Logan
78c27037e3
- 新增 ldap_ad.go，支持 AD 密码编码、字段映射与目录类型判断 - 重构 ldap/ldap_users/ldap_ou，兼容 OpenLDAP 与 AD 登录、导入、OU 浏览 - 前端系统设置增加目录类型选择与 AD 配置项 - Dockerfile 按 TARGETARCH 单架构编译 Agent，限制 Node 内存防 OOM - run.sh 新增 docker fast/upgrade，README 补充 LDAP/AD 与常见问题
117 lines
3.2 KiB
Go
117 lines
3.2 KiB
Go
package controller
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"ezops/model"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/go-ldap/ldap/v3"
|
|
)
|
|
|
|
// ListLDAPOUs 列出 LDAP 组织单元
|
|
// POST /api/v1/admin/ldap-config/ou-list
|
|
func (h *LDAPHandler) ListLDAPOUs(c *gin.Context) {
|
|
var configs []model.LDAPConfig
|
|
if err := h.db.Order("id").Find(&configs).Error; err != nil || len(configs) == 0 {
|
|
c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
|
|
return
|
|
}
|
|
cfg := configs[0]
|
|
|
|
conn, err := dialLDAP(&cfg)
|
|
if err != nil {
|
|
c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
|
|
return
|
|
}
|
|
defer conn.Close()
|
|
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
|
c.JSON(http.StatusOK, model.Response{Code: 200, Data: []interface{}{}})
|
|
return
|
|
}
|
|
|
|
type OU struct {
|
|
DN string `json:"dn"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description"`
|
|
}
|
|
var ous []OU
|
|
seenDN := map[string]bool{}
|
|
for _, filter := range ldapOUListFilters(&cfg) {
|
|
searchReq := ldap.NewSearchRequest(
|
|
cfg.BaseDN,
|
|
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
|
|
filter,
|
|
[]string{"ou", "cn", "name", "description"},
|
|
nil,
|
|
)
|
|
sr, err := conn.Search(searchReq)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
for _, e := range sr.Entries {
|
|
if seenDN[e.DN] {
|
|
continue
|
|
}
|
|
seenDN[e.DN] = true
|
|
ous = append(ous, OU{
|
|
DN: e.DN,
|
|
Name: ldapOUEntryName(e),
|
|
Description: e.GetAttributeValue("description"),
|
|
})
|
|
}
|
|
}
|
|
c.JSON(http.StatusOK, model.Response{Code: 200, Data: ous})
|
|
}
|
|
|
|
// CreateLDAPOU 创建组织单元
|
|
// POST /api/v1/admin/ldap-config/create-ou
|
|
func (h *LDAPHandler) CreateLDAPOU(c *gin.Context) {
|
|
var req struct {
|
|
OUName string `json:"ou_name"`
|
|
ParentDN string `json:"parent_dn"`
|
|
Description string `json:"description"`
|
|
}
|
|
if err := c.ShouldBindJSON(&req); err != nil {
|
|
c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: err.Error()})
|
|
return
|
|
}
|
|
|
|
var configs []model.LDAPConfig
|
|
if err := h.db.Order("id").Find(&configs).Error; err != nil || len(configs) == 0 {
|
|
c.JSON(http.StatusBadRequest, model.Response{Code: 400, Message: "LDAP未配置"})
|
|
return
|
|
}
|
|
cfg := configs[0]
|
|
|
|
if req.ParentDN == "" {
|
|
req.ParentDN = cfg.BaseDN
|
|
}
|
|
ouDN := fmt.Sprintf("ou=%s,%s", ldap.EscapeFilter(req.OUName), req.ParentDN)
|
|
|
|
conn, err := dialLDAP(&cfg)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "LDAP连接失败: " + err.Error()})
|
|
return
|
|
}
|
|
defer conn.Close()
|
|
if err := conn.Bind(cfg.AdminDN, cfg.AdminPassword); err != nil {
|
|
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "管理员认证失败: " + err.Error()})
|
|
return
|
|
}
|
|
|
|
addReq := ldap.NewAddRequest(ouDN, nil)
|
|
addReq.Attribute("objectClass", []string{"organizationalUnit", "top"})
|
|
addReq.Attribute("ou", []string{req.OUName})
|
|
if req.Description != "" {
|
|
addReq.Attribute("description", []string{req.Description})
|
|
}
|
|
if err := conn.Add(addReq); err != nil {
|
|
c.JSON(http.StatusInternalServerError, model.Response{Code: 500, Message: "创建OU失败: " + err.Error()})
|
|
return
|
|
}
|
|
|
|
c.JSON(http.StatusOK, model.Response{Code: 200, Message: "OU创建成功", Data: gin.H{"dn": ouDN}})
|
|
}
|