llmgw/internal/directory/ldap.go

package directory

import (
	"context"
	"crypto/tls"
	"crypto/x509"
	"encoding/binary"
	"errors"
	"fmt"
	"os"
	"strconv"
	"strings"

	"github.com/go-ldap/ldap/v3"

	"gitea.mynodes.xyz/ilker/llmgw/internal/config"
	"gitea.mynodes.xyz/ilker/llmgw/internal/secrets"
)

// LDAP is a directory reached over LDAP, written for Active Directory: its
// attribute names, its disabled flag, and its matching rule for nested
// groups (LDAP_MATCHING_RULE_IN_CHAIN).
type LDAP struct {
	cfg  config.LDAP
	tls  *tls.Config
	dial func(url string) (ldapConn, error)
}

// ldapConn is the part of a connection used here, so tests need no server.
type ldapConn interface {
	Bind(user, password string) error
	Search(*ldap.SearchRequest) (*ldap.SearchResult, error)
	SearchWithPaging(*ldap.SearchRequest, uint32) (*ldap.SearchResult, error)
	Close() error
}

// inChain is AD's matching rule that follows nested group membership.
const inChain = "1.2.840.113556.1.4.1941"

// uacDisabled is userAccountControl's ACCOUNTDISABLE bit.
const uacDisabled = 0x2

var personAttrs = []string{"objectGUID", "sAMAccountName", "userPrincipalName", "mail", "displayName", "userAccountControl"}

// ErrBadCredentials is a person the directory does not know, or a password
// it does not take: said alike, so a form cannot tell which.
var ErrBadCredentials = errors.New("the directory does not take that name and password")

// NewLDAP prepares a directory from its configuration.
func NewLDAP(cfg config.LDAP) (*LDAP, error) {
	tc := &tls.Config{MinVersion: tls.VersionTLS12}
	if cfg.CAFile != "" {
		pem, err := os.ReadFile(cfg.CAFile)
		if err != nil {
			return nil, fmt.Errorf("auth.ldap.ca_file: %w", err)
		}
		pool := x509.NewCertPool()
		if !pool.AppendCertsFromPEM(pem) {
			return nil, fmt.Errorf("auth.ldap.ca_file %s holds no certificate", cfg.CAFile)
		}
		tc.RootCAs = pool
	}
	d := &LDAP{cfg: cfg, tls: tc}
	d.dial = d.dialURL
	return d, nil
}

func (d *LDAP) dialURL(u string) (ldapConn, error) {
	c, err := ldap.DialURL(u, ldap.DialWithTLSConfig(d.tls))
	if err != nil {
		return nil, err
	}
	c.SetTimeout(d.cfg.RoundTrip())
	if strings.HasPrefix(u, "ldap://") {
		// Validate refuses ldap:// without start_tls: nothing is sent first.
		if err := c.StartTLS(d.tls); err != nil {
			c.Close()
			return nil, fmt.Errorf("StartTLS: %w", err)
		}
	}
	return c, nil
}

// service is a connection bound as the account that finds people, to the
// first server that answers.
func (d *LDAP) service(ctx context.Context) (ldapConn, error) {
	pw, err := secrets.Read(ctx, d.cfg.BindPasswordFile)
	if err != nil {
		return nil, fmt.Errorf("auth.ldap.bind_password_file: %w", err)
	}
	var errs []error
	for _, u := range d.cfg.URLs {
		c, err := d.dial(u)
		if err != nil {
			errs = append(errs, fmt.Errorf("%s: %w", u, err))
			continue
		}
		if err := c.Bind(d.cfg.BindDN, strings.TrimSpace(string(pw))); err != nil {
			c.Close()
			// A server that refuses the service account refuses it
			// everywhere: not tried on the next.
			return nil, fmt.Errorf("binding as %s on %s: %w", d.cfg.BindDN, u, err)
		}
		return c, nil
	}
	return nil, fmt.Errorf("no directory server answered: %w", errors.Join(errs...))
}

// Authenticate checks a person's name and password against the directory
// and says who they are there, groups and all.
func (d *LDAP) Authenticate(ctx context.Context, login, password string) (Identity, error) {
	login = strings.TrimSpace(login)
	// An empty password is an unauthenticated bind, which succeeds: never
	// one for a person.
	if login == "" || password == "" {
		return Identity{}, ErrBadCredentials
	}
	// DOMAIN\user, as Windows writes it.
	if i := strings.LastIndexByte(login, '\\'); i >= 0 {
		login = login[i+1:]
	}
	c, err := d.service(ctx)
	if err != nil {
		return Identity{}, err
	}
	defer c.Close()
	q := ldap.EscapeFilter(login)
	filter := "(&" + d.people(false) + "(|(sAMAccountName=" + q + ")(userPrincipalName=" + q + ")(mail=" + q + ")))"
	res, err := c.Search(ldap.NewSearchRequest(d.cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
		2, 0, false, filter, personAttrs, nil))
	if err != nil {
		return Identity{}, fmt.Errorf("finding %s: %w", login, err)
	}
	if len(res.Entries) != 1 {
		// None, or two people one name matches: neither is let in.
		return Identity{}, ErrBadCredentials
	}
	id := identity(res.Entries[0])
	if err := c.Bind(id.DN, password); err != nil {
		var le *ldap.Error
		if errors.As(err, &le) && le.ResultCode == ldap.LDAPResultInvalidCredentials {
			return Identity{}, ErrBadCredentials
		}
		return Identity{}, fmt.Errorf("checking %s's password: %w", login, err)
	}
	// Back to the service account to read groups, which a person may not.
	pw, err := secrets.Read(ctx, d.cfg.BindPasswordFile)
	if err != nil {
		return Identity{}, err
	}
	if err := c.Bind(d.cfg.BindDN, strings.TrimSpace(string(pw))); err != nil {
		return Identity{}, err
	}
	if id.Groups, err = d.groupsOf(c, id.DN); err != nil {
		return Identity{}, err
	}
	return id, nil
}

