aboutsummaryrefslogtreecommitdiffstats
path: root/services/auth/source/ldap
Commit message (Collapse)AuthorAgeFilesLines
* Enable addtional linters (#34085)TheFox0x74 days2-4/+2
| | | | | | | | enable mirror, usestdlibbars and perfsprint part of: https://github.com/go-gitea/gitea/issues/34083 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix various trivial problems (#32861)wxiaoguang2024-12-171-0/+6
| | | | | | | | | | | | | | 1. add/improve comments to help future readers could understand the problem more easily. 2. add an error log to LDAP with username fallback 3. use `or` instead of `Iif` for "repo/branch_dropdown" (`Iif` was a mistake, but it doesn't really affect the UI) 4. add `tw-font-mono` style to container digest to match dockerhub 5. fix a bug in RepoBranchTagSelector: the form is not updated when there is no click to an item --------- Co-authored-by: delvh <dev.lh@web.de>
* Refactor some LDAP code (#32849)wxiaoguang2024-12-155-34/+42
|
* Update go dependencies (#32389)wxiaoguang2024-10-311-2/+2
|
* Save initial signup information for users to aid in spam prevention (#31852)techknowlogick2024-09-092-2/+2
| | | | | | | | | | | | | | This will allow instance admins to view signup pattern patterns for public instances. It is modelled after discourse, mastodon, and MediaWiki's approaches. Note: This has privacy implications, but as the above-stated open-source projects take this approach, especially MediaWiki, which I have no doubt looked into this thoroughly, it is likely okay for us, too. However, I would be appreciative of any feedback on how this could be improved. --------- Co-authored-by: Giteabot <teabot@gitea.io>
* Enable more `revive` linter rules (#30608)silverwind2024-04-221-1/+0
| | | | | | | | | | | Noteable additions: - `redefines-builtin-id` forbid variable names that shadow go builtins - `empty-lines` remove unnecessary empty lines that `gofumpt` does not remove for some reason - `superfluous-else` eliminate more superfluous `else` branches Rules are also sorted alphabetically and I cleaned up various parts of `.golangci.yml`.
* Move some asymkey functions to service layer (#28894)Lunny Xiao2024-03-042-4/+6
| | | | After the moving, all models will not depend on `util.Rename` so that I can do next step refactoring.
* Start to migrate from `util.OptionalBool` to `optional.Option[bool]` (#29329)65432024-02-232-6/+4
| | | just create transition helper and migrate two structs
* Unify user update methods (#28733)KN4CK3R2024-02-042-23/+25
| | | | | | | | | | | Fixes #28660 Fixes an admin api bug related to `user.LoginSource` Fixed `/user/emails` response not identical to GitHub api This PR unifies the user update methods. The goal is to keep the logic only at one place (having audit logs in mind). For example, do the password checks only in one method not everywhere a password is updated. After that PR is merged, the user creation should be next.
* Penultimate round of `db.DefaultContext` refactor (#27414)JakobDev2023-10-112-7/+7
| | | | | | | Part of #27065 --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix ldap admin privileges update bug (#27051)CaiCandong2023-10-011-10/+7
| | | | | | | | | | | | When the user does not set a username lookup condition, LDAP will get an empty string `""` for the user, hence the following code ``` if isExist, err := user_model.IsUserExist(db.DefaultContext, 0, sr.Username) ``` The user presence determination will always be nonexistent, so updates to user information will never be performed. Fix #27049
* Another round of `db.DefaultContext` refactor (#27103)JakobDev2023-09-252-4/+4
| | | | | | | Part of #27065 --------- Co-authored-by: KN4CK3R <admin@oldschoolhack.me>
* Reduce usage of `db.DefaultContext` (#27073)JakobDev2023-09-142-9/+9
| | | | | | | | | | | | | | Part of #27065 This reduces the usage of `db.DefaultContext`. I think I've got enough files for the first PR. When this is merged, I will continue working on this. Considering how many files this PR affect, I hope it won't take to long to merge, so I don't end up in the merge conflict hell. --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Improve LDAP group config documentation, fixes #21159 (#21227)Sven Seeberg2023-09-051-4/+5
| | | | Improve the wording of the LDAP group attributes documentation and expand the examples.
* Use `Set[Type]` instead of `map[Type]bool/struct{}`. (#26804)KN4CK3R2023-08-301-3/+4
|
* Change default email domain for LDAP users (#25425)Zettat1232023-06-222-2/+2
| | | | | Fixes #21169 Change `localhost` to `localhost.local`
* Fix LDAP sync when Username Attribute is empty (#25278)Zettat1232023-06-201-30/+32
| | | | | | | | | | | | | Fix #21072 ![image](https://github.com/go-gitea/gitea/assets/15528715/96b30beb-7f88-4a60-baae-2e5ad8049555) Username Attribute is not a required item when creating an authentication source. If Username Attribute is empty, the username value of LDAP user cannot be read, so all users from LDAP will be marked as inactive by mistake when synchronizing external users. This PR improves the sync logic, if username is empty, the email address will be used to find user.
