Browse Source
fix: address PR review security issues for STS handlers
fix: address PR review security issues for STS handlers
This commit addresses all critical security issues from PR review: Security Fixes: - Use crypto/rand for cryptographically secure credential generation instead of time.Now().UnixNano() (fixes predictable credentials) - Add sts:AssumeRole permission check via VerifyActionPermission to prevent unauthorized role assumption - Generate proper session tokens using crypto/rand instead of placeholder strings Code Quality Improvements: - Refactor DurationSeconds parsing into reusable parseDurationSeconds() helper function used by all three STS handlers - Create generateSecureCredentials() helper for consistent and secure temporary credential generation - Fix iamMatcher to check query string as fallback when Action not found in form data LDAP Provider Implementation: - Add go-ldap/ldap/v3 dependency - Create LDAPProvider implementing IdentityProvider interface with full LDAP authentication support (connect, bind, search, groups) - Update ProviderFactory to create real LDAP providers - Wire LDAP provider into AssumeRoleWithLDAPIdentity handler Test Infrastructure: - Add LDAP user creation verification step in setup_all_tests.shpull/8003/head
Chris Lu
1 day ago
7 changed files with 622 additions and 102 deletions
-
2go.mod
-
4go.sum
-
8test/s3/iam/setup_all_tests.sh
-
428weed/iam/ldap/ldap_provider.go
-
8weed/iam/sts/provider_factory.go
-
20weed/s3api/s3api_server.go
-
254weed/s3api/s3api_sts.go
@ -0,0 +1,428 @@ |
|||
package ldap |
|||
|
|||
import ( |
|||
"context" |
|||
"crypto/tls" |
|||
"fmt" |
|||
"strings" |
|||
"sync" |
|||
"time" |
|||
|
|||
"github.com/go-ldap/ldap/v3" |
|||
"github.com/seaweedfs/seaweedfs/weed/glog" |
|||
"github.com/seaweedfs/seaweedfs/weed/iam/providers" |
|||
) |
|||
|
|||
// LDAPConfig holds configuration for LDAP provider
|
|||
type LDAPConfig struct { |
|||
// Server is the LDAP server URL (ldap:// or ldaps://)
|
|||
Server string `json:"server"` |
|||
|
|||
// BindDN is the DN used to bind for searches (optional for anonymous bind)
|
|||
BindDN string `json:"bindDN,omitempty"` |
|||
|
|||
// BindPassword is the password for the bind DN
|
|||
BindPassword string `json:"bindPassword,omitempty"` |
|||
|
|||
// BaseDN is the base DN for user searches
|
|||
BaseDN string `json:"baseDN"` |
|||
|
|||
// UserFilter is the filter to find users (use %s for username placeholder)
|
|||
// Example: "(uid=%s)" or "(cn=%s)" or "(&(objectClass=person)(uid=%s))"
|
|||
UserFilter string `json:"userFilter"` |
|||
|
|||
// GroupFilter is the filter to find user groups (use %s for user DN placeholder)
|
|||
// Example: "(member=%s)" or "(memberUid=%s)"
|
|||
GroupFilter string `json:"groupFilter,omitempty"` |
|||
|
|||
// GroupBaseDN is the base DN for group searches (defaults to BaseDN)
|
|||
GroupBaseDN string `json:"groupBaseDN,omitempty"` |
|||
|
|||
// Attributes to retrieve from LDAP
|
|||
Attributes LDAPAttributes `json:"attributes,omitempty"` |
|||
|
|||
// UseTLS enables StartTLS
|
|||
UseTLS bool `json:"useTLS,omitempty"` |
|||
|
|||
// InsecureSkipVerify skips TLS certificate verification
|
|||
InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"` |
|||
|
|||
// ConnectionTimeout is the connection timeout
|
|||
ConnectionTimeout time.Duration `json:"connectionTimeout,omitempty"` |
|||
} |
|||
|
|||
// LDAPAttributes maps LDAP attribute names
|
|||
type LDAPAttributes struct { |
|||
Email string `json:"email,omitempty"` // Default: mail
|
|||
DisplayName string `json:"displayName,omitempty"` // Default: cn
|
|||
Groups string `json:"groups,omitempty"` // Default: memberOf
|
|||
UID string `json:"uid,omitempty"` // Default: uid
|
|||
} |
|||
|
|||
