Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adds an option to enable sAMAccountname logins when upndomain is set #146

Merged
merged 3 commits into from
Dec 17, 2024
Merged

Adds an option to enable sAMAccountname logins when upndomain is set #146

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
445cc34
Adds an option to enable sAMAccountname logins when upndomain is set
kwagga Dec 6, 2024
921b2af
added changelog entry
kwagga Dec 6, 2024
96d4d16
Added unit tests for EnableSamaccountnameLogin
kwagga Dec 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ Canonical reference for changes, improvements, and bugfixes for cap.
## Next

* feat (oidc): add WithVerifier ([PR #141](https://github.com/hashicorp/cap/pull/141))
* feat (ldap): add an option to enable sAMAccountname logins when upndomain is set ([PR #146](https://github.com/hashicorp/cap/pull/146))

## 0.7.0

Expand Down
9 changes: 7 additions & 2 deletions ldap/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,8 +719,13 @@ func (c *Client) getUserDN(bindDN, username string) (string, error) {
}
var userDN string
if c.conf.UPNDomain != "" {
// Find the distinguished name for the user if userPrincipalName used for login
filter := fmt.Sprintf("(userPrincipalName=%s@%s)", escapeValue(username), c.conf.UPNDomain)
// Find the distinguished name for the user if userPrincipalName used for login, or sAMAccountName if enabled.
var filter string
if c.conf.EnableSamaccountnameLogin {
filter = fmt.Sprintf("(|(userPrincipalName=%s@%s)(sAMAccountName=%s))", escapeValue(username), c.conf.UPNDomain, escapeValue(username))
} else {
filter = fmt.Sprintf("(userPrincipalName=%s@%s)", escapeValue(username), c.conf.UPNDomain)
}
result, err := c.conn.Search(&ldap.SearchRequest{
BaseDN: c.conf.UserDN,
Scope: ldap.ScopeWholeSubtree,
Expand Down
51 changes: 51 additions & 0 deletions ldap/client_exported_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -458,6 +458,57 @@ func TestClient_Authenticate(t *testing.T) {
opts: []ldap.Option{ldap.WithGroups()},
wantGroups: []string{groups[0].DN},
},
{
name: "success-with-anon-bind-upn-domain-samaccountname",
username: "eve",
password: "password",
clientConfig: &ldap.ClientConfig{
URLs: []string{fmt.Sprintf("ldaps://127.0.0.1:%d", td.Port())},
Certificates: []string{td.Cert()},
DiscoverDN: true,
UserDN: testdirectory.DefaultUserDN,
GroupDN: testdirectory.DefaultGroupDN,
UPNDomain: "example.com",
EnableSamaccountnameLogin: true,
},
opts: []ldap.Option{ldap.WithGroups()},
wantGroups: []string{groups[0].DN},
},
{
name: "success-with-anon-bind-upn-domain-empty-userdn-samaccountname",
username: "eve",
password: "password",
clientConfig: &ldap.ClientConfig{
URLs: []string{fmt.Sprintf("ldaps://127.0.0.1:%d", td.Port())},
Certificates: []string{td.Cert()},
DiscoverDN: true,
UserDN: testdirectory.DefaultUserDN,
GroupDN: testdirectory.DefaultGroupDN,
UPNDomain: "example.com",
AnonymousGroupSearch: true,
AllowEmptyAnonymousGroupSearch: true,
EnableSamaccountnameLogin: true,
},
opts: []ldap.Option{ldap.WithGroups()},
wantGroups: []string{groups[0].DN},
},
{
name: "success-with-anon-bind-upn-domain-empty-userdn-opt-samaccountname",
username: "eve",
password: "password",
clientConfig: &ldap.ClientConfig{
URLs: []string{fmt.Sprintf("ldaps://127.0.0.1:%d", td.Port())},
Certificates: []string{td.Cert()},
DiscoverDN: true,
UserDN: testdirectory.DefaultUserDN,
GroupDN: testdirectory.DefaultGroupDN,
UPNDomain: "example.com",
AnonymousGroupSearch: true,
EnableSamaccountnameLogin: true,
},
opts: []ldap.Option{ldap.WithGroups(), ldap.WithEmptyAnonymousGroupSearch()},
wantGroups: []string{groups[0].DN},
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
Expand Down
3 changes: 3 additions & 0 deletions ldap/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,9 @@ type ClientConfig struct {
// the pre 1.1.1 Vault behavior.
// see: https://www.vaultproject.io/docs/upgrading/upgrade-to-1.1.1
DeprecatedVaultPre111GroupCNBehavior *bool `json:"use_pre111_group_cn_behavior"`

// EnableSamaccountnameLogin enables login with sAMAccountName in addition to UserPrincipalName when upndomain is set.
EnableSamaccountnameLogin bool `json:"enable_samaccountname_login"`
}

func (c *ClientConfig) clone() (*ClientConfig, error) {
Expand Down
Loading