k-space/dex
Archived
10
0
Fork 0
Code Issues Pull Requests Packages Projects Activity

Merge pull request #2026 from flant/ldap-groups-user-matcher-warning

Browse Source 
chore: warning about deprecated LDAP groupSearch fields
This commit is contained in:
Maksim Nabokikh 2021-12-11 13:26:30 +04:00 committed by GitHub
commit 9d3471e39b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
connector/ldap/ldap.go
View File

@ -187,11 +187,12 @@ func parseScope(s string) (int, bool) {
// Function exists here to allow backward compatibility between old and new // Function exists here to allow backward compatibility between old and new
// group to user matching implementations. // group to user matching implementations.
// See "Config.GroupSearch.UserMatchers" comments for the details // See "Config.GroupSearch.UserMatchers" comments for the details
func (c *ldapConnector) userMatchers() []UserMatcher { func userMatchers(c *Config, logger log.Logger) []UserMatcher {
if len(c.GroupSearch.UserMatchers) > 0 && c.GroupSearch.UserMatchers[0].UserAttr != "" { if len(c.GroupSearch.UserMatchers) > 0 && c.GroupSearch.UserMatchers[0].UserAttr != "" {
return c.GroupSearch.UserMatchers return c.GroupSearch.UserMatchers
} }
log.Deprecated(logger, `LDAP: use groupSearch.userMatchers option instead of "userAttr/groupAttr" fields.`)
return []UserMatcher{ return []UserMatcher{
{ {
UserAttr: c.GroupSearch.UserAttr, UserAttr: c.GroupSearch.UserAttr,
@ -283,6 +284,9 @@ func (c *Config) openConnector(logger log.Logger) (*ldapConnector, error) {
if !ok { if !ok {
return nil, fmt.Errorf("groupSearch.Scope unknown value %q", c.GroupSearch.Scope) return nil, fmt.Errorf("groupSearch.Scope unknown value %q", c.GroupSearch.Scope)
} }
// TODO(nabokihms): remove it after deleting deprecated groupSearch options
c.GroupSearch.UserMatchers = userMatchers(c, logger)
return &ldapConnector{*c, userSearchScope, groupSearchScope, tlsConfig, logger}, nil return &ldapConnector{*c, userSearchScope, groupSearchScope, tlsConfig, logger}, nil
} }
@ -418,7 +422,7 @@ func (c *ldapConnector) userEntry(conn *ldap.Conn, username string) (user ldap.E
}, },
} }
for _, matcher := range c.userMatchers() { for _, matcher := range c.GroupSearch.UserMatchers {
req.Attributes = append(req.Attributes, matcher.UserAttr) req.Attributes = append(req.Attributes, matcher.UserAttr)
} }
@ -575,7 +579,7 @@ func (c *ldapConnector) groups(ctx context.Context, user ldap.Entry) ([]string,
} }
var groups []*ldap.Entry var groups []*ldap.Entry
for _, matcher := range c.userMatchers() { for _, matcher := range c.GroupSearch.UserMatchers {
for _, attr := range getAttrs(user, matcher.UserAttr) { for _, attr := range getAttrs(user, matcher.UserAttr) {
filter := fmt.Sprintf("(%s=%s)", matcher.GroupAttr, ldap.EscapeFilter(attr)) filter := fmt.Sprintf("(%s=%s)", matcher.GroupAttr, ldap.EscapeFilter(attr))
if c.GroupSearch.Filter != "" { if c.GroupSearch.Filter != "" {

5
pkg/log/deprecated.go Normal file
View File

@ -0,0 +1,5 @@
package log
func Deprecated(logger Logger, f string, args ...interface{}) {
logger.Warnf("Deprecated: "+f, args...)
}

3
server/deviceflowhandlers.go
View File

@ -11,6 +11,7 @@ import (
"strings" "strings"
"time" "time"
"github.com/dexidp/dex/pkg/log"
"github.com/dexidp/dex/storage" "github.com/dexidp/dex/storage"
) )
@ -152,7 +153,7 @@ func (s *Server) handleDeviceCode(w http.ResponseWriter, r *http.Request) {
} }
func (s *Server) handleDeviceTokenDeprecated(w http.ResponseWriter, r *http.Request) { func (s *Server) handleDeviceTokenDeprecated(w http.ResponseWriter, r *http.Request) {
s.logger.Warn(`The deprecated "/device/token" endpoint was called. It will be removed, use "/token" instead.`) log.Deprecated(s.logger, `The /device/token endpoint was called. It will be removed, use /token instead.`)
w.Header().Set("Content-Type", "application/json") w.Header().Set("Content-Type", "application/json")
switch r.Method { switch r.Method {