mirror of
https://github.com/goauthentik/authentik.git
synced 2026-06-17 19:09:11 +03:00
Teffen Ellis
5727ae4271
* core, internal, packages: fix British spellings flagged by cspell Apply American spellings in Python docstrings/comments, Go log messages, a Rust doc comment, and a template comment (behaviour->behavior, initialise->initialize, finalise->finalize, etc.). Part of enabling cspell's British-spelling rule; the rule itself lands in a separate PR once all areas are clean. Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com> * gen Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>
71 lines
1.9 KiB
Go
71 lines
1.9 KiB
Go
package memory
|
|
|
|
import (
|
|
"time"
|
|
|
|
"beryju.io/ldap"
|
|
ttlcache "github.com/jellydator/ttlcache/v3"
|
|
log "github.com/sirupsen/logrus"
|
|
"goauthentik.io/internal/outpost/ldap/bind"
|
|
"goauthentik.io/internal/outpost/ldap/bind/direct"
|
|
"goauthentik.io/internal/outpost/ldap/server"
|
|
)
|
|
|
|
type Credentials struct {
|
|
DN string
|
|
Password string
|
|
}
|
|
|
|
type SessionBinder struct {
|
|
direct.DirectBinder
|
|
si server.LDAPServerInstance
|
|
log *log.Entry
|
|
sessions *ttlcache.Cache[Credentials, ldap.LDAPResultCode]
|
|
}
|
|
|
|
func NewSessionBinder(si server.LDAPServerInstance, oldBinder bind.Binder) *SessionBinder {
|
|
sb := &SessionBinder{
|
|
si: si,
|
|
log: log.WithField("logger", "authentik.outpost.ldap.binder.session"),
|
|
}
|
|
if oldBinder != nil {
|
|
if oldSb, ok := oldBinder.(*SessionBinder); ok {
|
|
sb.DirectBinder = oldSb.DirectBinder
|
|
sb.sessions = oldSb.sessions
|
|
sb.log.Debug("re-initialized session binder")
|
|
return sb
|
|
}
|
|
}
|
|
sb.sessions = ttlcache.New(ttlcache.WithDisableTouchOnHit[Credentials, ldap.LDAPResultCode]())
|
|
sb.DirectBinder = *direct.NewDirectBinder(si)
|
|
go sb.sessions.Start()
|
|
sb.log.Debug("initialized session binder")
|
|
return sb
|
|
}
|
|
|
|
func (sb *SessionBinder) Bind(username string, req *bind.Request) (ldap.LDAPResultCode, error) {
|
|
item := sb.sessions.Get(Credentials{
|
|
DN: req.BindDN,
|
|
Password: req.Password,
|
|
})
|
|
if item != nil {
|
|
sb.log.WithField("bindDN", req.BindDN).Info("authenticated from session")
|
|
return item.Value(), nil
|
|
}
|
|
sb.log.Debug("No session found for user, executing flow")
|
|
result, err := sb.DirectBinder.Bind(username, req)
|
|
// Only cache the result if there's been an error
|
|
if err == nil {
|
|
flags := sb.si.GetFlags(req.BindDN)
|
|
if flags == nil {
|
|
sb.log.Error("user flags not set after bind")
|
|
return result, err
|
|
}
|
|
sb.sessions.Set(Credentials{
|
|
DN: req.BindDN,
|
|
Password: req.Password,
|
|
}, result, time.Until(flags.Session.Expires))
|
|
}
|
|
return result, err
|
|
}
|