Sign-in is set up from the console, and a directory tried before it is kept

People → Sign-in shows single sign-on, Active Directory and SCIM, and the directory's last sync. E sets up Entra ID from the tenant and client IDs; D sets up Active Directory, tried from the control plane first: each server bound, people who may sign in, members of each mapped group. The secrets go into the store as store:auth/..., sealed by the master key, and the CA into the settings, so no control plane needs a file. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-19 12:55:27 +02:00
1 parent 4b6b3eeddb
commit ac25a9136a
@@ -76,6 +76,7 @@ type API struct {
 	// train is adapter training; nil without a store and agents.
 	train    *TrainAdmin
 	settings *Settings
+	auth     *AuthAdmin
 	// restartAgents tells every connected agent to start again.
 	restartAgents func(reason string) []string
 	// revoke records a removed node, so its certificate is refused.
@@ -129,6 +130,7 @@ func (a *API) Register(mux Mux) {
 	a.registerTrain(mux)
 	a.registerGuard(mux)
 	a.registerSettings(mux)
+	a.registerAuth(mux)
 	mux.HandleFunc("POST /api/v1/agents/restart", a.restartAgentsHandler)
 	mux.HandleFunc("GET /api/v1/audit", a.auditEvents)
 	mux.HandleFunc("GET /api/v1/usage/export", a.usageExport)
@@ -0,0 +1,170 @@
+package adminapi
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// AuthAdmin is what the sign-in endpoints need: how people sign in now, a
+// directory's settings tried before they are kept, and where the secrets
+// those settings name are kept for every control plane.
+type AuthAdmin struct {
+	Status func() AuthView
+	// TestLDAP tries an auth.ldap block, as YAML, binding with password
+	// when one is given rather than the one the block names.
+	TestLDAP func(ctx context.Context, settings, password string) ([]CheckView, error)
+	Secrets  interface {
+		SetClusterSecret(ctx context.Context, name, value string) error
+	}
+	Log *slog.Logger
+}
+
+// SetAuth enables the sign-in endpoints.
+func (a *API) SetAuth(x *AuthAdmin) { a.auth = x }
+
+// AuthView is how people sign in on this gateway.
+type AuthView struct {
+	SignupOpen bool `json:"signup_open"`
+	// OIDC is single sign-on through an identity provider: Entra ID,
+	// Keycloak, Okta.
+	OIDC *OIDCView `json:"oidc,omitempty"`
+	// LDAP is sign-in checked by a directory: Active Directory.
+	LDAP *LDAPView `json:"ldap,omitempty"`
+	// SCIM is whether a provider may keep accounts in step.
+	SCIM bool `json:"scim"`
+	// BaseURL is the portal's address, when the settings say it: what a
+	// provider's redirect address is made from.
+	BaseURL string `json:"base_url,omitempty"`
+}
+
+// OIDCView is auth.oidc as it is in force.
+type OIDCView struct {
+	Issuer         string `json:"issuer"`
+	ClientID       string `json:"client_id"`
+	Label          string `json:"label,omitempty"`
+	CreateAccounts bool   `json:"create_accounts"`
+	NoPasswords    bool   `json:"no_passwords"`
+}
+
+// LDAPView is auth.ldap as it is in force, and how its last sync went.
+type LDAPView struct {
+	URLs   []string `json:"urls"`
+	BaseDN string   `json:"base_dn"`
+	BindDN string   `json:"bind_dn"`
+	Label  string   `json:"label,omitempty"`
+	// Off is why this control plane could not use the settings, when it
+	// could not; local accounts still sign in.
+	Off      string             `json:"off,omitempty"`
+	LastSync *DirectorySyncView `json:"last_sync,omitempty"`
+}
+
+// DirectorySyncView is the last time the leader read the directory.
