feat(ldap): Active Directory 双目录支持与 Docker 构建优化

- 新增 ldap_ad.go，支持 AD 密码编码、字段映射与目录类型判断 - 重构 ldap/ldap_users/ldap_ou，兼容 OpenLDAP 与 AD 登录、导入、OU 浏览 - 前端系统设置增加目录类型选择与 AD 配置项 - Dockerfile 按 TARGETARCH 单架构编译 Agent，限制 Node 内存防 OOM - run.sh 新增 docker fast/upgrade，README 补充 LDAP/AD 与常见问题
2026-07-02 22:45:49 +08:00
1 parent 0f0f2770e1
commit 78c27037e3
@@ -32,6 +32,17 @@ type LDAPAuthInfo struct {
 	Email       string
 }

+var ldapUserAttrs = []string{
+	"uid", "cn", "displayName", "mail", "userPrincipalName", "sAMAccountName",
+	"telephoneNumber", "mobile", "title", "department",
+}
+
+var ldapUserAttrSets = [][]string{
+	{"uid", "cn", "displayName", "mail", "telephoneNumber", "mobile", "title", "department"},
+	{"sAMAccountName", "userPrincipalName", "displayName", "cn", "mail", "telephoneNumber", "mobile", "title", "department"},
+	ldapUserAttrs,
+}
+
 // dialLDAP 连接LDAP服务器
 func dialLDAP(cfg *model.LDAPConfig) (*ldap.Conn, error) {
 	if cfg.LDAPHost == "" {
@@ -50,6 +61,136 @@ func dialLDAP(cfg *model.LDAPConfig) (*ldap.Conn, error) {
 	return ldap.DialURL(uri, ldap.DialWithDialer(dialer))
 }

