mirror of https://github.com/h44z/wg-portal.git
95 lines
1.7 KiB
Go
95 lines
1.7 KiB
Go
package ldap
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"fmt"
|
|
|
|
"github.com/go-ldap/ldap/v3"
|
|
)
|
|
|
|
type Authentication struct {
|
|
Cfg *Config
|
|
}
|
|
|
|
func NewAuthentication(config Config) Authentication {
|
|
a := Authentication{
|
|
Cfg: &config,
|
|
}
|
|
|
|
return a
|
|
}
|
|
|
|
func (a Authentication) open() (*ldap.Conn, error) {
|
|
conn, err := ldap.DialURL(a.Cfg.URL)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if a.Cfg.StartTLS {
|
|
// Reconnect with TLS
|
|
err = conn.StartTLS(&tls.Config{InsecureSkipVerify: true})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
err = conn.Bind(a.Cfg.BindUser, a.Cfg.BindPass)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return conn, nil
|
|
}
|
|
|
|
func (a Authentication) close(conn *ldap.Conn) {
|
|
if conn != nil {
|
|
conn.Close()
|
|
}
|
|
}
|
|
|
|
func (a Authentication) CheckLogin(username, password string) bool {
|
|
return a.CheckCustomLogin("sAMAccountName", username, password)
|
|
}
|
|
|
|
func (a Authentication) CheckCustomLogin(userIdentifier, username, password string) bool {
|
|
client, err := a.open()
|
|
if err != nil {
|
|
return false
|
|
}
|
|
defer a.close(client)
|
|
|
|
// Search for the given username
|
|
searchRequest := ldap.NewSearchRequest(
|
|
a.Cfg.BaseDN,
|
|
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
|
|
fmt.Sprintf("(&(objectClass=organizationalPerson)(%s=%s))", userIdentifier, username),
|
|
[]string{"dn", "userAccountControl"},
|
|
nil,
|
|
)
|
|
|
|
sr, err := client.Search(searchRequest)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
if len(sr.Entries) != 1 {
|
|
return false
|
|
}
|
|
|
|
userDN := sr.Entries[0].DN
|
|
|
|
// Check if user is disabled, if so deny login
|
|
uac := sr.Entries[0].GetAttributeValue("userAccountControl")
|
|
if uac != "" && IsLdapUserDisabled(uac) {
|
|
return false
|
|
}
|
|
|
|
// Bind as the user to verify their password
|
|
err = client.Bind(userDN, password)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
return true
|
|
}
|