+type DirectorySyncView struct {
+	At           time.Time `json:"at"`
+	People       int       `json:"people"`
+	Accounts     int       `json:"accounts"`
+	Suspended    int       `json:"suspended"`
+	Reinstated   int       `json:"reinstated"`
+	RolesChanged int       `json:"roles_changed"`
+	Error        string    `json:"error,omitempty"`
+}
+
+// CheckView is one step of trying a directory.
+type CheckView struct {
+	Step   string `json:"step"`
+	OK     bool   `json:"ok"`
+	Detail string `json:"detail"`
+}
+
+// LDAPTestRequest is an auth.ldap block to try, as YAML, and the service
+// account's password when it is not kept yet.
+type LDAPTestRequest struct {
+	Settings string `json:"settings"`
+	Password string `json:"password,omitempty"`
+}
+
+// LDAPTestView is how trying the directory went.
+type LDAPTestView struct {
+	OK     bool        `json:"ok"`
+	Checks []CheckView `json:"checks"`
+}
+
+// SecretRequest is a secret for the store to keep.
+type SecretRequest struct {
+	Value string `json:"value"`
+}
+
+// authSecrets are the secrets an operator may give through the API, and
+// the reference the settings then name each by.
+var authSecrets = map[string]bool{"ldap-bind": true, "oidc-client-secret": true, "scim-token": true}
+
+// AuthSecretRef is the reference auth's settings name a kept secret by.
+func AuthSecretRef(name string) string { return "store:auth/" + name }
+
+func (a *API) registerAuth(mux Mux) {
+	need := func(w http.ResponseWriter) bool {
+		if a.auth == nil {
+			writeError(w, http.StatusNotImplemented, "this control plane has no accounts")
+			return false
+		}
+		return true
+	}
+	mux.HandleFunc("GET /api/v1/auth", func(w http.ResponseWriter, r *http.Request) {
+		if !need(w) {
+			return
+		}
+		writeJSON(w, http.StatusOK, a.auth.Status())
+	})
+	mux.HandleFunc("POST /api/v1/auth/ldap/test", func(w http.ResponseWriter, r *http.Request) {
+		if !need(w) {
+			return
+		}
+		var req LDAPTestRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		checks, err := a.auth.TestLDAP(r.Context(), req.Settings, req.Password)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		v := LDAPTestView{OK: len(checks) > 0, Checks: checks}
+		for _, c := range checks {
+			v.OK = v.OK && c.OK
+		}
+		writeJSON(w, http.StatusOK, v)
+	})
+	mux.HandleFunc("PUT /api/v1/auth/secrets/{name}", func(w http.ResponseWriter, r *http.Request) {
+		if !need(w) {
+			return
+		}
+		name := r.PathValue("name")
+		if !authSecrets[name] {
+			writeError(w, http.StatusNotFound, "no such secret: ldap-bind, oidc-client-secret or scim-token")
+			return
+		}
+		var req SecretRequest
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		if strings.TrimSpace(req.Value) == "" {
+			writeError(w, http.StatusBadRequest, "an empty secret")
+			return
+		}
+		if err := a.auth.Secrets.SetClusterSecret(r.Context(), "auth/"+name, req.Value); err != nil {
+			writeError(w, http.StatusInternalServerError, err.Error())
+			return
+		}
+		if a.auth.Log != nil {
+			// What changed and who changed it; never the value.
+			a.auth.Log.Info("a sign-in secret was set", "secret", name, "by", actorOf(r))
+		}
+		writeJSON(w, http.StatusOK, map[string]string{"ref": AuthSecretRef(name)})
+	})
+}
@@ -0,0 +1,53 @@
+package adminapi
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+type memSecrets map[string]string
+
+func (m memSecrets) SetClusterSecret(_ context.Context, name, value string) error {
+	m[name] = value
+	return nil
+}
+
+func TestSignInIsShownTriedAndItsSecretsKept(t *testing.T) {
+	a, _ := setup(t, testModels())
+	kept := memSecrets{}
+	var tried string
+	a.SetAuth(&AuthAdmin{
+		Status: func() AuthView { return AuthView{LDAP: &LDAPView{URLs: []string{"ldaps://dc1"}}} },
+		TestLDAP: func(_ context.Context, settings, password string) ([]CheckView, error) {
+			tried = settings + "|" + password
+			return []CheckView{{Step: "ldaps://dc1", OK: true}, {Step: "people", OK: false, Detail: "no one"}}, nil
+		},
+		Secrets: kept,
+	})
+	var v AuthView
+	if code := call(t, a, "GET", "/api/v1/auth", "", &v); code != 200 || v.LDAP == nil {
+		t.Fatalf("status: %d %+v", code, v)
+	}
+	// One step failing fails the whole.