* Do not send "registration success email" for external auth sources (#24632)wxiaoguang2023-05-101-3/+0
| | | | | | | | | | | | Co-author: @pboguslawski "registration success email" is only used for notifying a user that "you have a new account now" when the account is created by admin manually. When a user uses external auth source, they already knows that they has the account, so do not send such email. Co-authored-by: Giteabot <teabot@gitea.io>
* Update LDAP filters to include both username and email address (#24547)Gary Moon2023-05-051-5/+5
| | | | | | | Since the login form label for user_name unconditionally displays `Username or Email Address` for the `user_name` field, bring matching LDAP filters to more prominence in the documentation/placeholders. Signed-off-by: Gary Moon <gary@garymoon.net>
* Don't apply the group filter when listing LDAP group membership if it is ↵zeripath2023-03-291-1/+1
| | | | | | | | | | empty (#23745) When running listLdapGroupMemberships check if the groupFilter is empty before using it to list memberships. Fix #23615 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Map OIDC groups to Orgs/Teams (#21441)KN4CK3R2023-02-084-231/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | Fixes #19555 Test-Instructions: https://github.com/go-gitea/gitea/pull/21441#issuecomment-1419438000 This PR implements the mapping of user groups provided by OIDC providers to orgs teams in Gitea. The main part is a refactoring of the existing LDAP code to make it usable from different providers. Refactorings: - Moved the router auth code from module to service because of import cycles - Changed some model methods to take a `Context` parameter - Moved the mapping code from LDAP to a common location I've tested it with Keycloak but other providers should work too. The JSON mapping format is the same as for LDAP. ![grafik](https://user-images.githubusercontent.com/1666336/195634392-3fc540fc-b229-4649-99ac-91ae8e19df2d.png) --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Fix group filter for ldap source sync (#22506)Pavel Ezhov2023-02-021-66/+71
| | | | | | | | | | | | | | | | | | | | | There are 2 separate flows of creating a user: authentication and source sync. When a group filter is defined, source sync ignores group filter, while authentication respects it. With this PR I've fixed this behavior, so both flows now apply this filter when searching users in LDAP in a unified way. - Unified LDAP group membership lookup for authentication and source sync flows - Replaced custom group membership lookup (used for authentication flow) with an existing listLdapGroupMemberships method (used for source sync flow) - Modified listLdapGroupMemberships and getUserAttributeListedInGroup in a way group lookup could be called separately - Added user filtering based on a group membership for a source sync - Added tests to cover this logic Co-authored-by: Pavel Ezhov <paejov@gmail.com> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* Improve utils of slices (#22379)Jason Song2023-01-111-1/+1
| | | | | | | | | | | | | | | | | | | - Move the file `compare.go` and `slice.go` to `slice.go`. - Fix `ExistsInSlice`, it's buggy - It uses `sort.Search`, so it assumes that the input slice is sorted. - It passes `func(i int) bool { return slice[i] == target })` to `sort.Search`, that's incorrect, check the doc of `sort.Search`. - Conbine `IsInt64InSlice(int64, []int64)` and `ExistsInSlice(string, []string)` to `SliceContains[T]([]T, T)`. - Conbine `IsSliceInt64Eq([]int64, []int64)` and `IsEqualSlice([]string, []string)` to `SliceSortedEqual[T]([]T, T)`. - Add `SliceEqual[T]([]T, T)` as a distinction from `SliceSortedEqual[T]([]T, T)`. - Redesign `RemoveIDFromList([]int64, int64) ([]int64, bool)` to `SliceRemoveAll[T]([]T, T) []T`. - Add `SliceContainsFunc[T]([]T, func(T) bool)` and `SliceRemoveAllFunc[T]([]T, func(T) bool)` for general use. - Add comments to explain why not `golang.org/x/exp/slices`. - Add unit tests.
