feat(ldap): Active Directory 双目录支持与 Docker 构建优化
- 新增 ldap_ad.go，支持 AD 密码编码、字段映射与目录类型判断 - 重构 ldap/ldap_users/ldap_ou，兼容 OpenLDAP 与 AD 登录、导入、OU 浏览 - 前端系统设置增加目录类型选择与 AD 配置项 - Dockerfile 按 TARGETARCH 单架构编译 Agent，限制 Node 内存防 OOM - run.sh 新增 docker fast/upgrade，README 补充 LDAP/AD 与常见问题
This commit is contained in:
Logan committed
1 parent
0f0f2770e1
commit
78c27037e3
12 files changed
+613
-226
No files matched your search
@@ -1,11 +1,8 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"ezops/model"
|
||||
|
||||
@@ -24,18 +21,18 @@ func (h *LDAPHandler) ListLDAPUsers(c *gin.Context) {
|
||||
|
||||
var cfg model.LDAPConfig
|
||||
if err := h.db.Order("id").First(&cfg).Error; err != nil {
|
||||
c.JSON(http.StatusOK, []interface{}{})
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
|
||||
return
|
||||
}
|
||||
|
||||
conn, err := dialLDAP(&cfg)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusOK, []interface{}{})
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
|
||||
return
|
||||
}
|
||||
defer conn.Close()
|
||||
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
||||
c.JSON(http.StatusOK, []interface{}{})
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
|
||||
return
|
||||
}
|
||||
|
||||
@@ -44,30 +41,10 @@ func (h *LDAPHandler) ListLDAPUsers(c *gin.Context) {
|
||||
searchBase = req.OuDn
|
||||
}
|
||||
|
||||
baseFilter := "(objectClass=inetOrgPerson)"
|
||||
if cfg.SearchFilter != nil && *cfg.SearchFilter != "" {
|
||||
sf := *cfg.SearchFilter
|
||||
if strings.Contains(sf, "%s") {
|
||||
baseFilter = strings.ReplaceAll(sf, "%s", "*")
|
||||
} else {
|
||||
baseFilter = sf
|
||||
}
|
||||
}
|
||||
|
||||
sr, err := conn.Search(ldap.NewSearchRequest(
|
||||
searchBase, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,
|
||||
200, 0, false, baseFilter,
|
||||
[]string{"uid", "cn", "mail", "dn", "telephoneNumber", "title", "department"},
|
||||
nil,
|
||||
))
|
||||
if err != nil {
|
||||
c.JSON(http.StatusOK, []interface{}{})
|
||||
return
|
||||
}
|
||||
|
||||
type LdapUser struct {
|
||||
DN string `json:"dn"`
|
||||
UID string `json:"uid"`
|
||||
Username string `json:"username"`
|
||||
CN string `json:"cn"`
|
||||
Mail string `json:"mail"`
|
||||
Phone string `json:"phone"`
|
||||
@@ -75,16 +52,32 @@ func (h *LDAPHandler) ListLDAPUsers(c *gin.Context) {
|
||||
Department string `json:"department"`
|
||||
}
|
||||
var users []LdapUser
|
||||
for _, e := range sr.Entries {
|
||||
users = append(users, LdapUser{
|
||||
DN: e.DN,
|
||||
UID: e.GetAttributeValue("uid"),
|
||||
CN: e.GetAttributeValue("cn"),
|
||||
Mail: e.GetAttributeValue("mail"),
|
||||
Phone: e.GetAttributeValue("telephoneNumber"),
|
||||
Title: e.GetAttributeValue("title"),
|
||||
Department: e.GetAttributeValue("department"),
|
||||
})
|
||||
seenDNs := map[string]bool{}
|
||||
for _, filter := range ldapUserListFilters(&cfg) {
|
||||
sr, err := ldapSearchUsers(conn, searchBase, filter, 500)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
for _, e := range sr.Entries {
|
||||
if seenDNs[e.DN] {
|
||||
continue
|
||||
}
|
||||
info := ldapIdentityFromEntry(&cfg, e, "")
|
||||
if info.Username == "" {
|
||||
continue
|
||||
}
|
||||
seenDNs[e.DN] = true
|
||||
users = append(users, LdapUser{
|
||||
DN: e.DN,
|
||||
UID: info.Username,
|
||||
Username: info.Username,
|
||||
CN: info.DisplayName,
|
||||
Mail: info.Email,
|
||||
Phone: ldapEntryAttr(e, "telephoneNumber", "mobile"),
|
||||
Title: ldapEntryAttr(e, "title"),
|
||||
Department: ldapEntryAttr(e, "department"),
|
||||
})
|
||||
}
|
||||
}
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Data: users})
|
||||
}
|
||||
@@ -195,54 +188,40 @@ func (h *LDAPHandler) CreateLDAPUser(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
cfg := configs[0]
|
||||
port := 389
|
||||
if cfg.LDAPPort != nil {
|
||||
port = *cfg.LDAPPort
|
||||
}
|
||||
if req.OUDN == "" {
|
||||
req.OUDN = cfg.BaseDN
|
||||
}
|
||||
userDN := fmt.Sprintf("uid=%s,%s", ldap.EscapeFilter(req.Username), req.OUDN)
|
||||
|
||||
// Parse user mapping
|
||||
mapping := map[string]string{"username": "uid", "email": "mail", "display_name": "cn"}
|
||||
if cfg.UserMapping != nil {
|
||||
_ = json.Unmarshal([]byte(*cfg.UserMapping), &mapping)
