5f5bfe1ea5
Three bugs blocked sign-in entirely: - Login.razor is static-SSR but its form model lacked [SupplyParameterFromForm], so the posted username/password never bound — SignInAsync saw empty fields and bailed before LDAP was contacted. Annotate the model; seed it in OnInitialized since BL0008 forbids an initializer on a [SupplyParameterFromForm] property. - appsettings.json ServiceAccountDn used ou=svcaccts, which GLAuth reads as a (non-existent) group — the service-account bind failed with "Group not found". Use cn=serviceaccount,dc=lmxopcua,dc=local. - LdapAuthService resolved the user DN by searching (uid=...), but GLAuth keys users by cn. Add an LdapOptions.UserNameAttribute knob (default cn for GLAuth; set sAMAccountName for Active Directory) and use it for the search filter. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
46 lines
1.9 KiB
C#
46 lines
1.9 KiB
C#
namespace ZB.MOM.WW.OtOpcUa.Admin.Security;
|
|
|
|
/// <summary>
|
|
/// LDAP + role-mapping configuration for the Admin UI. Bound from <c>appsettings.json</c>
|
|
/// <c>Authentication:Ldap</c> section. Defaults point at the local GLAuth dev instance (see
|
|
/// <c>C:\publish\glauth\auth.md</c>).
|
|
/// </summary>
|
|
public sealed class LdapOptions
|
|
{
|
|
public const string SectionName = "Authentication:Ldap";
|
|
|
|
public bool Enabled { get; set; } = true;
|
|
public string Server { get; set; } = "localhost";
|
|
public int Port { get; set; } = 3893;
|
|
public bool UseTls { get; set; }
|
|
|
|
/// <summary>Dev-only escape hatch — must be <c>false</c> in production.</summary>
|
|
public bool AllowInsecureLdap { get; set; }
|
|
|
|
public string SearchBase { get; set; } = "dc=lmxopcua,dc=local";
|
|
|
|
/// <summary>
|
|
/// Service-account DN used for search-then-bind. When empty, a direct-bind with
|
|
/// <c>cn={user},{SearchBase}</c> is attempted.
|
|
/// </summary>
|
|
public string ServiceAccountDn { get; set; } = string.Empty;
|
|
public string ServiceAccountPassword { get; set; } = string.Empty;
|
|
|
|
public string DisplayNameAttribute { get; set; } = "cn";
|
|
public string GroupAttribute { get; set; } = "memberOf";
|
|
|
|
/// <summary>
|
|
/// Attribute the service-account search matches the login name against to resolve the
|
|
/// user's DN. <c>cn</c> for GLAuth (the dev default); set <c>sAMAccountName</c> for
|
|
/// Active Directory.
|
|
/// </summary>
|
|
public string UserNameAttribute { get; set; } = "cn";
|
|
|
|
/// <summary>
|
|
/// Maps LDAP group name → Admin role. Group match is case-insensitive. A user gets every
|
|
/// role whose source group is in their membership list. Example dev mapping:
|
|
/// <code>"ReadOnly":"ConfigViewer","ReadWrite":"ConfigEditor","AlarmAck":"FleetAdmin"</code>
|
|
/// </summary>
|
|
public Dictionary<string, string> GroupToRole { get; set; } = new(StringComparer.OrdinalIgnoreCase);
|
|
}
|