Initial commit: scadaproj umbrella — sister-project index, auth component normalization (design + GAPS), and the built ZB.MOM.WW.Auth shared library (0.1.0, flattened in).

2026-06-01 03:59:23 -04:00
commit 37e23cf9f2
73 changed files with 6836 additions and 0 deletions
@@ -0,0 +1,47 @@
+namespace ZB.MOM.WW.Auth.Abstractions.Ldap;
+
+public enum LdapTransport { Ldaps, StartTls, None }
+
+public sealed record LdapOptions
+{
+    public bool Enabled { get; init; } = true;
+    public string Server { get; init; } = "localhost";
+    public int Port { get; init; } = 3893;
+    public LdapTransport Transport { get; init; } = LdapTransport.Ldaps;
+    public bool AllowInsecure { get; init; }
+    public string SearchBase { get; init; } = "";
+    public string ServiceAccountDn { get; init; } = "";
+    public string ServiceAccountPassword { get; init; } = "";
+    public string UserNameAttribute { get; init; } = "cn";
+    public string DisplayNameAttribute { get; init; } = "cn";
+    public string GroupAttribute { get; init; } = "memberOf";
+    public int ConnectionTimeoutMs { get; init; } = 10_000;
+}
+
+public enum LdapAuthFailure { BadCredentials, UserNotFound, AmbiguousUser, GroupLookupFailed, ServiceAccountBindFailed, Disabled }
+
+public sealed record LdapAuthResult(bool Succeeded, string Username, string DisplayName, IReadOnlyList<string> Groups, LdapAuthFailure? Failure)
+{
+    public static LdapAuthResult Success(string username, string displayName, IReadOnlyList<string> groups) => new(true, username, displayName, groups, null);
+    public static LdapAuthResult Fail(LdapAuthFailure failure) => new(false, "", "", Array.Empty<string>(), failure);
+}
+
+public interface ILdapAuthService
+{
+    /// <summary>
+    /// Authenticates <paramref name="username"/> against the directory by bind-then-search and
+    /// returns the outcome, including the resolved display name and group memberships on success.
+    /// </summary>
+    /// <param name="username">The login name to authenticate.</param>
+    /// <param name="password">The credential to bind with.</param>
+    /// <param name="ct">A token to request cancellation of the operation.</param>
+    /// <returns>The authentication result.</returns>
+    /// <remarks>
+    /// The cancellation token is observed at entry only. Implementations backed by synchronous
+    /// LDAP clients cannot abort an in-flight bind or search once it has been dispatched, so full
+    /// cooperative cancellation is not guaranteed mid-call: a request that has already reached the
+    /// directory will run to completion (subject to the configured connection timeout) even if the
+    /// token is cancelled.
+    /// </remarks>
+    Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct);
+}