Skip to content

Commit 354d542

Browse files
[v0.6] Validate LDAP/AD authconfigs (#1186)
Backport of #682, #738, #927
1 parent 5dcfa4e commit 354d542

9 files changed

Lines changed: 998 additions & 0 deletions

File tree

docs.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,33 @@ If yes, the webhook redacts the role, so that it only grants a deletion permissi
8383

8484
# management.cattle.io/v3
8585

86+
## Authconfig
87+
88+
89+
### Validation Checks
90+
91+
#### Create and Update
92+
93+
When an LDAP (`openldap`, `freeipa`) or ActiveDirectory (`activedirectory`) authconfig is created or updated, the following checks take place:
94+
95+
- The field `servers` is required.
96+
- If set, the following fields should have valid LDAP attribute names according to RFC4512
97+
- `userSearchAttribute`
98+
- `userLoginAttribute`
99+
- `userObjectClass`
100+
- `userNameAttribute`
101+
- `userMemberAttribute` (only for LDAP authconfigs)
102+
- `userEnabledAttribute`
103+
- `groupSearchAttribute`
104+
- `groupObjectClass`
105+
- `groupNameAttribute`
106+
- `groupDNAttribute`
107+
- `groupMemberUserAttribute`
108+
- `groupMemberMappingAttribute`
109+
- If set, the following fields should have a valid LDAP filter expression according to RFC4515
110+
- `userSearchFilter`
111+
- `groupSearchFilter`
112+
86113
## Cluster
87114

88115
### Validation Checks

go.mod

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ replace (
4141
require (
4242
github.com/blang/semver v3.5.1+incompatible
4343
github.com/evanphx/json-patch v5.9.11+incompatible
44+
github.com/go-ldap/ldap/v3 v3.4.10
4445
github.com/gorilla/mux v1.8.1
4546
github.com/rancher/dynamiclistener v0.6.1
4647
github.com/rancher/lasso v0.2.2
@@ -66,6 +67,7 @@ require (
6667

6768
require (
6869
cel.dev/expr v0.18.0 // indirect
70+
github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
6971
github.com/NYTimes/gziphandler v1.1.1 // indirect
7072
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
7173
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
@@ -82,6 +84,7 @@ require (
8284
github.com/fsnotify/fsnotify v1.7.0 // indirect
8385
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
8486
github.com/ghodss/yaml v1.0.0 // indirect
87+
github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
8588
github.com/go-logr/logr v1.4.3 // indirect
8689
github.com/go-logr/stdr v1.2.2 // indirect
8790
github.com/go-openapi/jsonpointer v0.21.0 // indirect

go.sum

Lines changed: 87 additions & 0 deletions
Large diffs are not rendered by default.

pkg/codegen/main.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ func main() {
9292
&v3.Project{},
9393
&v3.Setting{},
9494
&v3.User{},
95+
&v3.AuthConfig{},
9596
},
9697
},
9798
"provisioning.cattle.io": {

pkg/generated/objects/management.cattle.io/v3/objects.go

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -696,3 +696,56 @@ func UserFromRequest(request *admissionv1.AdmissionRequest) (*v3.User, error) {
696696

697697
return object, nil
698698
}
699+
700+
// AuthConfigOldAndNewFromRequest gets the old and new AuthConfig objects, respectively, from the webhook request.
701+
// If the request is a Delete operation, then the new object is the zero value for AuthConfig.
702+
// Similarly, if the request is a Create operation, then the old object is the zero value for AuthConfig.
703+
func AuthConfigOldAndNewFromRequest(request *admissionv1.AdmissionRequest) (*v3.AuthConfig, *v3.AuthConfig, error) {
704+
if request == nil {
705+
return nil, nil, fmt.Errorf("nil request")
706+
}
707+
708+
object := &v3.AuthConfig{}
709+
oldObject := &v3.AuthConfig{}
710+
711+
if request.Operation != admissionv1.Delete {
712+
err := json.Unmarshal(request.Object.Raw, object)
713+
if err != nil {
714+
return nil, nil, fmt.Errorf("failed to unmarshal request object: %w", err)
715+
}
716+
}
717+
718+
if request.Operation == admissionv1.Create {
719+
return oldObject, object, nil
720+
}
721+
722+
err := json.Unmarshal(request.OldObject.Raw, oldObject)
723+
if err != nil {
724+
return nil, nil, fmt.Errorf("failed to unmarshal request oldObject: %w", err)
725+
}
726+
727+
return oldObject, object, nil
728+
}
729+
730+
// AuthConfigFromRequest returns a AuthConfig object from the webhook request.
731+
// If the operation is a Delete operation, then the old object is returned.
732+
// Otherwise, the new object is returned.
733+
func AuthConfigFromRequest(request *admissionv1.AdmissionRequest) (*v3.AuthConfig, error) {
734+
if request == nil {
735+
return nil, fmt.Errorf("nil request")
736+
}
737+
738+
object := &v3.AuthConfig{}
739+
raw := request.Object.Raw
740+
741+
if request.Operation == admissionv1.Delete {
742+
raw = request.OldObject.Raw
743+
}
744+
745+
err := json.Unmarshal(raw, object)
746+
if err != nil {
747+
return nil, fmt.Errorf("failed to unmarshal request object: %w", err)
748+
}
749+
750+
return object, nil
751+
}
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
2+
## Validation Checks
3+
4+
### Create and Update
5+
6+
When an LDAP (`openldap`, `freeipa`) or ActiveDirectory (`activedirectory`) authconfig is created or updated, the following checks take place:
7+
8+
- The field `servers` is required.
9+
- If set, the following fields should have valid LDAP attribute names according to RFC4512
10+
- `userSearchAttribute`
11+
- `userLoginAttribute`
12+
- `userObjectClass`
13+
- `userNameAttribute`
14+
- `userMemberAttribute` (only for LDAP authconfigs)
15+
- `userEnabledAttribute`
16+
- `groupSearchAttribute`
17+
- `groupObjectClass`
18+
- `groupNameAttribute`
19+
- `groupDNAttribute`
20+
- `groupMemberUserAttribute`
21+
- `groupMemberMappingAttribute`
22+
- If set, the following fields should have a valid LDAP filter expression according to RFC4515
23+
- `userSearchFilter`
24+
- `groupSearchFilter`

0 commit comments

Comments
 (0)