* Implement FSFE REUSE for golang files (#21840)flynnnnnnnnnn2022-11-278-16/+8
| | | | | | | | | Change all license headers to comply with REUSE specification. Fix #16132 Co-authored-by: flynnnnnnnnnn <flynnnnnnnnnn@github> Co-authored-by: John Olheiser <john.olheiser@gmail.com>
* Replace all instances of fmt.Errorf(%v) with fmt.Errorf(%w) (#21551)delvh2022-10-241-2/+2
| | | | | | | | | Found using `find . -type f -name '*.go' -print -exec vim {} -c ':%s/fmt\.Errorf(\(.*\)%v\(.*\)err/fmt.Errorf(\1%w\2err/g' -c ':wq' \;` Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Andrew Thornton <art27@cantab.net> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* EscapeFilter the group dn membership (#20200)zeripath2022-07-051-1/+1
| | | | | | | | | The uid provided to the group filter must be properly escaped using the provided ldap.EscapeFilter function. Fix #20181 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Add more linters to improve code readability (#19989)Wim2022-06-201-93/+93
| | | | | | | | | | Add nakedret, unconvert, wastedassign, stylecheck and nolintlint linters to improve code readability - nakedret - https://github.com/alexkohler/nakedret - nakedret is a Go static analysis tool to find naked returns in functions greater than a specified function length. - unconvert - https://github.com/mdempsky/unconvert - Remove unnecessary type conversions - wastedassign - https://github.com/sanposhiho/wastedassign - wastedassign finds wasted assignment statements. - notlintlint - Reports ill-formed or insufficient nolint directives - stylecheck - https://staticcheck.io/docs/checks/#ST - keep style consistent - excluded: [ST1003 - Poorly chosen identifier](https://staticcheck.io/docs/checks/#ST1003) and [ST1005 - Incorrectly formatted error string](https://staticcheck.io/docs/checks/#ST1005)
* Move almost all functions' parameter db.Engine to context.Context (#19748)Lunny Xiao2022-05-202-4/+3
| | | | * Move almost all functions' parameter db.Engine to context.Context * remove some unnecessary wrap functions
* Move user password verification after checking his groups on ldap auth (#19587)Gwilherm Folliot2022-05-031-8/+8
| | | | | | | In case the binded user can not access its own attributes. Signed-off-by: Gwilherm Folliot <gwilherm55fo@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Respect DefaultUserIsRestricted system default when creating new user (#19310)Jimmy Praet2022-04-292-22/+28
| | | | | | | | | | | | | | | | | | | * Apply DefaultUserIsRestricted in CreateUser * Enforce system defaults in CreateUser Allow for overwrites with CreateUserOverwriteOptions * Fix compilation errors * Add "restricted" option to create user command * Add "restricted" option to create user admin api * Respect default setting.Service.RegisterEmailConfirm and setting.Service.RegisterManualConfirm where needed * Revert "Respect default setting.Service.RegisterEmailConfirm and setting.Service.RegisterManualConfirm where needed" This reverts commit ee95d3e8dc9e9fff4fa66a5111e4d3930280e033.
* Move organization related structs into sub package (#18518)Lunny Xiao2022-03-293-24/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Move organization related structs into sub package * Fix test * Fix lint * Move more functions into sub packages * Fix bug * Fix test * Update models/organization/team_repo.go Co-authored-by: KN4CK3R <admin@oldschoolhack.me> * Apply suggestions from code review Co-authored-by: KN4CK3R <admin@oldschoolhack.me> * Fix fmt * Follow suggestion from @Gusted * Fix test * Fix test * Fix bug * Use ctx but db.DefaultContext on routers * Fix bug * Fix bug * fix bug * Update models/organization/team_user.go * Fix bug Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use `ctx` instead of `db.DefaultContext` in some ↵wxiaoguang2022-03-221-1/+1
| | | | | | | | | | | | packages(routers/services/modules) (#19163) * Remove `db.DefaultContext` usage in routers, use `ctx` directly * Use `ctx` directly if there is one, remove some `db.DefaultContext` in `services` * Use ctx instead of db.DefaultContext for `cmd` and some `modules` packages * fix incorrect context usage
* Fix ldap user sync missed email in email_address table (#18786)Lunny Xiao2022-02-241-1/+2
| | | | | * Fix ldap user sync missed email in email_address table * Fix test
* Fix ldap loginname (#18789)Johan Van de Wauw2022-02-181-2/+6
| | | | | | | | | | | | | | | | | | | | * Use email_address table to check user's email when login with email adress * Update services/auth/signin.go * Fix test * Fix test * Fix logging in with ldap username != loginname * Fix if user does not exist yet * Make more clear this is loginName * Fix formatting Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net>
* Add LDAP group sync to Teams, fixes #1395 (#16299)Sven Seeberg2022-02-116-27/+244
| | | | | | | | | | * Add setting for a JSON that maps LDAP groups to Org Teams. * Add log when removing or adding team members. * Sync is being run on login and periodically. * Existing group filter settings are reused. * Adding and removing team members. * Sync not existing LDAP group. * Login with broken group map JSON.
