diff --git a/README.md b/README.md index f5405a5..bb1451c 100644 --- a/README.md +++ b/README.md @@ -353,9 +353,8 @@ settings: auth_mode: required ldap_bind_address: ldaps://ad01.example.com:636 ldap_base_dn: DC=example,DC=com - # Optional performance scopes; default to ldap_base_dn when omitted. + # Optional user lookup scope; defaults to ldap_base_dn when omitted. ldap_user_base_dn: OU=Users,DC=example,DC=com - ldap_group_base_dn: OU=Groups,DC=example,DC=com auth_group_role_mappings: "CN=vctp-viewers,OU=Groups,DC=example,DC=com": viewer "CN=vctp-admins,OU=Groups,DC=example,DC=com": admin @@ -513,9 +512,8 @@ Authentication: - A user must belong to at least one mapped group to receive any role and log in. - `settings.ldap_groups` empty/omitted means no allowlist filter, but mapped-role requirement still applies. - `settings.ldap_bind_address`: LDAP/LDAPS URL used for authentication. -- `settings.ldap_base_dn`: LDAP base DN for user/group lookups. +- `settings.ldap_base_dn`: LDAP base DN fallback used for user lookup when `settings.ldap_user_base_dn` is not set. - `settings.ldap_user_base_dn`: optional user lookup base DN; defaults to `settings.ldap_base_dn`. -- `settings.ldap_group_base_dn`: optional group lookup base DN; defaults to `settings.ldap_base_dn`. - `settings.ldap_trust_cert_file`: optional CA cert file for LDAP TLS. - `settings.ldap_disable_validation`: disables LDAP TLS cert validation. - `settings.ldap_insecure`: insecure LDAP TLS mode. diff --git a/internal/auth/ldap.go b/internal/auth/ldap.go index 864221a..418bff3 100644 --- a/internal/auth/ldap.go +++ b/internal/auth/ldap.go @@ -26,7 +26,6 @@ type LDAPConfig struct { BindAddress string BaseDN string UserBaseDN string - GroupBaseDN string TrustCertFile string DisableValidation bool Insecure bool @@ -48,7 +47,6 @@ type LDAPAuthenticator struct { bindAddress string baseDN string userBaseDN string - groupBaseDN string trustCertFile string disableValidation bool insecure bool @@ -59,7 +57,6 @@ func NewLDAPAuthenticator(cfg LDAPConfig) (*LDAPAuthenticator, error) { bindAddress := strings.TrimSpace(cfg.BindAddress) baseDN := strings.TrimSpace(cfg.BaseDN) userBaseDN := strings.TrimSpace(cfg.UserBaseDN) - groupBaseDN := strings.TrimSpace(cfg.GroupBaseDN) trustCertFile := strings.TrimSpace(cfg.TrustCertFile) if bindAddress == "" { @@ -71,9 +68,6 @@ func NewLDAPAuthenticator(cfg LDAPConfig) (*LDAPAuthenticator, error) { if userBaseDN == "" { userBaseDN = baseDN } - if groupBaseDN == "" { - groupBaseDN = baseDN - } if _, err := url.ParseRequestURI(bindAddress); err != nil { return nil, fmt.Errorf("%w: bind address must be a valid URL: %v", ErrInvalidLDAPConfig, err) } @@ -87,7 +81,6 @@ func NewLDAPAuthenticator(cfg LDAPConfig) (*LDAPAuthenticator, error) { bindAddress: bindAddress, baseDN: baseDN, userBaseDN: userBaseDN, - groupBaseDN: groupBaseDN, trustCertFile: trustCertFile, disableValidation: cfg.DisableValidation, insecure: cfg.Insecure, @@ -135,7 +128,6 @@ func (a *LDAPAuthenticator) AuthenticateAndFetchGroups(ctx context.Context, user } identity.Diagnostics = append(identity.Diagnostics, "user_lookup_base_dn="+a.userBaseDN, - "group_lookup_base_dn="+a.groupBaseDN, ) if whoami, err := conn.WhoAmI(nil); err != nil { identity.Diagnostics = append(identity.Diagnostics, fmt.Sprintf("whoami_failed:%v", err)) diff --git a/internal/settings/settings.go b/internal/settings/settings.go index 2ac1c21..b0e92fe 100644 --- a/internal/settings/settings.go +++ b/internal/settings/settings.go @@ -80,7 +80,6 @@ type SettingsYML struct { LDAPBindAddress string `yaml:"ldap_bind_address"` LDAPBaseDN string `yaml:"ldap_base_dn"` LDAPUserBaseDN string `yaml:"ldap_user_base_dn"` - LDAPGroupBaseDN string `yaml:"ldap_group_base_dn"` LDAPTrustCertFile string `yaml:"ldap_trust_cert_file"` LDAPDisableValidation bool `yaml:"ldap_disable_validation"` LDAPInsecure bool `yaml:"ldap_insecure"` @@ -287,7 +286,6 @@ func applyDefaultsAndValidateSettings(cfg *SettingsYML) error { s.LDAPBindAddress = strings.TrimSpace(s.LDAPBindAddress) s.LDAPBaseDN = strings.TrimSpace(s.LDAPBaseDN) s.LDAPUserBaseDN = strings.TrimSpace(s.LDAPUserBaseDN) - s.LDAPGroupBaseDN = strings.TrimSpace(s.LDAPGroupBaseDN) s.LDAPTrustCertFile = strings.TrimSpace(s.LDAPTrustCertFile) s.LDAPGroups = compactTrimmedStrings(s.LDAPGroups) @@ -347,9 +345,6 @@ func applyDefaultsAndValidateSettings(cfg *SettingsYML) error { if s.LDAPUserBaseDN == "" { s.LDAPUserBaseDN = s.LDAPBaseDN } - if s.LDAPGroupBaseDN == "" { - s.LDAPGroupBaseDN = s.LDAPBaseDN - } if len(s.AuthGroupRoleMappings) == 0 { return errors.New("settings.auth_group_role_mappings must define at least one mapping when settings.auth_enabled=true") } diff --git a/internal/settings/settings_strict_test.go b/internal/settings/settings_strict_test.go index adeac39..9563aae 100644 --- a/internal/settings/settings_strict_test.go +++ b/internal/settings/settings_strict_test.go @@ -196,9 +196,6 @@ func TestReadYMLSettingsAcceptsValidAuthConfigAndNormalizesMappings(t *testing.T if got.LDAPUserBaseDN != "dc=example,dc=com" { t.Fatalf("expected default ldap_user_base_dn to fall back to ldap_base_dn, got %q", got.LDAPUserBaseDN) } - if got.LDAPGroupBaseDN != "dc=example,dc=com" { - t.Fatalf("expected default ldap_group_base_dn to fall back to ldap_base_dn, got %q", got.LDAPGroupBaseDN) - } if got.AuthGroupRoleMappings["cn=vctp-admins,ou=groups,dc=example,dc=com"] != authRoleAdmin { t.Fatalf("expected admin mapping to normalize role to %q, got %#v", authRoleAdmin, got.AuthGroupRoleMappings) } diff --git a/server/handler/auth.go b/server/handler/auth.go index 2dd6e87..08e9d2a 100644 --- a/server/handler/auth.go +++ b/server/handler/auth.go @@ -86,7 +86,6 @@ func (h *Handler) AuthLogin(w http.ResponseWriter, r *http.Request) { "ldap_bind_address", cfg.LDAPBindAddress, "ldap_base_dn", cfg.LDAPBaseDN, "ldap_user_base_dn", cfg.LDAPUserBaseDN, - "ldap_group_base_dn", cfg.LDAPGroupBaseDN, "ldap_group_requirements", limitStrings(cfg.LDAPGroups, maxDebugLogListItems), "auth_group_role_mapping_keys", limitStrings(sortedStringMapKeys(cfg.AuthGroupRoleMappings), maxDebugLogListItems), "ldap_insecure", cfg.LDAPInsecure, @@ -98,7 +97,6 @@ func (h *Handler) AuthLogin(w http.ResponseWriter, r *http.Request) { BindAddress: cfg.LDAPBindAddress, BaseDN: cfg.LDAPBaseDN, UserBaseDN: cfg.LDAPUserBaseDN, - GroupBaseDN: cfg.LDAPGroupBaseDN, TrustCertFile: cfg.LDAPTrustCertFile, DisableValidation: cfg.LDAPDisableValidation, Insecure: cfg.LDAPInsecure,