2021-11-23feat(storage): primary key for all tables and general qol refactoring (#2431)James Elliott
This is a massive overhaul to the SQL Storage for Authelia. It facilitates a whole heap of utility commands to help manage the database, primary keys, ensures all database requests use a context for cancellations, and paves the way for a few other PR's which improve the database. Fixes #1337
2021-09-17refactor: factorize startup checks (#2386)James Elliott
* refactor: factorize startup checks * refactor: address linting issues
2021-08-11fix: include major in go.mod module directive (#2278)James Elliott
* build: include major in go.mod module directive * fix: xflags * revert: cobra changes * fix: mock doc
2021-08-05perf(authentication): improve ldap dynamic replacement performance (#2239)James Elliott
This change means we only check the filters for the existence of placeholders that cannot be replaced at startup. We then utilized cached results of that lookup for subsequent replacements.
2021-07-13fix(authentication): ldap connection left open (#2179)James Elliott
The recent ldap changes in cb71df5 left a connection to the LDAP server open at startup. This resolves this which prevents an ugly log message and unnecessary open sockets.
2021-07-06feat(authentication): use the passwordmodify exop for pwd resets with ldap ↵Arsenović Arsen
(#2124) Implement the LDAP password modify extended operation for LDAP providers that advertise they support it.
2021-07-02feat(authentiation): check ldap support for extended operations on startup ↵James Elliott
(#2133) * feat(authentiation): check ldap server on startup This PR adds a startup check to the LDAP authentication backend. It additionally adds support for checking supportedExtension OIDs, currently only checking passwdModifyOID (1.3.6.1.4.1.4203.1.11.3). This can relatively easily be enhanced to add detection for other rootDSE capabilities like supportedControl and supportedCapabilities as necessary. * test(authentication): add unit tests for new feature * refactor(authentication): factorize ldap user provider newup * refactor: minor adjustments
2021-04-16fix: removed deprecated smtp/ldap options (#1912)James Elliott
This removes the deprecated options from 4.25. This includes the LDAP filters which allow {0} or {1} placeholders. The new aliases are documented. Additionally it refactors the keys validator to use uniform messages for most replaced keys.
2021-04-12refactor(authentication): add trace logs for the user/group baseDN (#1904)James Elliott
This logs the baseDN for user and group searching on startup as well as the users filter (with just input remaining). Additionally refactors the location of a few log messages, and exposes the logger to the provider to reduce calls to logging.Logger().
2021-01-04[FEATURE] Enhance LDAP/SMTP TLS Configuration and Unify Them (#1557)James Elliott
* add new directive in the global scope `certificates_directory` which is used to bulk load certs and trust them in Authelia * this is in ADDITION to system certs and are trusted by both LDAP and SMTP * added a shared TLSConfig struct to be used by both SMTP and LDAP, and anything else in the future that requires tuning the TLS * remove usage of deprecated LDAP funcs Dial and DialTLS in favor of DialURL which is also easier to use * use the server name from LDAP URL or SMTP host when validating the certificate unless otherwise defined in the TLS section * added temporary translations from the old names to the new ones for all deprecated options * added docs * updated example configuration * final deprecations to be done in 4.28.0 * doc updates * fix misc linting issues * uniform deprecation notices for ease of final removal * added additional tests covering previously uncovered areas and the new configuration options * add non-fatal to certificate loading when system certs could not be loaded * adjust timeout of Suite ShortTimeouts * add warnings pusher for the StructValidator * make the schema suites uninform * utilize the warnings in the StructValidator * fix test suite usage for skip_verify * extract LDAP filter parsing into it's own function to make it possible to test * test LDAP filter parsing * update ErrorContainer interface * add tests to the StructValidator * add NewTLSConfig test * move baseDN for users/groups into parsed values * add tests to cover many of the outstanding areas in LDAP * add explicit deferred LDAP conn close to UpdatePassword * add some basic testing to SMTP notifier * suggestions from code review