// groupsOf are a person's groups, nested ones included, by CN and DN.
func (d *LDAP) groupsOf(c ldapConn, dn string) ([]string, error) {
	filter := "(&(objectClass=group)(member:" + inChain + ":=" + ldap.EscapeFilter(dn) + "))"
	res, err := c.SearchWithPaging(ldap.NewSearchRequest(d.groupBase(), ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
		0, 0, false, filter, []string{"cn"}, nil), 500)
	if err != nil {
		return nil, fmt.Errorf("reading the groups of %s: %w", dn, err)
	}
	var out []string
	for _, e := range res.Entries {
		out = append(out, e.GetAttributeValue("cn"), e.DN)
	}
	return out, nil
}

// People are everyone the directory has under the base, enabled or not,
// each with the mapped groups they are in: what a sync compares against.
func (d *LDAP) People(ctx context.Context, m Mapping) ([]Identity, error) {
	c, err := d.service(ctx)
	if err != nil {
		return nil, err
	}
	defer c.Close()
	res, err := c.SearchWithPaging(ldap.NewSearchRequest(d.cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
		0, 0, false, d.people(true), personAttrs, nil), 500)
	if err != nil {
		return nil, fmt.Errorf("listing people: %w", err)
	}
	people := make([]Identity, 0, len(res.Entries))
	at := map[string]int{}
	for _, e := range res.Entries {
		id := identity(e)
		at[id.ID] = len(people)
		people = append(people, id)
	}
	// Only the groups the mapping names matter: a query each, for its
	// members nested ones included, rather than one per person.
	for _, g := range m.Groups() {
		dns, err := d.groupDNs(c, g)
		if err != nil {
			return nil, err
		}
		for _, gdn := range dns {
			filter := "(&" + d.people(true) + "(memberOf:" + inChain + ":=" + ldap.EscapeFilter(gdn) + "))"
			r, err := c.SearchWithPaging(ldap.NewSearchRequest(d.cfg.BaseDN, ldap.ScopeWholeSubtree,
				ldap.NeverDerefAliases, 0, 0, false, filter, []string{"objectGUID"}, nil), 500)
			if err != nil {
				return nil, fmt.Errorf("reading the members of %s: %w", gdn, err)
			}
			for _, e := range r.Entries {
				if i, ok := at[guid(e.GetRawAttributeValue("objectGUID"))]; ok {
					people[i].Groups = append(people[i].Groups, g, gdn)
				}
			}
		}
	}
	return people, nil
}

// groupDNs are the groups a mapping's name means: a DN as it is, a CN
// looked up.
func (d *LDAP) groupDNs(c ldapConn, g string) ([]string, error) {
	if strings.Contains(g, "=") {
		return []string{g}, nil
	}
	res, err := c.Search(ldap.NewSearchRequest(d.groupBase(), ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
		0, 0, false, "(&(objectClass=group)(cn="+ldap.EscapeFilter(g)+"))", []string{"cn"}, nil))
	if err != nil {
		return nil, fmt.Errorf("finding the group %s: %w", g, err)
	}
	var out []string
	for _, e := range res.Entries {
		out = append(out, e.DN)
	}
	return out, nil
}

// people is the filter for person accounts under the user filter; enabled
// ones only, unless all.
func (d *LDAP) people(all bool) string {
	f := "(objectCategory=person)(objectClass=user)"
	if !all {
		f += "(!(userAccountControl:1.2.840.113556.1.4.803:=" + strconv.Itoa(uacDisabled) + "))"
	}
	return "(&" + f + d.cfg.UserFilter + ")"
}

// groupBase is where groups are searched: GroupBaseDN, else the domain root
// of BaseDN (its DC= parts).
func (d *LDAP) groupBase() string {
	if d.cfg.GroupBaseDN != "" {
		return d.cfg.GroupBaseDN
	}
	var dc []string
	for _, rdn := range strings.Split(d.cfg.BaseDN, ",") {
		if strings.HasPrefix(strings.ToUpper(strings.TrimSpace(rdn)), "DC=") {
			dc = append(dc, strings.TrimSpace(rdn))
		}
	}
	if len(dc) == 0 {
		return d.cfg.BaseDN
	}
	return strings.Join(dc, ",")
}

func identity(e *ldap.Entry) Identity {
	email := e.GetAttributeValue("mail")
	if email == "" {
		email = e.GetAttributeValue("userPrincipalName")
	}
	uac, _ := strconv.Atoi(e.GetAttributeValue("userAccountControl"))
	return Identity{
		ID: guid(e.GetRawAttributeValue("objectGUID")), DN: e.DN,
		Email: email, Name: e.GetAttributeValue("displayName"),
		Disabled: uac&uacDisabled != 0,
	}
}

// guid is an objectGUID as Windows writes it: its first three parts
// little-endian. Another directory's id is kept as hex.
func guid(b []byte) string {
	if len(b) != 16 {
		return fmt.Sprintf("%x", b)
	}
	return fmt.Sprintf("%08x-%04x-%04x-%x-%x", binary.LittleEndian.Uint32(b[0:4]),
		binary.LittleEndian.Uint16(b[4:6]), binary.LittleEndian.Uint16(b[6:8]), b[8:10], b[10:16])
}