# GLAuth fixture for the user-bind identity test (Auth-007, scadaproj#40).
# Start:  docker compose up -d   (listens on localhost:3897)
# All passwords are "password" (sha256 below).
#
# mallory binds as herself (cn=mallory,ou=Users,...). The admin entry carries mail=mallory,
# so with UserNameAttribute=mail a search for the typed name "mallory" finds the ADMIN — the
# account that bound and the account searched for differ. The library must refuse.

[ldap]
  enabled = true
  listen = "0.0.0.0:3893"

[ldaps]
  enabled = false

[backend]
  datastore = "config"
  baseDN = "dc=zb,dc=local"

[behaviors]
  LimitFailedBinds = false

[[groups]]
  name = "Users"
  gidnumber = 6001
[[groups]]
  name = "Admins"
  gidnumber = 6002

[[users]]
  name = "mallory"
  mail = "mallory-real@zb.local"
  uidnumber = 6101
  primarygroup = 6001
  passsha256 = "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8"
    [[users.capabilities]]
    action = "search"
    object = "*"

[[users]]
  name = "boss"
  mail = "mallory"
  uidnumber = 6102
  primarygroup = 6001
  othergroups = [6002]
  passsha256 = "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8"
    [[users.capabilities]]
    action = "search"
    object = "*"