// LDAPProvider implements the IdentityProvider interface for LDAP
|
|||
type LDAPProvider struct { |
|||
name string |
|||
config *LDAPConfig |
|||
initialized bool |
|||
mu sync.RWMutex |
|||
} |
|||
|
|||
// NewLDAPProvider creates a new LDAP provider
|
|||
func NewLDAPProvider(name string) *LDAPProvider { |
|||
return &LDAPProvider{ |
|||
name: name, |
|||
} |
|||
} |
|||
|
|||
// Name returns the provider name
|
|||
func (p *LDAPProvider) Name() string { |
|||
return p.name |
|||
} |
|||
|
|||
// Initialize initializes the provider with configuration
|
|||
func (p *LDAPProvider) Initialize(config interface{}) error { |
|||
p.mu.Lock() |
|||
defer p.mu.Unlock() |
|||
|
|||
cfg, ok := config.(*LDAPConfig) |
|||
if !ok { |
|||
// Try to convert from map
|
|||
if cfgMap, ok := config.(map[string]interface{}); ok { |
|||
cfg = &LDAPConfig{} |
|||
if v, ok := cfgMap["server"].(string); ok { |
|||
cfg.Server = v |
|||
} |
|||
if v, ok := cfgMap["bindDN"].(string); ok { |
|||
cfg.BindDN = v |
|||
} |
|||
if v, ok := cfgMap["bindPassword"].(string); ok { |
|||
cfg.BindPassword = v |
|||
} |
|||
if v, ok := cfgMap["baseDN"].(string); ok { |
|||
cfg.BaseDN = v |
|||
} |
|||
if v, ok := cfgMap["userFilter"].(string); ok { |
|||
cfg.UserFilter = v |
|||
} |
|||
if v, ok := cfgMap["groupFilter"].(string); ok { |
|||
cfg.GroupFilter = v |
|||
} |
|||
if v, ok := cfgMap["groupBaseDN"].(string); ok { |
|||
cfg.GroupBaseDN = v |
|||
} |
|||
if v, ok := cfgMap["useTLS"].(bool); ok { |
|||
cfg.UseTLS = v |
|||
} |
|||
if v, ok := cfgMap["insecureSkipVerify"].(bool); ok { |
|||
cfg.InsecureSkipVerify = v |
|||
} |
|||
// Parse attributes
|
|||
if attrs, ok := cfgMap["attributes"].(map[string]interface{}); ok { |
|||
if v, ok := attrs["email"].(string); ok { |
|||
cfg.Attributes.Email = v |
|||
} |
|||
if v, ok := attrs["displayName"].(string); ok { |
|||
cfg.Attributes.DisplayName = v |
|||
} |
|||
if v, ok := attrs["groups"].(string); ok { |
|||
cfg.Attributes.Groups = v |
|||
} |
|||
if v, ok := attrs["uid"].(string); ok { |
|||
cfg.Attributes.UID = v |
|||
} |
|||
} |
|||
} else { |
|||
return fmt.Errorf("invalid LDAP configuration type: %T", config) |
|||
} |
|||
} |
|||
|
|||
// Validate required fields
|
|||
if cfg.Server == "" { |
|||
return fmt.Errorf("LDAP server URL is required") |
|||
} |
|||
if cfg.BaseDN == "" { |
|||
return fmt.Errorf("LDAP base DN is required") |
|||
} |
|||
if cfg.UserFilter == "" { |
|||
cfg.UserFilter = "(cn=%s)" // Default filter
|
|||
} |
|||
|
|||
// Set default attributes
|
|||
if cfg.Attributes.Email == "" { |
|||
cfg.Attributes.Email = "mail" |
|||
} |
|||
if cfg.Attributes.DisplayName == "" { |
|||
cfg.Attributes.DisplayName = "cn" |
|||
} |
|||
if cfg.Attributes.Groups == "" { |
|||
cfg.Attributes.Groups = "memberOf" |
|||
} |
|||
if cfg.Attributes.UID == "" { |
|||
cfg.Attributes.UID = "uid" |
|||
} |
|||
if cfg.GroupBaseDN == "" { |
|||
cfg.GroupBaseDN = cfg.BaseDN |
|||
} |
|||
if cfg.ConnectionTimeout == 0 { |
|||
cfg.ConnectionTimeout = 10 * time.Second |
|||
} |
|||
|
|||
p.config = cfg |
|||
p.initialized = true |
|||
|
|||
glog.V(1).Infof("LDAP provider '%s' initialized: server=%s, baseDN=%s", |
|||
p.name, cfg.Server, cfg.BaseDN) |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// connect establishes a connection to the LDAP server
|
|||
func (p *LDAPProvider) connect() (*ldap.Conn, error) { |
|||
var conn *ldap.Conn |
|||
var err error |
|||
|
|||
// Parse server URL
|
|||
if strings.HasPrefix(p.config.Server, "ldaps://") { |
|||
// LDAPS connection
|
|||
tlsConfig := &tls.Config{ |
|||
InsecureSkipVerify: p.config.InsecureSkipVerify, |
|||
} |
|||
conn, err = ldap.DialURL(p.config.Server, ldap.DialWithTLSConfig(tlsConfig)) |
|||
} else { |
|||
// LDAP connection
|
|||
