Kiu/Semaphore
Kiu/Semaphore
1
0
Fork 0
mirror of https://github.com/semaphoreui/semaphore.git synced 2025-01-20 23:39:56 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Merge branch 'ndgit-1026-ldap-search-result-index-out-of-range' into develop

Browse Source
This commit is contained in:
Denis Gukov 2022-10-30 21:45:36 +05:00
commit 4b097de954
1 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
api/login.go
View File

@ -64,13 +64,27 @@ func tryFindLDAPUser(username, password string) (*db.User, error) {
return nil, fmt.Errorf("too many entries returned") return nil, fmt.Errorf("too many entries returned")
} }
// Bind as the user to verify their password // Bind as the user
userdn := sr.Entries[0].DN userdn := sr.Entries[0].DN
if err = l.Bind(userdn, password); err != nil { if err = l.Bind(userdn, password); err != nil {
return nil, err return nil, err
} }
// Get user info and ensure authentication in case LDAP supports unauthenticated bind // Ensure authentication and verify itself with whoami operation
var res *ldap.WhoAmIResult
if res, err = l.WhoAmI(nil); err != nil {
return nil, err
}
if len(res.AuthzID) <= 0 {
return nil, fmt.Errorf("error while doing whoami operation")
}
// Second time bind as read only user
if err = l.Bind(util.Config.LdapBindDN, util.Config.LdapBindPassword); err != nil {
return nil, err
}
// Get user info
searchRequest = ldap.NewSearchRequest( searchRequest = ldap.NewSearchRequest(
util.Config.LdapSearchDN, util.Config.LdapSearchDN,
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
@ -84,6 +98,10 @@ func tryFindLDAPUser(username, password string) (*db.User, error) {
return nil, err return nil, err
} }
if len(sr.Entries) <= 0 {
return nil, fmt.Errorf("ldap search returned no entries")
}
ldapUser := db.User{ ldapUser := db.User{
Username: strings.ToLower(sr.Entries[0].GetAttributeValue(util.Config.LdapMappings.UID)), Username: strings.ToLower(sr.Entries[0].GetAttributeValue(util.Config.LdapMappings.UID)),
Created: time.Now(), Created: time.Now(),
@ -128,7 +146,7 @@ func createSession(w http.ResponseWriter, r *http.Request, user db.User) {
}) })
} }
//nolint: gocyclo // nolint: gocyclo
func login(w http.ResponseWriter, r *http.Request) { func login(w http.ResponseWriter, r *http.Request) {
var login struct { var login struct {
Auth string `json:"auth" binding:"required"` Auth string `json:"auth" binding:"required"`