2020-12-03[FEATURE] LDAP StartTLS (#1500)James Elliott
* add start_tls config option * add StartTLS method to the LDAP conn factory and the mock * implemented use of the StartTLS method when the config is set to true * add mock unit tests * add docs * add TLS min version support * add tests to tls version method * fix lint issues * minor adjustments * remove SSL3.0 * add tls consts * deprecate old filter placeholders * remove redundant fake hashing in file auth provider (to delay username enumeration, was replaced by #993 * make suite ActiveDirectory use StartTLS * misc adjustments to docs * suggested changes from code review * deprecation notice conformity * add mock test for LDAPS plus StartTLS
2020-06-19[FEATURE] Add configurable display name to frontend (#1124)Amir Zarrinkafsh
* [FEATURE] Add configurable display name to frontend This feature allows users with a LDAP backend to specify an attribute (default is "displayname") to retrieve a users name for the portal greeting. Similarly for the file based backend a new required key "name" has been introduced. This can also be used down the line with OIDC as a separate scope. * Update references from Name to DisplayName * Update compose bundles to include displayname refs * Update LDAP automatic profile refresh * Ensure display name is updated * Fix bug which prevented trace logging for profile refresh to not trigger
2020-05-04[FEATURE] Automatic Profile Refresh - LDAP (#912)James Elliott
* [FIX] LDAP Not Checking for Updated Groups * refactor handlers verifyFromSessionCookie * refactor authorizer selectMatchingObjectRules * refactor authorizer isDomainMatching * add authorizer URLHasGroupSubjects method * add user provider ProviderType method * update tests * check for new LDAP groups and update session when: * user provider type is LDAP * authorization is forbidden * URL has rule with group subjects * Implement Refresh Interval * add default values for LDAP user provider * add default for refresh interval * add schema validator for refresh interval * add various tests * rename hasUserBeenInactiveLongEnough to hasUserBeenInactiveTooLong * use Authelia ctx clock * add check to determine if user is deleted, if so destroy the * make ldap user not found error a const * implement GetRefreshSettings in mock * Use user not found const with FileProvider * comment exports * use ctx.Clock instead of time pkg * add debug logging * use ptr to reference userSession so we don't have to retrieve it again * add documenation * add check for 0 refresh interval to reduce CPU cost * remove badly copied debug msg * add group change delta message * add SliceStringDelta * refactor ldap refresh to use the new func * improve delta add/remove log message * fix incorrect logic in SliceStringDelta * add tests to SliceStringDelta * add always config option * add tests for always config option * update docs * apply suggestions from code review Co-Authored-By: Amir Zarrinkafsh <nightah@me.com> * complete mocks and fix an old one * show warning when LDAP details failed to update for an unknown reason * golint fix * actually fix existing mocks * use mocks for LDAP refresh testing * use mocks for LDAP refresh testing for both added and removed groups * use test mock to verify disabled refresh behaviour * add information to threat model * add time const for default Unix() value * misc adjustments to mocks * Suggestions from code review * requested changes * update emails * docs updates * test updates * misc * golint fix * set debug for dev testing * misc docs and logging updates * misc grammar/spelling * use built function for VerifyGet * fix reviewdog suggestions * requested changes * Apply suggestions from code review Co-authored-by: Amir Zarrinkafsh <nightah@me.com> Co-authored-by: Clément Michaud <clement.michaud34@gmail.com>
2020-04-22[MISC] Ignore errcheck recommendations for legacy code (#893)Amir Zarrinkafsh
* [MISC] Ignore errcheck recommendations for legacy code Some of this is likely intended to stay how it is, some could use refactoring, for now we will mark is and ignore it from the linter to be potentially addressed in the future. * [MISC] Ensure files are gofmt-ed
2020-04-09[Buildkite] Introduce CI linting with golangci-lint and reviewdog (#832)Amir Zarrinkafsh