+// ldapUserFilter 构造兼容 OpenLDAP 与 AD 的用户搜索过滤器 // Logan.Li
+func ldapUserFilter(cfg *model.LDAPConfig, username string) string {
+	escaped := ldap.EscapeFilter(username)
+	if cfg.SearchFilter != nil && strings.TrimSpace(*cfg.SearchFilter) != "" {
+		sf := strings.TrimSpace(*cfg.SearchFilter)
+		if strings.Contains(sf, "%s") {
+			return strings.ReplaceAll(sf, "%s", escaped)
+		}
+		return fmt.Sprintf("(&%s(|(uid=%s)(sAMAccountName=%s)(userPrincipalName=%s)(cn=%s)))", sf, escaped, escaped, escaped, escaped)
+	}
+	return fmt.Sprintf("(|(&(objectClass=inetOrgPerson)(uid=%s))(&(objectClass=user)(|(sAMAccountName=%s)(userPrincipalName=%s)(cn=%s))))", escaped, escaped, escaped, escaped)
+}
+
+// ldapADUserFilter 生成 AD 兜底过滤器，参考 opsx-monitor 的 sAMAccountName/userPrincipalName/cn 兼容策略 // Logan.Li
+func ldapADUserFilter(username string) string {
+	escaped := ldap.EscapeFilter(username)
+	return fmt.Sprintf("(|(sAMAccountName=%s)(userPrincipalName=%s)(cn=%s))", escaped, escaped, escaped)
+}
+
+// ldapUserListFilters 返回目录用户列表过滤器，先尊重配置，再补 OpenLDAP/AD 兜底 // Logan.Li
+func ldapUserListFilters(cfg *model.LDAPConfig) []string {
+	filters := []string{}
+	if cfg.SearchFilter != nil && strings.TrimSpace(*cfg.SearchFilter) != "" {
+		sf := strings.TrimSpace(*cfg.SearchFilter)
+		if strings.Contains(sf, "%s") {
+			filters = append(filters, strings.ReplaceAll(sf, "%s", "*"))
+		} else {
+			filters = append(filters, sf)
+		}
+	}
+	filters = append(filters,
+		"(objectClass=inetOrgPerson)",
+		"(&(objectClass=user)(|(sAMAccountName=*)(userPrincipalName=*)))",
+	)
+	return filters
+}
+
+// ldapEntryAttr 按属性名回退读取，兼容 OpenLDAP 与 AD 常见字段 // Logan.Li
+func ldapEntryAttr(entry *ldap.Entry, names ...string) string {
+	for _, name := range names {
+		if v := entry.GetAttributeValue(name); v != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// ldapUserMapping 读取用户字段映射，同时提供 AD/OpenLDAP 默认回退 // Logan.Li
+func ldapUserMapping(cfg *model.LDAPConfig) map[string]string {
+	userMapping := ldapDefaultUserMapping(cfg)
+	if cfg.UserMapping != nil && *cfg.UserMapping != "" {
+		_ = json.Unmarshal([]byte(*cfg.UserMapping), &userMapping)
+	}
+	return userMapping
+}
+
+// ldapIdentityFromEntry 将目录条目转换为平台统一用户信息 // Logan.Li
+func ldapIdentityFromEntry(cfg *model.LDAPConfig, entry *ldap.Entry, fallbackUsername string) *LDAPAuthInfo {
+	mapping := ldapUserMapping(cfg)
+	mappedUsername := ldapEntryAttr(entry, mapping["username"])
+	mappedDisplay := ldapEntryAttr(entry, mapping["display_name"])
+	mappedEmail := ldapEntryAttr(entry, mapping["email"])
+	info := &LDAPAuthInfo{
+		Username:    ldapFirstNonEmpty(mappedUsername, ldapEntryAttr(entry, "uid", "sAMAccountName", "userPrincipalName", "cn"), fallbackUsername),
+		DisplayName: ldapFirstNonEmpty(mappedDisplay, ldapEntryAttr(entry, "displayName", "cn"), fallbackUsername),
+		Email:       ldapFirstNonEmpty(mappedEmail, ldapEntryAttr(entry, "mail", "userPrincipalName")),
+	}
+	return info
+}
+
+func ldapFirstNonEmpty(values ...string) string {
+	for _, v := range values {
+		if strings.TrimSpace(v) != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+// ldapIsInvalidAttributeErr 判断目录不支持某些属性时的错误，用于 OpenLDAP/AD 属性集降级 // Logan.Li
+func ldapIsInvalidAttributeErr(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "undefined attribute") ||
+		strings.Contains(msg, "invalid attribute") ||
+		strings.Contains(msg, "attribute type undefined") ||
+		strings.Contains(msg, "no such attribute")
+}
+
+// ldapSearchUsers 使用多组属性搜索，避免 OpenLDAP 与 AD 互不支持属性时整体失败 // Logan.Li
+func ldapSearchUsers(conn *ldap.Conn, baseDN, filter string, sizeLimit int) (*ldap.SearchResult, error) {
+	var lastErr error
+	for _, attrs := range ldapUserAttrSets {
+		searchReq := ldap.NewSearchRequest(
+			baseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
+			sizeLimit, 10, false,
+			filter,
+			attrs,
+			nil,
+		)
+		sr, err := conn.Search(searchReq)
+		if err == nil {
+			return sr, nil
+		}
+		lastErr = err
+		if ldapIsInvalidAttributeErr(err) {
+			continue
+		}
+		return nil, err
+	}
+	return nil, lastErr
+}
+
+// ldapSearchFirstUser 查找单个用户，过滤器兼容 OpenLDAP 与 Active Directory // Logan.Li
+func ldapSearchFirstUser(conn *ldap.Conn, cfg *model.LDAPConfig, username string) (*ldap.Entry, error) {
+	for _, filter := range []string{ldapUserFilter(cfg, username), ldapADUserFilter(username)} {
+		sr, err := ldapSearchUsers(conn, cfg.BaseDN, filter, 1)
+		if err != nil {
+			return nil, err
+		}
+		if len(sr.Entries) > 0 {
+			return sr.Entries[0], nil
+		}
+	}
+	return nil, fmt.Errorf("LDAP用户不存在")
+}
+
 // tryLDAPAuth 尝试LDAP认证，返回用户信息
 func tryLDAPAuth(db *gorm.DB, username, password string) (*LDAPAuthInfo, error) {
 	var cfg model.LDAPConfig
@@ -71,69 +212,18 @@ func tryLDAPAuth(db *gorm.DB, username, password string) (*LDAPAuthInfo, error)
 		return nil, fmt.Errorf("LDAP管理员绑定失败: %w", err)
 	}

-	// Build search filter
-	userFilter := ""
-	baseFilter := "(objectClass=inetOrgPerson)"
-	if cfg.SearchFilter != nil && *cfg.SearchFilter != "" {
-		sf := *cfg.SearchFilter
-		if strings.Contains(sf, "%s") {
-			userFilter = strings.ReplaceAll(sf, "%s", ldap.EscapeFilter(username))
-		} else {
-			baseFilter = sf
-			userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(username))
-		}
-	} else {
-		userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(username))
-	}
-
-	// Search user
-	searchReq := ldap.NewSearchRequest(
-		cfg.BaseDN,
-		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
-		1, 10, false,
-		userFilter,
-		[]string{"uid", "cn", "mail", "telephoneNumber"},
-		nil,
-	)
-	sr, err := conn.Search(searchReq)
-	if err != nil || len(sr.Entries) == 0 {
+	entry, err := ldapSearchFirstUser(conn, &cfg, username)
+	if err != nil {
 		return nil, fmt.Errorf("LDAP用户不存在")
 	}
-	entry := sr.Entries[0]
 	userDN := entry.DN

-	// Verify password by binding as user
+	// 使用用户 DN 重新绑定以校验密码，兼容 OpenLDAP 与 AD // Logan.Li
 	if err := conn.Bind(userDN, password); err != nil {
 		return nil, fmt.Errorf("LDAP密码验证失败: %w", err)
 	}