conn, err = ldap.DialURL(p.config.Server) |
|||
if err == nil && p.config.UseTLS { |
|||
// StartTLS
|
|||
tlsConfig := &tls.Config{ |
|||
InsecureSkipVerify: p.config.InsecureSkipVerify, |
|||
} |
|||
err = conn.StartTLS(tlsConfig) |
|||
} |
|||
} |
|||
|
|||
if err != nil { |
|||
return nil, fmt.Errorf("failed to connect to LDAP server: %w", err) |
|||
} |
|||
|
|||
return conn, nil |
|||
} |
|||
|
|||
// Authenticate authenticates a user with username:password credentials
|
|||
func (p *LDAPProvider) Authenticate(ctx context.Context, credentials string) (*providers.ExternalIdentity, error) { |
|||
p.mu.RLock() |
|||
if !p.initialized { |
|||
p.mu.RUnlock() |
|||
return nil, fmt.Errorf("LDAP provider not initialized") |
|||
} |
|||
config := p.config |
|||
p.mu.RUnlock() |
|||
|
|||
// Parse credentials (username:password format)
|
|||
parts := strings.SplitN(credentials, ":", 2) |
|||
if len(parts) != 2 { |
|||
return nil, fmt.Errorf("invalid credentials format (expected username:password)") |
|||
} |
|||
username, password := parts[0], parts[1] |
|||
|
|||
if username == "" || password == "" { |
|||
return nil, fmt.Errorf("username and password are required") |
|||
} |
|||
|
|||
// Connect to LDAP
|
|||
conn, err := p.connect() |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
defer conn.Close() |
|||
|
|||
// First, bind with service account to search for user
|
|||
if config.BindDN != "" { |
|||
err = conn.Bind(config.BindDN, config.BindPassword) |
|||
if err != nil { |
|||
glog.V(2).Infof("LDAP service bind failed: %v", err) |
|||
return nil, fmt.Errorf("LDAP service bind failed: %w", err) |
|||
} |
|||
} |
|||
|
|||
// Search for the user
|
|||
userFilter := fmt.Sprintf(config.UserFilter, ldap.EscapeFilter(username)) |
|||
searchRequest := ldap.NewSearchRequest( |
|||
config.BaseDN, |
|||
ldap.ScopeWholeSubtree, |
|||
ldap.NeverDerefAliases, |
|||
1, // Size limit
|
|||
int(config.ConnectionTimeout.Seconds()), |
|||
false, |
|||
userFilter, |
|||
[]string{"dn", config.Attributes.Email, config.Attributes.DisplayName, config.Attributes.UID, config.Attributes.Groups}, |
|||
nil, |
|||
) |
|||
|
|||
result, err := conn.Search(searchRequest) |
|||
if err != nil { |
|||
glog.V(2).Infof("LDAP user search failed: %v", err) |
|||
return nil, fmt.Errorf("LDAP user search failed: %w", err) |
|||
} |
|||
|
|||
if len(result.Entries) == 0 { |
|||
return nil, fmt.Errorf("user not found") |
|||
} |
|||
if len(result.Entries) > 1 { |
|||
return nil, fmt.Errorf("multiple users found") |
|||
} |
|||
|
|||
userEntry := result.Entries[0] |
|||
userDN := userEntry.DN |
|||
|
|||
// Bind as the user to verify password
|
|||
err = conn.Bind(userDN, password) |
|||
if err != nil { |
|||
glog.V(2).Infof("LDAP user bind failed for %s: %v", username, err) |
|||
return nil, fmt.Errorf("authentication failed: invalid credentials") |
|||
} |
|||
|
|||
// Build identity from LDAP attributes
|
|||
identity := &providers.ExternalIdentity{ |
|||
UserID: username, |
|||
Email: userEntry.GetAttributeValue(config.Attributes.Email), |
|||
DisplayName: userEntry.GetAttributeValue(config.Attributes.DisplayName), |
|||
Groups: userEntry.GetAttributeValues(config.Attributes.Groups), |
|||
Provider: p.name, |
|||
Attributes: map[string]string{ |
|||
"dn": userDN, |
|||
"uid": userEntry.GetAttributeValue(config.Attributes.UID), |
|||
}, |
|||
} |
|||
|
|||
// If no groups from memberOf, try group search
|
|||
if len(identity.Groups) == 0 && config.GroupFilter != "" { |
|||
groups, err := p.searchUserGroups(conn, userDN, config) |
|||
if err != nil { |
|||
glog.V(2).Infof("Group search failed for %s: %v", username, err) |
|||
} else { |
|||
identity.Groups = groups |
|||
} |
|||
} |
|||
|
|||
