LDAP Authentication

go.mod

@@ -42,6 +42,7 @@ require (
 	github.com/PuerkitoBio/goquery v1.8.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/go-ldap/ldap v3.0.3+incompatible // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/swag v0.21.1 // indirect
 	github.com/gorilla/context v1.1.1 // indirect
@@ -66,6 +67,7 @@ require (
 	golang.org/x/image v0.5.0 // indirect
 	golang.org/x/sys v0.5.0 // indirect
 	golang.org/x/text v0.7.0 // indirect
+	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

go.sum

@@ -34,6 +34,8 @@ github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBd
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/go-ldap/ldap v3.0.3+incompatible h1:HTeSZO8hWMS1Rgb2Ziku6b8a7qRIZZMHjsvuZyatzwk=
+github.com/go-ldap/ldap v3.0.3+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
@@ -207,6 +209,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d h1:TxyelI5cVkbREznMhfzycHdkp5cLA7DpE+GKjSslYhM=
+gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=

server/ctrladmin/adminui/pages/home.tmpl

@@ -35,7 +35,9 @@
         {{ end }}
     {{ end }}
     {{ if .User.IsAdmin }}
-        <div class="col-span-full">{{ component "link" (props . "To" (path "/admin/create_user")) }}create new{{ end }}</div>
+				<div class="col-span-full">{{ component "link" (props . "To" (path 
+				"/admin/create_user")) }}create new{{ end }} {{component "link" 
+				(props . "To" (path "/admin/ldap")) }}LDAP{{ end }}</div>
     {{ end }}
 </div>
 {{ end }}

server/ctrladmin/adminui/pages/ldap.tmpl

@@ -0,0 +1,68 @@
+{{ component "layout" . }}
+{{ component "layout_user" . }}
+
+{{ component "block" (props .
+    "Icon" "user"
+		"Name" "configuring LDAP"
+) }}
+		<form class="flex flex-col gap-2 items-end" action="{{ path 
+		"/admin/ldap_do" }}" method="post">
+				<p>Leave the server empty to disable LDAP.</p>
+				<input
+					type="username"
+					id="bind_user"
+					name="bind_user"
+					placeholder="bind username"
+					value={{ default "" .CurrentBindUID }}
+				>
+				<input
+					type="password"
+					id="bind_user_password"
+					name="bind_user_password"
+					placeholder="bind password"
+				>
+
+				<input
+					type="text"
+					id="fqdn"
+					name="fqdn"
+					placeholder="LDAP server"
+					value={{ default "" .CurrentFQDN }}
+				>
+
+				<input
+					type="number"
+					id="port"
+					name="port"
+					placeholder="port"
+					value={{ default "389" .CurrentPort }}
+				>
+
+				<select name="tls" id="tls">
+					<option value="true">TLS</option>
+					<option value="false" {{ .CurrentNoTLS }}>None</option>
+				</select>
+
+				<input
+					type="text"
+					id="base_dn"
+					name="base_dn"
+					placeholder="Base DN"
+					value={{ default "" .CurrentBaseDN }}
+				>
+
+				<input
+					type="text"
+					id="filter"
+					name="filter"
+					placeholder="filter"
+					value={{ default "" .CurrentFilter }}
+				>
+
+
+				<input type="submit" value="update">
+    </form>
+{{ end }}
+
+{{ end }}
+{{ end }}

server/ctrladmin/ctrl.go

@@ -129,6 +129,13 @@ type templateData struct {
 	Podcasts              []*db.Podcast
 	InternetRadioStations []*db.InternetRadioStation
 
+	CurrentBindUID		string
+	CurrentFQDN				string
+	CurrentPort				string
+	CurrentNoTLS			string
+	CurrentBaseDN			string
+	CurrentFilter			string
+
 	// avatar
 	Avatar []byte
 }

server/ctrladmin/handlers.go

@@ -157,6 +157,125 @@ func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
 	return &Response{redirect: "/admin/home"}
 }
 
+func (c *Controller) ServeLDAPConfig(_ *http.Request) *Response {
+	data := &templateData{}
+
+	data.CurrentBindUID, _ = c.DB.GetSetting("ldap_bind_user")
+	data.CurrentFQDN, _ = c.DB.GetSetting("ldap_fqdn")
+	data.CurrentPort, _ = c.DB.GetSetting("ldap_port")
+	data.CurrentBaseDN, _ = c.DB.GetSetting("ldap_base_dn")
+	data.CurrentFilter, _ = c.DB.GetSetting("ldap_filter")
+
+	// This is to fix the fact that select boxes are strange.
+	currentTLS, _ := c.DB.GetSetting("ldap_tls")
+	data.CurrentNoTLS = "selected"
+
+	if currentTLS == "true" {
+		data.CurrentNoTLS = ""
+	}
+
+	return &Response{
+		template: "ldap.tmpl",
+		data: data,
+	}
+}
+
+func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
+	bindUID := r.FormValue("bind_user")
+	bindPSWD := r.FormValue("bind_user_password") // TODO: Secure this better.
+	fqdn := r.FormValue("fqdn")
+	port := r.FormValue("port")
+	tls := r.FormValue("tls")
+	baseDN := r.FormValue("base_dn")
+	filter := r.FormValue("filter")
+
+	if bindUID == "" || bindPSWD == ""|| port == "" || baseDN == "" || filter == "" {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"please provide a bind username and password, port, base CN, and filter"},
+		}
+	}
+
+	err := c.DB.SetSetting("ldap_bind_user", bindUID)
+	if err != nil {
+		log.Println("Failed to set bind user:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set bind user."},
+		}
+	}
+
+  err = c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+	if err != nil {
+		log.Println("Failed to set bind user password:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set bind user password."},
+		}
+	}	
+
+  err = c.DB.SetSetting("ldap_fqdn", fqdn)
+	if err != nil {
+		log.Println("Failed to set server:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set server."},
+		}
+	}
+
+  err = c.DB.SetSetting("ldap_port", port)
+	if err != nil {
+		log.Println("Failed to set port:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set port."},
+		}
+	}
+
+  err = c.DB.SetSetting("ldap_tls", tls)
+	if err != nil {
+		log.Println("Failed to set TLS:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set TLS."},
+		}
+	}
+
+  err = c.DB.SetSetting("ldap_base_dn", baseDN)
+	if err != nil {
+		log.Println("Failed to set base DN:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set base DN."},
+		}
+	}
+
+  err = c.DB.SetSetting("ldap_filter", filter)
+	if err != nil {
+		log.Println("Failed to set filter:", err)
+
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set filter."},
+		}
+	}
+
+	if fqdn == "" {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{"LDAP server was left empty, LDAP authentication will be disabled."},
+		}
+	}
+
+	return &Response{redirect: "/admin/home"}
+}
+
 func (c *Controller) ServeChangeUsername(r *http.Request) *Response {
 	user, err := selectedUserIfAdmin(c, r)
 	if err != nil {