From 3c2c7f325b9741cf168029b12287703400e87269 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Fri, 6 Jan 2023 00:03:37 +0100 Subject: [PATCH] keep original admin group behaviour --- README.md | 118 +++++++++++++++---------------- internal/ldap/ldap.go | 3 + internal/server/configuration.go | 2 +- 3 files changed, 63 insertions(+), 60 deletions(-) diff --git a/README.md b/README.md index d9e140b..01b3fc3 100644 --- a/README.md +++ b/README.md @@ -131,65 +131,65 @@ For example: `CONFIG_FILE=/home/test/config.yml ./wg-portal-amd64`. ### Configuration Options The following configuration options are available: -| environment | yaml | yaml_parent | default_value | description | -|----------------------------|-------------------------|-------------|-----------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| -| LISTENING_ADDRESS | listeningAddress | core | :8123 | The address on which the web server is listening. Optional IP address and port, e.g.: 127.0.0.1:8080. | -| EXTERNAL_URL | externalUrl | core | http://localhost:8123 | The external URL where the web server is reachable. This link is used in emails that are created by the WireGuard Portal. | -| WEBSITE_TITLE | title | core | WireGuard VPN | The website title. | -| COMPANY_NAME | company | core | WireGuard Portal | The company name (for branding). | -| MAIL_FROM | mailFrom | core | WireGuard VPN | The email address from which emails are sent. | -| LOGO_URL | logoUrl | core | /img/header-logo.png | The logo displayed in the page's header. | -| ADMIN_USER | adminUser | core | admin@wgportal.local | The administrator user. Must be a valid email address. | -| ADMIN_PASS | adminPass | core | wgportal | The administrator password. If unchanged, a random password will be set on first startup. | -| EDITABLE_KEYS | editableKeys | core | true | Allow to edit key-pairs in the UI. | -| CREATE_DEFAULT_PEER | createDefaultPeer | core | false | If an LDAP user logs in for the first time, a new WireGuard peer will be created on the WG_DEFAULT_DEVICE if this option is enabled. | -| SELF_PROVISIONING | selfProvisioning | core | false | Allow registered users to automatically create peers via the RESTful API. | -| WG_EXPORTER_FRIENDLY_NAMES | wgExporterFriendlyNames | core | false | Enable integration with [prometheus_wireguard_exporter friendly name](https://github.com/MindFlavor/prometheus_wireguard_exporter#friendly-tags). | -| LDAP_ENABLED | ldapEnabled | core | false | Enable or disable the LDAP backend. | -| SESSION_SECRET | sessionSecret | core | secret | Use a custom secret to encrypt session data. | -| BACKGROUND_TASK_INTERVAL | backgroundTaskInterval | core | 900 | The interval (in seconds) for the background tasks (like peer expiry check). | -| EXPIRY_REENABLE | expiryReEnable | core | false | Reactivate expired peers if the expiration date is in the future. | -| DATABASE_TYPE | typ | database | sqlite | Either mysql or sqlite. | -| DATABASE_HOST | host | database | | The mysql server address. | -| DATABASE_PORT | port | database | | The mysql server port. | -| DATABASE_NAME | database | database | data/wg_portal.db | For sqlite database: the database file-path, otherwise the database name. | -| DATABASE_USERNAME | user | database | | The mysql user. | -| DATABASE_PASSWORD | password | database | | The mysql password. | -| EMAIL_HOST | host | email | 127.0.0.1 | The email server address. | -| EMAIL_PORT | port | email | 25 | The email server port. | -| EMAIL_TLS | tls | email | false | Use STARTTLS. DEPRECATED: use EMAIL_ENCRYPTION instead. | -| EMAIL_ENCRYPTION | encryption | email | none | Either none, tls or starttls. | -| EMAIL_CERT_VALIDATION | certcheck | email | false | Validate the email server certificate. | -| EMAIL_USERNAME | user | email | | An optional username for SMTP authentication. | -| EMAIL_PASSWORD | pass | email | | An optional password for SMTP authentication. | -| EMAIL_AUTHTYPE | auth | email | plain | Either plain, login or crammd5. If username and password are empty, this value is ignored. | -| WG_DEVICES | devices | wg | wg0 | A comma separated list of WireGuard devices. | -| WG_DEFAULT_DEVICE | defaultDevice | wg | wg0 | This device is used for auto-created peers (if CREATE_DEFAULT_PEER is enabled). | -| WG_CONFIG_PATH | configDirectory | wg | /etc/wireguard | If set, interface configuration updates will be written to this path, filename: .conf. | -| MANAGE_IPS | manageIPAddresses | wg | true | Handle IP address setup of interface, only available on linux. | -| USER_MANAGE_PEERS | userManagePeers | wg | false | Logged in user can create or update peers (partially). | -| LDAP_URL | url | ldap | ldap://srv-ad01.company.local:389 | The LDAP server