* [Buildkite] Introduce CI linting with golangci-lint and reviewdog * Initial pass of golangci-lint * Add gosimple (megacheck) recommendations * Add golint recommendations * [BUGFIX] Migrate authentication traces from v3 mongodb * Add deadcode recommendations * [BUGFIX] Fix ShortTimeouts suite when run in dev workflow * Add unused recommendations * Add unparam recommendations * Disable linting on unfixable errors instead of skipping files * Adjust nolint notation for unparam * Fix ineffectual assignment to err raised by linter. * Export environment variable in agent hook * Add ineffassign recommendations * Add staticcheck recommendations * Add gocyclo recommendations * Adjust ineffassign recommendations Co-authored-by: Clement Michaud <clement.michaud34@gmail.com>
2020-04-05[MISC] Update durations to notation format and housekeeping (#824)James Elliott
* added regulation validator * made regulations find_time and ban_time values duration notation strings * added DefaultRegulationConfiguration for the validator * made session expiration and inactivity values duration notation strings * TOTP period does not need to be converted because adjustment should be discouraged * moved TOTP defaults to DefaultTOTPConfiguration and removed the consts * arranged the root config validator in configuration file order * adjusted tests for the changes * moved duration notation docs to root of configuration * added references to duration notation where applicable * project wide gofmt and goimports: * run gofmt * run goimports -local github.com/authelia/authelia -w on all files * Make jwt_secret error uniform and add tests * now at 100% coverage for internal/configuration/validator/configuration.go
2020-03-31 [FEATURE][BREAKING] Allow users to sign in with email. (#792)Clément Michaud
* [FEATURE][BREAKING] Allow users to sign in with email. The users_filter purpose evolved with the introduction of username_attribute but is reverted here to allow the most flexibility. users_filter is now the actual filter used for searching the user and not a sub-filter based on the username_attribute anymore. * {input} placeholder has been introduced to later deprecate {0} which has been kept for backward compatibility. * {username_attribute} and {mail_attribute} are new placeholders used to back reference other configuration options. Fix #735 * [MISC] Introduce new placeholders for groups_filter too. * [MISC] Update BREAKING.md to mention the change regarding users_filter. * [MISC] Fix unit and integration tests. * Log an error message in console when U2F is not supported. * Apply suggestions from code review * Update BREAKING.md Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com> Co-authored-by: Amir Zarrinkafsh <nightah@me.com>
2020-03-19[DEPS] Fix gopkg.in/ldap.v3 import for dependabot (#726)Amir Zarrinkafsh
2020-03-15[BUGFIX] [BREAKING] Set username retrieved from authentication backend in ↵Clément Michaud
session. (#687) * [BUGFIX] Set username retrieved from authentication backend in session. In some setups, binding is case insensitive but Authelia is case sensitive and therefore need the actual username as stored in the authentication backend in order for Authelia to work correctly. Fixes #561. * Use uid attribute as unique user identifier in suites. * Fix the integration tests. * Update config.template.yml * Compute user filter based on username attribute and users_filter. The filter provided in users_filter is now combined with a filter based on the username attribute to perform the LDAP search query finding a user object from the username. * Fix LDAP based integration tests. * Update `users_filter` reference examples
2020-02-27[BUGFIX] Fix crash when no emails or groups are retrieved from LDAP. (#651)Clément Michaud
* [BUGFIX] Fix crash when no emails or groups are retrieved from LDAP. If group or email attribute configured by user in configuration is not found in user object the list of attributes in LDAP search result is empty. This change introduces a check before accessing the first element of the list which previously led to out of bound access. Fixes #647. * [MISC] Change log level of LDAP connection creation to trace.
2020-01-21Escape special LDAP characters as suggested by OWASP.Clement Michaud
https://owasp.org/www-project-cheat-sheets/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
2019-12-24Rename org from clems4ever to autheliaAmir Zarrinkafsh
Also fix references from config.yml to configuration.yml
2019-12-06Add support for LDAP over TLS.Clement Michaud