Joseph Doherty
d549a782fd
BindMode=User bound as UserBindTemplate({0}) and then returned the groups of
whatever entry (UserNameAttribute={0}) found - two directory lookups that can
name two accounts (Auth-007). Reproduced live against GLAuth: mallory bound as
herself and signed in with boss's Admins group.
After the bind the service now asks RFC 4532 Who-am-I and requires the entry
to be that account (dn: -> DN match; AD u:DOMAIN\name -> sAMAccountName match).
Without a Who-am-I answer only a DN template is provable (bind DN must equal
the entry DN); anything else fails closed as GroupLookupFailed. {0} is
RFC 4514-escaped in DN templates; validator message leads with EXAMPLE\{0}.
Auth 0.4.3 -> 0.4.4 (unpublished).
Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
50 lines
1.2 KiB
TOML
50 lines
1.2 KiB
TOML
# GLAuth fixture for the user-bind identity test (Auth-007, scadaproj#40).
|
|
# Start: docker compose up -d (listens on localhost:3897)
|
|
# All passwords are "password" (sha256 below).
|
|
#
|
|
# mallory binds as herself (cn=mallory,ou=Users,...). The admin entry carries mail=mallory,
|
|
# so with UserNameAttribute=mail a search for the typed name "mallory" finds the ADMIN — the
|
|
# account that bound and the account searched for differ. The library must refuse.
|
|
|
|
[ldap]
|
|
enabled = true
|
|
listen = "0.0.0.0:3893"
|
|
|
|
[ldaps]
|
|
enabled = false
|
|
|
|
[backend]
|
|
datastore = "config"
|
|
baseDN = "dc=zb,dc=local"
|
|
|
|
[behaviors]
|
|
LimitFailedBinds = false
|
|
|
|
[[groups]]
|
|
name = "Users"
|
|
gidnumber = 6001
|
|
[[groups]]
|
|
name = "Admins"
|
|
gidnumber = 6002
|
|
|
|
[[users]]
|
|
name = "mallory"
|
|
mail = "mallory-real@zb.local"
|
|
uidnumber = 6101
|
|
primarygroup = 6001
|
|
passsha256 = "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8"
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "*"
|
|
|
|
[[users]]
|
|
name = "boss"
|
|
mail = "mallory"
|
|
uidnumber = 6102
|
|
primarygroup = 6001
|
|
othergroups = [6002]
|
|
passsha256 = "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8"
|
|
[[users.capabilities]]
|
|
action = "search"
|
|
object = "*"
|