This adds the functionality to run a user search with a filter for LDAP authentication. The search is done after successful bind, as the binding user. The typical use case is to limit authentication to users who are member of a group or under a certain OU. For example, to only match users in the "Syncthing" group in otherwise default Active Directory set up for example.com: <searchBaseDN>CN=Users,DC=example,DC=com</searchBaseDN> <searchFilter>(&(sAMAccountName=%s)(memberOf=CN=Syncthing,CN=Users,DC=example,DC=com))</searchFilter> The search filter is an "and" of two criteria (with the ampersand being XML quoted), - "(sAMAccountName=%s)" matches the user logging in - "(memberOf=CN=Syncthing,CN=Users,DC=example,DC=com)" matches members of the group in question. Authentication will only proceed if the search filter matches precisely one user.
21 lines
879 B
Go
21 lines
879 B
Go
// Copyright (C) 2018 The Syncthing Authors.
|
|
//
|
|
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
|
// You can obtain one at https://mozilla.org/MPL/2.0/.
|
|
|
|
package config
|
|
|
|
type LDAPConfiguration struct {
|
|
Address string `xml:"address,omitempty" json:"address"`
|
|
BindDN string `xml:"bindDN,omitempty" json:"bindDN"`
|
|
Transport LDAPTransport `xml:"transport,omitempty" json:"transport"`
|
|
InsecureSkipVerify bool `xml:"insecureSkipVerify,omitempty" json:"insecureSkipVerify" default:"false"`
|
|
SearchBaseDN string `xml:"searchBaseDN,omitempty" json:"searchBaseDN"`
|
|
SearchFilter string `xml:"searchFilter,omitempty" json:"searchFilter"`
|
|
}
|
|
|
|
func (c LDAPConfiguration) Copy() LDAPConfiguration {
|
|
return c
|
|
}
|