Adds LDAP auth engine by vasyl-purchel · Pull Request #45 · jmgilman/vaultrs

vasyl-purchel · 2022-09-25T18:16:47Z

Adds new auth engine: LDAP.

Also attempt at adding a test for said engine but while manual test seems to work just fine (example added in a comment) but automated test fails to bind as a user (probably missing some knowledge on how docker_servertest localstack works)

jmgilman · 2022-09-25T19:36:46Z

Thanks for the PR! So which tests are failing?

vasyl-purchel · 2022-09-25T19:47:56Z

LDAP tests - currently it's commented out inside the login method (to check that return is OK result)

vasyl-purchel · 2022-09-25T19:50:35Z

I've pushed a commit to uncomment the test so that you can see how it fails. Hope you can help with getting it fixed :)

jmgilman · 2022-09-25T19:51:36Z

Thanks! I have limited bandwidth at the moment, but I'll see if I can take a deeper look later today or early this week. If we can't get it figured out, we can just mark tests as TODO and merge.

vasyl-purchel · 2022-09-25T19:54:43Z

Cool thanks, I'll also continue looking into fixing it, there is no rush in merging it so I'd prefer tests fixed first. :)

vasyl-purchel · 2022-09-25T20:07:35Z

src/api.rs

 #[derive(Deserialize, Debug)]
 pub struct EndpointResult<T> {
-    pub data: Option<T>,
+    pub data: Option<EitherData<T>>,


Also worth pointing out explicitly why this was changed:

as it seems that for currently implemented auth methods there is no "data" field returned for login api but for ldap/login it returns "data": {} for some reason and that breaks normal deserialisation. This "either data" structure ensures that if unexpectedly data field was returned it still can parse json object.

patryk-s · 2023-12-20T11:47:04Z

any updates on why this isn't merged? Would be nice to have.

Haennetz

Thanks again for your pull request, and sorry for the delay.
I added some suggestions mainly some naming stuff to be closer to the vault documentation.

Haennetz · 2024-02-11T12:20:49Z

src/api/auth/ldap/requests.rs

+    pub username_as_alias: Option<bool>,
+    pub token_ttl: Option<String>,


According to the documentation Vault add some parameters to the auth method.

Suggested change

pub username_as_alias: Option<bool>,

pub token_ttl: Option<String>,

pub username_as_alias: Option<bool>,

pub dereference_aliases: Option<String>,

pub max_page_size: Option<u32>,

pub use_token_groups: Option<bool>,

pub token_ttl: Option<String>,

Haennetz · 2024-02-11T12:26:41Z

src/api/auth/ldap/requests.rs

+/// ## Read LDAP Group
+/// Reads the policies associated with a LDAP group.
+///
+/// * Path: /auth/{self.mount}/groups/{self.groupname}
+/// * Method: GET
+/// * Response: [ReadLDAPGroupResponse]
+/// * Reference: https://www.vaultproject.io/api-docs/auth/ldap#read-ldap-group
+#[derive(Builder, Debug, Default, Endpoint)]
+#[endpoint(
+    path = "/auth/{self.mount}/groups/{self.groupname}",
+    response = "ReadLDAPGroupResponse",
+    builder = "true"
+)]
+#[builder(setter(into, strip_option), default)]
+pub struct ReadLDAPGroupRequest {
+    #[endpoint(skip)]
+    pub mount: String,
+    #[endpoint(skip)]
+    pub groupname: String,
+}


According to the official documentation we should change it from groupname to name.

Suggested change

/// ## Read LDAP Group

/// Reads the policies associated with a LDAP group.

///

/// * Path: /auth/{self.mount}/groups/{self.groupname}

/// * Method: GET

/// * Response: [ReadLDAPGroupResponse]

/// * Reference: https://www.vaultproject.io/api-docs/auth/ldap#read-ldap-group

#[derive(Builder, Debug, Default, Endpoint)]

#[endpoint(

path = "/auth/{self.mount}/groups/{self.groupname}",

response = "ReadLDAPGroupResponse",

builder = "true"

)]

#[builder(setter(into, strip_option), default)]

pub struct ReadLDAPGroupRequest {

#[endpoint(skip)]

pub mount: String,

#[endpoint(skip)]

pub groupname: String,

}

/// ## Read LDAP Group

/// Reads the policies associated with a LDAP group.