* format with gofumpt (#18184)65432022-01-201-1/+0
| | | | | | | | | | | * gofumpt -w -l . * gofumpt -w -l -extra . * Add linter * manual fix * change make fmt
* Refactor auth package (#17962)Lunny Xiao2022-01-024-41/+41
|
* Move keys to models/asymkey (#17917)Lunny Xiao2021-12-102-10/+10
| | | | | | | | | | | | | | | | | | | * Move keys to models/keys * Rename models/keys -> models/asymkey * change the missed package name * Fix package alias * Fix test * Fix docs * Fix test * Fix test * merge
* Move repository model into models/repo (#17933)Lunny Xiao2021-12-101-2/+1
| | | | | | | | | | | | | | | * Some refactors related repository model * Move more methods out of repository * Move repository into models/repo * Fix test * Fix test * some improvements * Remove unnecessary function
* Move user related model into models/user (#17781)Lunny Xiao2021-11-242-13/+15
| | | | | | | | | | | | | * Move user related model into models/user * Fix lint for windows * Fix windows lint * Fix windows lint * Move some tests in models * Merge
* Remove unnecessary attributes of User struct (#17745)Lunny Xiao2021-11-222-6/+9
| | | | | | | | | | | | | | | * Remove unnecessary functions of User struct * Move more database methods out of user struct * Move more database methods out of user struct * Fix template failure * Fix bug * Remove finished FIXME * remove unnecessary code
* Move webhook into models/webhook/ (#17579)Lunny Xiao2021-11-101-3/+4
|
* Allow LDAP Sources to provide Avatars (#16851)zeripath2021-09-264-6/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Allow LDAP Sources to provide Avatars Add setting to LDAP source to allow it to provide an Avatar. Currently this is required to point to the image bytes. Fix #4144 Signed-off-by: Andrew Thornton <art27@cantab.net> * Rename as Avatar Attribute (drop JPEG) Signed-off-by: Andrew Thornton <art27@cantab.net> * Always synchronize avatar if there is change Signed-off-by: Andrew Thornton <art27@cantab.net> * Actually get the avatar from the ldap Signed-off-by: Andrew Thornton <art27@cantab.net> * clean-up Signed-off-by: Andrew Thornton <art27@cantab.net> * use len()>0 rather than != "" Signed-off-by: Andrew Thornton <art27@cantab.net> * slight shortcut in IsUploadAvatarChanged Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add SkipLocal2FA option to pam and smtp sources (#17078)zeripath2021-09-261-1/+1
| | | | | | | | | | | | | * Add SkipLocal2FA option to other pam and smtp sources Extend #16954 to allow setting skip local 2fa on pam and SMTP authentication sources Signed-off-by: Andrew Thornton <art27@cantab.net> * make SkipLocal2FA omitempty Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Move login related structs and functions to models/login (#17093)Lunny Xiao2021-09-243-16/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Move login related structs and functions to models/login * Fix test * Fix lint * Fix lint * Fix lint of windows * Fix lint * Fix test * Fix test * Only load necessary fixtures when preparing unit tests envs * Fix lint * Fix test * Fix test * Fix error log * Fix error log * Fix error log * remove unnecessary change * fix error log * merge main branch
* Make LDAP be able to skip local 2FA (#16954)zeripath2021-09-173-0/+7
| | | | | | This PR extends #16594 to allow LDAP to be able to be set to skip local 2FA too. The technique used here would be extensible to PAM and SMTP sources. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Improve LDAP synchronization efficiency (#16994)zeripath2021-09-152-18/+28
| | | | | | | The current LDAP sync routine has order n^2 efficiency. This change reduces this to order n.log n. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Report the associated filter if there is an error in LDAP (#17014)zeripath2021-09-111-2/+2
| | | | | | If there is an error when performing the admin or restricted filter search ensure that the filter and the userDN are reported. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Send registration email on user autoregistration (#16523)zeripath2021-08-121-1/+7
| | | | | | | | | | | When users login and are autoregistered send email notification. Fix #16178 * Protect public functions within the mailer by testing if the mailer is configured Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Improve SMTP authentication and Fix user creation bugs (#16612)zeripath2021-08-111-12/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Improve SMTP authentication, Fix user creation bugs and add LDAP cert/key options This PR has two parts: Improvements for SMTP authentication: * Default to use SMTPS if port is 465, and allow setting of force SMTPS. * Always use STARTTLS if available * Provide CRAM-MD5 mechanism * Add options for HELO hostname disabling * Add options for providing certificates and keys * Handle application specific password response as a failed user login instead of as a 500. Close #16104 Fix creation of new users: * A bug was introduced when allowing users to change usernames which prevents the creation of external users. * The LoginSource refactor also broke this page. Close #16104 Signed-off-by: Andrew Thornton <art27@cantab.net>
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-05 17:14:46 +0000