+	var tv LDAPTestView
+	if code := call(t, a, "POST", "/api/v1/auth/ldap/test", `{"settings":"urls: [ldaps://dc1]","password":"pw"}`, &tv); code != 200 ||
+		tv.OK || len(tv.Checks) != 2 || tried != "urls: [ldaps://dc1]|pw" {
+		t.Errorf("test: %d %+v %q", code, tv, tried)
+	}
+	var ref map[string]string
+	if code := call(t, a, "PUT", "/api/v1/auth/secrets/ldap-bind", `{"value":"s3cret"}`, &ref); code != 200 ||
+		kept["auth/ldap-bind"] != "s3cret" || ref["ref"] != "store:auth/ldap-bind" {
+		t.Errorf("secret: %d %v %v", code, kept, ref)
+	}
+	// Only the sign-in secrets, and never an empty one.
+	if code := call(t, a, "PUT", "/api/v1/auth/secrets/engine-key", `{"value":"x"}`, nil); code != 404 {
+		t.Errorf("another secret: %d", code)
+	}
+	if code := call(t, a, "PUT", "/api/v1/auth/secrets/ldap-bind", `{"value":"  "}`, nil); code != 400 {
+		t.Errorf("an empty secret: %d", code)
+	}
+	if strings.Contains(kept["auth/ldap-bind"], " ") {
+		t.Error("an empty secret replaced the kept one")
+	}
+}
@@ -67,6 +67,7 @@ var PathParams = map[string]string{
 	"models/{name}":     "The model's name in the catalog.",
 	"presets/{name}":    "The preset's name, as `llmgw ctl model presets` lists it.",
 	"nodes/{id}":        "The node's ID, as `llmgw ctl nodes` lists it.",
+	"secrets/{name}":    "ldap-bind, oidc-client-secret or scim-token.",
 	"jobs/{id}":         "The job's ID, as starting it answered.",
 	"runs/{id}":         "The quality run's ID, as starting it answered.",
 	"requests/{id}":     "The request's ID: the x-request-id a client was answered with.",
@@ -396,6 +397,15 @@ var Routes = []Route{
 	{Method: "POST", Path: "/api/v1/settings/rollback", Summary: "Put an earlier version of the cluster's settings back in force",
 		Request: SettingsRollbackRequest{}, Response: SettingsView{}},

+	// How people sign in: single sign-on, a directory, and the secrets
+	// they need kept for every control plane.
+	{Method: "GET", Path: "/api/v1/auth", Summary: "How people sign in: OIDC, a directory, SCIM, and the directory's last sync",
+		Response: AuthView{}},
+	{Method: "POST", Path: "/api/v1/auth/ldap/test", Summary: "Try an auth.ldap block before it is kept: servers, the service account, people and groups",
+		Request: LDAPTestRequest{}, Response: LDAPTestView{}},
+	{Method: "PUT", Path: "/api/v1/auth/secrets/{name}", Summary: "Keep ldap-bind, oidc-client-secret or scim-token in the store, for settings to name as store:auth/NAME",
+		Request: SecretRequest{}, Response: map[string]string{}},
+
 	// Usage, requests and the record of changes.
 	{Method: "GET", Path: "/api/v1/usage", Summary: "What each group of the tenancy tree spent",
 		Query: []Param{