///

/// * Path: /auth/{self.mount}/groups/{self.name}

/// * Method: GET

/// * Response: [ReadLDAPGroupResponse]

/// * Reference: https://www.vaultproject.io/api-docs/auth/ldap#read-ldap-group

#[derive(Builder, Debug, Default, Endpoint)]

#[endpoint(

path = "/auth/{self.mount}/groups/{self.name}",

response = "ReadLDAPGroupResponse",

builder = "true"

)]

#[builder(setter(into, strip_option), default)]

pub struct ReadLDAPGroupRequest {

#[endpoint(skip)]

pub mount: String,

#[endpoint(skip)]

pub name: String,

}

Haennetz · 2024-02-11T12:29:01Z

src/api/auth/ldap/requests.rs

+/// ## Create/Update LDAP Group
+/// Creates or updates LDAP group policies.
+///
+/// * Path: /auth/{self.mount}/users/{self.groupname}


Suggested change

/// * Path: /auth/{self.mount}/users/{self.groupname}

/// * Path: /auth/{self.mount}/users/{self.name}

Haennetz · 2024-02-11T12:29:13Z

src/api/auth/ldap/requests.rs

+/// * Reference: https://www.vaultproject.io/api-docs/auth/ldap#create-update-ldap-group
+#[derive(Builder, Debug, Default, Endpoint)]
+#[endpoint(
+    path = "/auth/{self.mount}/groups/{self.groupname}",


Suggested change

path = "/auth/{self.mount}/groups/{self.groupname}",

path = "/auth/{self.mount}/groups/{self.name}",

Haennetz · 2024-02-11T12:29:26Z

src/api/auth/ldap/requests.rs

+    #[endpoint(skip)]
+    pub mount: String,
+    #[endpoint(skip)]
+    pub groupname: String,


Suggested change

pub groupname: String,

pub name: String,

Haennetz · 2024-02-11T12:51:23Z

src/auth/ldap.rs

+        api::exec_with_result(client, endpoint).await
+    }
+
+    /// Crates or updates a new user.


Suggested change

/// Crates or updates a new user.

/// Crates or updates a new group.

Haennetz · 2024-02-11T12:52:24Z

src/auth/ldap.rs

+            .groupname(groupname)
+            .policies(policies)


Suggested change

.groupname(groupname)

.policies(policies)

.name(name)

Haennetz · 2024-02-11T12:54:02Z

src/auth/ldap.rs

+        groupname: &str,
+        policies: &str,


The Policies should also be optional and are included in opts.

Suggested change

groupname: &str,

policies: &str,

name: &str,

Haennetz · 2024-02-11T12:56:54Z

src/auth/ldap.rs

+        policies: &str,
+        groups: &str,


policies and groups should also be optional.

Suggested change

policies: &str,

groups: &str,

Haennetz · 2024-02-11T12:57:15Z

src/auth/ldap.rs

+            .policies(policies)
+            .groups(groups)


Suggested change

.policies(policies)

.groups(groups)

vasyl-purchel · 2024-02-21T16:03:59Z

hi, sorry, currently busy with other things, I'll try to take a look at fixing the comments later

vasyl-purchel force-pushed the master branch from 477e34a to d7aa3c7 Compare September 25, 2022 18:43

Adds LDAP auth engine

79dcaaa

vasyl-purchel force-pushed the master branch from d7aa3c7 to 79dcaaa Compare September 25, 2022 18:45

Uncomment ldap login test

436f43a

vasyl-purchel commented Sep 25, 2022

View reviewed changes

Haennetz reviewed Feb 11, 2024

View reviewed changes

Haennetz force-pushed the master branch from 758b226 to 43e3214 Compare March 20, 2024 20:19

		pub username_as_alias: Option<bool>,
		pub token_ttl: Option<String>,

	/// * Path: /auth/{self.mount}/users/{self.groupname}
	/// * Path: /auth/{self.mount}/users/{self.name}

	path = "/auth/{self.mount}/groups/{self.groupname}",
	path = "/auth/{self.mount}/groups/{self.name}",

	/// Crates or updates a new user.
	/// Crates or updates a new group.

Conversation

vasyl-purchel commented Sep 25, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jmgilman commented Sep 25, 2022

Uh oh!

vasyl-purchel commented Sep 25, 2022

Uh oh!

vasyl-purchel commented Sep 25, 2022

Uh oh!

jmgilman commented Sep 25, 2022

Uh oh!

vasyl-purchel commented Sep 25, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

patryk-s commented Dec 20, 2023

Uh oh!

Haennetz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vasyl-purchel commented Feb 21, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vasyl-purchel commented Sep 25, 2022 •

edited

Loading