-	// Extract user info using mapping
-	userMapping := map[string]string{
-		"username":     "uid",
-		"email":        "mail",
-		"display_name": "cn",
-	}
-	if cfg.UserMapping != nil && *cfg.UserMapping != "" {
-		json.Unmarshal([]byte(*cfg.UserMapping), &userMapping)
-	}
-
-	getAttr := func(key string) string {
-		if v := entry.GetAttributeValue(key); v != "" {
-			return v
-		}
-		return ""
-	}
-
-	info := &LDAPAuthInfo{
-		Username:    getAttr(userMapping["username"]),
-		DisplayName: getAttr(userMapping["display_name"]),
-		Email:       getAttr(userMapping["email"]),
-	}
-	if info.Username == "" {
-		info.Username = username
-	}
-
-	return info, nil
+	return ldapIdentityFromEntry(&cfg, entry, username), nil
 }

 // GetLDAPConfig 获取LDAP配置
@@ -181,17 +271,29 @@ func (h *LDAPHandler) UpdateLDAPConfig(c *gin.Context) {
 		}
 		return nil
 	}
+	hasKey := func(key string) bool {
+		_, ok := input[key]
+		return ok
+	}

 	userMappingStr := ""
 	if um, ok := input["user_mapping"]; ok {
-		if bytes, err := json.Marshal(um); err == nil {
+		if um == nil || um == "" {
+			userMappingStr = "{}"
+		} else if bytes, err := json.Marshal(um); err == nil {
 			userMappingStr = string(bytes)
 		}
 	}

+	serverType := getStr("server_type")
+	if serverType == "" {
+		serverType = ldapServerOpenLDAP
+	}
+
 	if len(configs) == 0 {
 		// Create
 		cfg := model.LDAPConfig{
+			ServerType:    serverType,
 			LDAPHost:      getStr("ldap_host"),
 			AdminDN:       getStr("admin_dn"),
 			BaseDN:        getStr("base_dn"),
@@ -216,6 +318,13 @@ func (h *LDAPHandler) UpdateLDAPConfig(c *gin.Context) {
 		// Update
 		cfg := configs[0]
 		updates := map[string]interface{}{}
+		if hasKey("server_type") {
+			st := getStr("server_type")
+			if st == "" {
+				st = ldapServerOpenLDAP
+			}
+			updates["server_type"] = st
+		}
 		if v := getStr("ldap_host"); v != "" {
 			updates["ldap_host"] = v
 		}
@@ -225,8 +334,9 @@ func (h *LDAPHandler) UpdateLDAPConfig(c *gin.Context) {
 		if v := getStr("admin_dn"); v != "" {
 			updates["admin_dn"] = v
 		}
-		if v := getStr("search_filter"); v != "" {
-			updates["search_filter"] = v
+		if hasKey("search_filter") {
+			v := strings.TrimSpace(getStr("search_filter"))
+			updates["search_filter"] = &v
 		}
 		if userMappingStr != "" {
 			updates["user_mapping"] = userMappingStr
@@ -282,36 +392,17 @@ func (h *LDAPHandler) TestLDAPConnection(c *gin.Context) {

 	// If test_user provided, search and verify
 	if req.TestUser != "" && req.TestPassword != "" {
-		userFilter := ""
-		baseFilter := "(objectClass=inetOrgPerson)"
-		if cfg.SearchFilter != nil && *cfg.SearchFilter != "" {
-			sf := *cfg.SearchFilter
-			if strings.Contains(sf, "%s") {
-				userFilter = strings.ReplaceAll(sf, "%s", ldap.EscapeFilter(req.TestUser))
-			} else {
-				baseFilter = sf
-				userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(req.TestUser))
-			}
-		} else {
-			userFilter = fmt.Sprintf("(&%s(uid=%s))", baseFilter, ldap.EscapeFilter(req.TestUser))
-		}
-
-		sr, err := conn.Search(ldap.NewSearchRequest(
-			cfg.BaseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
-			1, 10, false, userFilter,
-			[]string{"uid", "cn", "mail"},
-			nil,
-		))
-		if err != nil || len(sr.Entries) == 0 {
+		entry, err := ldapSearchFirstUser(conn, &cfg, req.TestUser)
+		if err != nil {
 			c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("用户 %s 不存在", req.TestUser)})
 			return
 		}
-		userDN := sr.Entries[0].DN
+		userDN := entry.DN
 		if err := conn.Bind(userDN, req.TestPassword); err != nil {
 			c.JSON(http.StatusOK, gin.H{"success": false, "message": fmt.Sprintf("密码验证失败: %s", err)})
 			return
 		}
-		c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{"success": true, "message": fmt.Sprintf("认证成功！用户DN: %s", userDN)}})
+		c.JSON(http.StatusOK, model.Response{Code: 200, Data: gin.H{"success": true, "message": fmt.Sprintf("认证成功！用户DN: %s", userDN), "user_info": ldapIdentityFromEntry(&cfg, entry, req.TestUser)}})
 		return
 	}