|
||||
userDN, err := ldapBuildUserDN(&cfg, req.Username, req.DisplayName, req.OUDN)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
|
||||
return
|
||||
}
|
||||
if ldapIsAD(&cfg) && (cfg.UseLDAPS == nil || !*cfg.UseLDAPS) {
|
||||
c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "Active Directory 创建用户需启用 LDAPS"})
|
||||
return
|
||||
}
|
||||
|
||||
uidAttr := mapping["username"]
|
||||
if uidAttr == "" {
|
||||
uidAttr = "uid"
|
||||
}
|
||||
mailAttr := mapping["email"]
|
||||
if mailAttr == "" {
|
||||
mailAttr = "mail"
|
||||
}
|
||||
|
||||
conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
|
||||
conn, err := dialLDAP(&cfg)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
defer conn.Close()
|
||||
conn.SetTimeout(5 * time.Second)
|
||||
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
addReq := ldap.NewAddRequest(userDN, nil)
|
||||
addReq.Attribute("objectClass", []string{"inetOrgPerson", "organizationalPerson", "person", "top"})
|
||||
addReq.Attribute(uidAttr, []string{req.Username})
|
||||
addReq.Attribute("cn", []string{req.DisplayName})
|
||||
addReq.Attribute("sn", []string{req.DisplayName})
|
||||
if req.Email != "" {
|
||||
addReq.Attribute(mailAttr, []string{req.Email})
|
||||
}
|
||||
addReq.Attribute("userPassword", []string{req.Password})
|
||||
if err := conn.Add(addReq); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建用户失败: " + err.Error()})
|
||||
return
|
||||
if ldapIsAD(&cfg) {
|
||||
if err := ldapAddADUser(conn, userDN, req.Username, req.DisplayName, req.Email, req.Password); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建 AD 用户失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
} else {
|
||||
if err := ldapAddOpenLDAPUser(conn, &cfg, userDN, req.Username, req.DisplayName, req.Email, req.Password); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建用户失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, model.Response{Code: 200, Message: "用户创建成功", Data: gin.H{"dn": userDN}})
|
||||
@@ -265,18 +244,13 @@ func (h *LDAPHandler) DeleteLDAPUser(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
cfg := configs[0]
|
||||
port := 389
|
||||
if cfg.LDAPPort != nil {
|
||||
port = *cfg.LDAPPort
|
||||
}
|
||||
|
||||
conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
|
||||
conn, err := dialLDAP(&cfg)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
defer conn.Close()
|
||||
conn.SetTimeout(5 * time.Second)
|
||||
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
|
||||
return
|
||||
@@ -312,28 +286,23 @@ func (h *LDAPHandler) UpdateLDAPUser(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
cfg := configs[0]
|
||||
port := 389
|
||||
if cfg.LDAPPort != nil {
|
||||
port = *cfg.LDAPPort
|
||||
}
|
||||
|
||||
conn, err := ldap.DialURL(fmt.Sprintf("ldap://%s:%d", cfg.LDAPHost, port))
|
||||
conn, err := dialLDAP(&cfg)
|
||||
if err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
defer conn.Close()
|
||||
conn.SetTimeout(5 * time.Second)
|
||||
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
||||
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
|
||||
return
|
||||
}
|
||||
|
||||
// 先查当前值，做 diff
|
||||
// 先查当前值，做 diff（AD 同时读取 displayName） // Logan.Li
|
||||
sr, err := conn.Search(ldap.NewSearchRequest(
|
||||
req.DN, ldap.ScopeBaseObject, ldap.NeverDerefAliases,
|
||||
1, 0, false, "(objectClass=*)",
|
||||
[]string{"cn", "mail", "telephoneNumber", "title"},
|
||||
[]string{"cn", "displayName", "mail", "telephoneNumber", "title"},
|
||||
nil,
|
||||
))
|
||||
if err != nil || len(sr.Entries) == 0 {
|
||||
@@ -343,10 +312,13 @@ func (h *LDAPHandler) UpdateLDAPUser(c *gin.Context) {
|
||||
entry := sr.Entries[0]
|
||||
|
||||
modReq := ldap.NewModifyRequest(req.DN, nil)
|
||||
// cn
|
||||
oldCN := entry.GetAttributeValue("cn")
|
||||
// cn / displayName（AD 优先 displayName） // Logan.Li
|
||||
oldCN := ldapEntryAttr(entry, "displayName", "cn")
|
||||
if req.CN != "" && req.CN != oldCN {
|
||||
modReq.Replace("cn", []string{req.CN})
|
||||
if ldapIsAD(&cfg) {
|
||||
modReq.Replace("displayName", []string{req.CN})
|
||||
}
|
||||
modReq.Replace("sn", []string{req.CN}) // sn 同步更新
|
||||
}
|
||||
// mail
|
||||
|
||||
Reference in new issue
Block a user