url. | -| LDAP_STARTTLS | startTLS | ldap | true | Use STARTTLS. | -| LDAP_CERT_VALIDATION | certcheck | ldap | false | Validate the LDAP server certificate. | -| LDAP_BASEDN | dn | ldap | DC=COMPANY,DC=LOCAL | The base DN for searching users. | -| LDAP_USER | user | ldap | company\\\\ldap_wireguard | The bind user. | -| LDAP_PASSWORD | pass | ldap | SuperSecret | The bind password. | -| LDAP_LOGIN_FILTER | loginFilter | ldap | (&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2)) | {{login_identifier}} will be replaced with the login email address. | -| LDAP_SYNC_FILTER | syncFilter | ldap | (&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*)) | The filter string for the LDAP synchronization service. Users matching this filter will be synchronized with the WireGuard Portal database. | -| LDAP_SYNC_GROUP_FILTER | syncGroupFilter | ldap | (&(objectClass=group)) | The filter string for the LDAP groups. The groups are used to recursively check for admin group member ship of users. | -| LDAP_ADMIN_GROUP | adminGroup | ldap | CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL | Users in this group are marked as administrators. | -| LDAP_ATTR_EMAIL | attrEmail | ldap | mail | User email attribute. | -| LDAP_ATTR_FIRSTNAME | attrFirstname | ldap | givenName | User firstname attribute. | -| LDAP_ATTR_LASTNAME | attrLastname | ldap | sn | User lastname attribute. | -| LDAP_ATTR_PHONE | attrPhone | ldap | telephoneNumber | User phone number attribute. | -| LDAP_ATTR_GROUPS | attrGroups | ldap | memberOf | User groups attribute. | -| LDAP_CERT_CONN | ldapCertConn | ldap | false | Allow connection with certificate against LDAP server without user/password | -| LDAPTLS_CERT | ldapTlsCert | ldap | | The LDAP cert's path | -| LDAPTLS_KEY | ldapTlsKey | ldap | | The LDAP key's path | -| LOG_LEVEL | | | debug | Specify log level, one of: trace, debug, info, off. | -| LOG_JSON | | | false | Format log output as JSON. | -| LOG_COLOR | | | true | Colorize log output. | -| CONFIG_FILE | | | config.yml | The config file path. | +| environment | yaml | yaml_parent | default_value | description | +|----------------------------|-------------------------|-------------|-----------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------| +| LISTENING_ADDRESS | listeningAddress | core | :8123 | The address on which the web server is listening. Optional IP address and port, e.g.: 127.0.0.1:8080. | +| EXTERNAL_URL | externalUrl | core | http://localhost:8123 | The external URL where the web server is reachable. This link is used in emails that are created by the WireGuard Portal. | +| WEBSITE_TITLE | title | core | WireGuard VPN | The website title. | +| COMPANY_NAME | company | core | WireGuard Portal | The company name (for branding). | +| MAIL_FROM | mailFrom | core | WireGuard VPN | The email address from which emails are sent. | +| LOGO_URL | logoUrl | core | /img/header-logo.png | The logo displayed in the page's header. | +| ADMIN_USER | adminUser | core | admin@wgportal.local | The administrator user. Must be a valid email address. | +| ADMIN_PASS | adminPass | core | wgportal | The administrator password. If unchanged, a random password will be set on first startup. | +| EDITABLE_KEYS | editableKeys | core | true | Allow to edit key-pairs in the UI. | +| CREATE_DEFAULT_PEER | createDefaultPeer | core | false | If an LDAP user logs in for the first time, a new WireGuard peer will be created on the WG_DEFAULT_DEVICE if this option is enabled. | +| SELF_PROVISIONING | selfProvisioning | core | false | Allow registered users to automatically create peers via the RESTful API. | +| WG_EXPORTER_FRIENDLY_NAMES | wgExporterFriendlyNames | core | false | Enable integration with [prometheus_wireguard_exporter friendly name](https://github.com/MindFlavor/prometheus_wireguard_exporter#friendly-tags). | +| LDAP_ENABLED | ldapEnabled | core | false | Enable or disable the LDAP backend. | +| SESSION_SECRET | sessionSecret | core | secret | Use a custom secret to encrypt session data. | +| BACKGROUND_TASK_INTERVAL | backgroundTaskInterval | core | 900 | The interval (in seconds) for the background tasks (like peer expiry check). | +| EXPIRY_REENABLE | expiryReEnable | core | false | Reactivate expired peers if the expiration date is in the future. | +| DATABASE_TYPE | typ | database | sqlite | Either mysql or sqlite. | +| DATABASE_HOST | host | database | | The mysql server address. | +| DATABASE_PORT | port | database | | The mysql server port. | +| DATABASE_NAME | database | database | data/wg_portal.db | For sqlite database: the database file-path, otherwise the database name. | +| DATABASE_USERNAME | user | database | | The mysql user. | +| DATABASE_PASSWORD | password | database | | The mysql password. | +| EMAIL_HOST | host | email | 127.0.0.1 | The email server address. | +| EMAIL_PORT | port | email | 25 | The email server port. | +| EMAIL_TLS | tls | email | false | Use STARTTLS. DEPRECATED: use EMAIL_ENCRYPTION instead. | +| EMAIL_ENCRYPTION | encryption | email | none | Either none, tls or starttls. | +| EMAIL_CERT_VALIDATION | certcheck | email | false | Validate the email server certificate. | +| EMAIL_USERNAME | user | email | | An optional username for SMTP authentication. | +| EMAIL_PASSWORD | pass | email | | An optional password for SMTP authentication. | +| EMAIL_AUTHTYPE | auth | email | plain | Either plain, login or crammd5. If username and password are empty, this value is ignored. | +| WG_DEVICES | devices | wg | wg0 | A comma separated list of WireGuard devices. | +| WG_DEFAULT_DEVICE | defaultDevice | wg | wg0 | This device is used for auto-created peers (if CREATE_DEFAULT_PEER is enabled). | +| WG_CONFIG_PATH | configDirectory | wg | /etc/wireguard | If set, interface configuration updates will be written to this path, filename: .conf. | +| MANAGE_IPS | manageIPAddresses | wg | true | Handle IP address setup of interface, only available on linux. | +| USER_MANAGE_PEERS | userManagePeers | wg | false | Logged in user can create or update peers (partially). | +| LDAP_URL | url | ldap | ldap://srv-ad01.company.local:389 | The LDAP server url. | +| LDAP_STARTTLS | startTLS | ldap | true | Use STARTTLS. | +| LDAP_CERT_VALIDATION | certcheck | ldap | false | Validate the LDAP server certificate. | +| LDAP_BASEDN | dn | ldap | DC=COMPANY,DC=LOCAL | The base DN for searching users. | +| LDAP_USER | user | ldap | company\\\\ldap_wireguard | The bind user. | +| LDAP_PASSWORD | pass | ldap | SuperSecret | The bind password. | +| LDAP_LOGIN_FILTER | loginFilter | ldap | (&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2)) | {{login_identifier}} will be replaced with the login email address. | +| LDAP_SYNC_FILTER | syncFilter | ldap | (&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*)) | The filter string for the LDAP synchronization service. Users matching this filter will be synchronized with the WireGuard Portal database. | +| LDAP_SYNC_GROUP_FILTER | syncGroupFilter | ldap | | The filter string for the LDAP groups, for example: (objectClass=group). The groups are used to recursively check for admin group member ship of users. | +| LDAP_ADMIN_GROUP | adminGroup | ldap | CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL | Users in this group are marked as administrators. | +| LDAP_ATTR_EMAIL | attrEmail | ldap | mail | User email attribute. | +| LDAP_ATTR_FIRSTNAME | attrFirstname | ldap | givenName | User firstname attribute. | +| LDAP_ATTR_LASTNAME | attrLastname | ldap | sn | User lastname attribute. | +| LDAP_ATTR_PHONE | attrPhone | ldap | telephoneNumber | User phone number attribute. | +| LDAP_ATTR_GROUPS | attrGroups | ldap | memberOf | User groups attribute. | +| LDAP_CERT_CONN | ldapCertConn | ldap | false | Allow connection with certificate against LDAP server without user/password | +| LDAPTLS_CERT | ldapTlsCert | ldap | | The LDAP cert's path | +| LDAPTLS_KEY | ldapTlsKey | ldap | | The LDAP key's path | +| LOG_LEVEL | | | debug | Specify log level, one of: trace, debug, info, off. | +| LOG_JSON | | | false | Format log output as JSON. | +| LOG_COLOR | | | true | Colorize log output. | +| CONFIG_FILE | | | config.yml | The config file path. | ### Sample yaml configuration config.yml: diff --git a/internal/ldap/ldap.go b/internal/ldap/ldap.go index cad3e76..78be238 100644 --- a/internal/ldap/ldap.go +++ b/internal/ldap/ldap.go @@ -97,6 +97,9 @@ func FindAllObjects(cfg *Config, objType ObjectType) ([]RawLdapData, error) { cfg.SyncFilter, attrs, nil, ) case Groups: + if cfg.SyncGroupFilter == "" { + return nil, nil // no groups + } // Search all groups attrs = []string{"dn", cfg.GroupMemberAttribute} searchRequest = ldap.NewSearchRequest( diff --git a/internal/server/configuration.go b/internal/server/configuration.go index 17bcc6a..00553a7 100644 --- a/internal/server/configuration.go +++ b/internal/server/configuration.go @@ -114,7 +114,7 @@ func NewConfig() *Config { cfg.LDAP.AdminLdapGroup = "CN=WireGuardAdmins,OU=_O_IT,DC=COMPANY,DC=LOCAL" cfg.LDAP.LoginFilter = "(&(objectClass=organizationalPerson)(mail={{login_identifier}})(!userAccountControl:1.2.840.113556.1.4.803:=2))" cfg.LDAP.SyncFilter = "(&(objectClass=organizationalPerson)(!userAccountControl:1.2.840.113556.1.4.803:=2)(mail=*))" - cfg.LDAP.SyncGroupFilter = "(&(objectClass=group))" + cfg.LDAP.SyncGroupFilter = "" cfg.WG.DeviceNames = []string{"wg0"} cfg.WG.DefaultDeviceName = "wg0"