glog.V(2).Infof("LDAP authentication successful for user: %s, groups: %v", username, identity.Groups) |
|||
return identity, nil |
|||
} |
|||
|
|||
// searchUserGroups searches for groups the user belongs to
|
|||
func (p *LDAPProvider) searchUserGroups(conn *ldap.Conn, userDN string, config *LDAPConfig) ([]string, error) { |
|||
groupFilter := fmt.Sprintf(config.GroupFilter, ldap.EscapeFilter(userDN)) |
|||
searchRequest := ldap.NewSearchRequest( |
|||
config.GroupBaseDN, |
|||
ldap.ScopeWholeSubtree, |
|||
ldap.NeverDerefAliases, |
|||
0, |
|||
int(config.ConnectionTimeout.Seconds()), |
|||
false, |
|||
groupFilter, |
|||
[]string{"cn", "dn"}, |
|||
nil, |
|||
) |
|||
|
|||
result, err := conn.Search(searchRequest) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
var groups []string |
|||
for _, entry := range result.Entries { |
|||
cn := entry.GetAttributeValue("cn") |
|||
if cn != "" { |
|||
groups = append(groups, cn) |
|||
} |
|||
} |
|||
|
|||
return groups, nil |
|||
} |
|||
|
|||
// GetUserInfo retrieves user information by user ID
|
|||
func (p *LDAPProvider) GetUserInfo(ctx context.Context, userID string) (*providers.ExternalIdentity, error) { |
|||
p.mu.RLock() |
|||
if !p.initialized { |
|||
p.mu.RUnlock() |
|||
return nil, fmt.Errorf("LDAP provider not initialized") |
|||
} |
|||
config := p.config |
|||
p.mu.RUnlock() |
|||
|
|||
// Connect to LDAP
|
|||
conn, err := p.connect() |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
defer conn.Close() |
|||
|
|||
// Bind with service account
|
|||
if config.BindDN != "" { |
|||
err = conn.Bind(config.BindDN, config.BindPassword) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("LDAP service bind failed: %w", err) |
|||
} |
|||
} |
|||
|
|||
// Search for the user
|
|||
userFilter := fmt.Sprintf(config.UserFilter, ldap.EscapeFilter(userID)) |
|||
searchRequest := ldap.NewSearchRequest( |
|||
config.BaseDN, |
|||
ldap.ScopeWholeSubtree, |
|||
ldap.NeverDerefAliases, |
|||
1, |
|||
int(config.ConnectionTimeout.Seconds()), |
|||
false, |
|||
userFilter, |
|||
[]string{"dn", config.Attributes.Email, config.Attributes.DisplayName, config.Attributes.UID, config.Attributes.Groups}, |
|||
nil, |
|||
) |
|||
|
|||
result, err := conn.Search(searchRequest) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("LDAP user search failed: %w", err) |
|||
} |
|||
|
|||
if len(result.Entries) == 0 { |
|||
return nil, fmt.Errorf("user not found") |
|||
} |
|||
|
|||
userEntry := result.Entries[0] |
|||
return &providers.ExternalIdentity{ |
|||
UserID: userID, |
|||
Email: userEntry.GetAttributeValue(config.Attributes.Email), |
|||
DisplayName: userEntry.GetAttributeValue(config.Attributes.DisplayName), |
|||
Groups: userEntry.GetAttributeValues(config.Attributes.Groups), |
|||
Provider: p.name, |
|||
Attributes: map[string]string{ |
|||
"dn": userEntry.DN, |
|||
"uid": userEntry.GetAttributeValue(config.Attributes.UID), |
|||
}, |
|||
}, nil |
|||
} |
|||
|
|||
// ValidateToken validates credentials (username:password format) and returns claims
|
|||
func (p *LDAPProvider) ValidateToken(ctx context.Context, token string) (*providers.TokenClaims, error) { |
|||
identity, err := p.Authenticate(ctx, token) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
return &providers.TokenClaims{ |
|||
Subject: identity.UserID, |
|||
Claims: map[string]interface{}{ |
|||
"email": identity.Email, |
|||
"name": identity.DisplayName, |
|||
"groups": identity.Groups, |
|||
"dn": identity.Attributes["dn"], |
|||
"provider": p.name, |
|||
}, |
|||
}, nil |
|||
} |
|||
|
|||
// IsInitialized returns whether the provider is initialized
|
|||
func (p *LDAPProvider) IsInitialized() bool { |
|||
p.mu.RLock() |
|||
defer p.mu.RUnlock() |
|||
return p.initialized |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue