cmd/syncthing: Add LDAP authentication for GUI (fixes #5163) (#5169)

cmd/syncthing/gui.go

@@ -119,6 +119,7 @@ type modelIntf interface {
 
 type configIntf interface {
 	GUI() config.GUIConfiguration
+	LDAP() config.LDAPConfiguration
 	RawCopy() config.Configuration
 	Options() config.OptionsConfiguration
 	Replace(cfg config.Configuration) (config.Waiter, error)
@@ -343,8 +344,8 @@ func (s *apiService) Serve() {
 	handler = withDetailsMiddleware(s.id, handler)
 
 	// Wrap everything in basic auth, if user/password is set.
-	if len(guiCfg.User) > 0 && len(guiCfg.Password) > 0 {
-		handler = basicAuthAndSessionMiddleware("sessionid-"+s.id.String()[:5], guiCfg, handler)
+	if guiCfg.IsAuthEnabled() {
+		handler = basicAuthAndSessionMiddleware("sessionid-"+s.id.String()[:5], guiCfg, s.cfg.LDAP(), handler)
 	}
 
 	// Redirect to HTTPS if we are supposed to

cmd/syncthing/gui_auth.go

@@ -8,7 +8,9 @@ package main
 
 import (
 	"bytes"
+	"crypto/tls"
 	"encoding/base64"
+	"fmt"
 	"net/http"
 	"strings"
 	"time"
@@ -18,6 +20,7 @@ import (
 	"github.com/syncthing/syncthing/lib/rand"
 	"github.com/syncthing/syncthing/lib/sync"
 	"golang.org/x/crypto/bcrypt"
+	"gopkg.in/ldap.v2"
 )
 
 var (
@@ -32,9 +35,9 @@ func emitLoginAttempt(success bool, username string) {
 	})
 }
 
-func basicAuthAndSessionMiddleware(cookieName string, cfg config.GUIConfiguration, next http.Handler) http.Handler {
+func basicAuthAndSessionMiddleware(cookieName string, guiCfg config.GUIConfiguration, ldapCfg config.LDAPConfiguration, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if cfg.IsValidAPIKey(r.Header.Get("X-API-Key")) {
+		if guiCfg.IsValidAPIKey(r.Header.Get("X-API-Key")) {
 			next.ServeHTTP(w, r)
 			return
 		}
@@ -77,42 +80,26 @@ func basicAuthAndSessionMiddleware(cookieName string, cfg config.GUIConfiguratio
 			return
 		}
 
-		// Check if the username is correct, assuming it was sent as UTF-8
+		authOk := false
 		username := string(fields[0])
-		if username == cfg.User {
-			goto usernameOK
+		password := string(fields[1])
+
+		authOk = auth(username, password, guiCfg, ldapCfg)
+		if !authOk {
+			usernameIso := string(iso88591ToUTF8([]byte(username)))
+			passwordIso := string(iso88591ToUTF8([]byte(password)))
+			authOk = auth(usernameIso, passwordIso, guiCfg, ldapCfg)
+			if authOk {
+				username = usernameIso
+			}
 		}
 
-		// ... check it again, converting it from assumed ISO-8859-1 to UTF-8
-		username = string(iso88591ToUTF8(fields[0]))
-		if username == cfg.User {
-			goto usernameOK
+		if !authOk {
+			emitLoginAttempt(false, username)
+			error()
+			return
 		}
 
-		// Neither of the possible interpretations match the configured username
-		emitLoginAttempt(false, username)
-		error()
-		return
-
-	usernameOK:
-		// Check password as given (assumes UTF-8 encoding)
-		password := fields[1]
-		if err := bcrypt.CompareHashAndPassword([]byte(cfg.Password), password); err == nil {
-			goto passwordOK
-		}
-
-		// ... check it again, converting it from assumed ISO-8859-1 to UTF-8
-		password = iso88591ToUTF8(password)
-		if err := bcrypt.CompareHashAndPassword([]byte(cfg.Password), password); err == nil {
-			goto passwordOK
-		}
-
-		// Neither of the attempts to verify the password checked out
-		emitLoginAttempt(false, username)
-		error()
-		return
-
-	passwordOK:
 		sessionid := rand.String(32)
 		sessionsMut.Lock()
 		sessions[sessionid] = true
@@ -128,6 +115,54 @@ func basicAuthAndSessionMiddleware(cookieName string, cfg config.GUIConfiguratio
 	})
 }
 
+func auth(username string, password string, guiCfg config.GUIConfiguration, ldapCfg config.LDAPConfiguration) bool {
+	if guiCfg.AuthMode == config.AuthModeLDAP {
+		return authLDAP(username, password, ldapCfg)
+	} else {
+		return authStatic(username, password, guiCfg.User, guiCfg.Password)
+	}
+}
+
+func authStatic(username string, password string, configUser string, configPassword string) bool {
+	configPasswordBytes := []byte(configPassword)
+	passwordBytes := []byte(password)
+	return bcrypt.CompareHashAndPassword(configPasswordBytes, passwordBytes) == nil && username == configUser
+}
+
+func authLDAP(username string, password string, cfg config.LDAPConfiguration) bool {
+	address := cfg.Address
+	var connection *ldap.Conn
+	var err error
+	if cfg.Transport == config.LDAPTransportTLS {
+		connection, err = ldap.DialTLS("tcp", address, &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify})
+	} else {
+		connection, err = ldap.Dial("tcp", address)
+	}
+
+	if err != nil {
+		l.Warnln("LDAP Dial:", err)
+		return false
+	}
+
+	if cfg.Transport == config.LDAPTransportStartTLS {
+		err = connection.StartTLS(&tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify})
+		if err != nil {
+			l.Warnln("LDAP Start TLS:", err)
+			return false
+		}
+	}
+
+	defer connection.Close()
+
+	err = connection.Bind(fmt.Sprintf(cfg.BindDN, username), password)
+	if err != nil {
+		l.Warnln("LDAP Bind:", err)
+		return false
+	}
+
+	return true
+}
+
 // Convert an ISO-8859-1 encoded byte string to UTF-8. Works by the
 // principle that ISO-8859-1 bytes are equivalent to unicode code points,
 // that a rune slice is a list of code points, and that stringifying a slice

cmd/syncthing/gui_auth_test.go

@@ -0,0 +1,36 @@
+// Copyright (C) 2014 The Syncthing Authors.
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this file,
+// You can obtain one at https://mozilla.org/MPL/2.0/.
+
+package main
+
+import (
+	"golang.org/x/crypto/bcrypt"
+	"testing"
+)
+
+func TestStaticAuthOK(t *testing.T) {
+	passwordHashBytes, _ := bcrypt.GenerateFromPassword([]byte("pass"), 14)
+	ok := authStatic("user", "pass", "user", string(passwordHashBytes))
+	if !ok {
+		t.Fatalf("should pass auth")
+	}
+}
+
+func TestSimpleAuthUsernameFail(t *testing.T) {
+	passwordHashBytes, _ := bcrypt.GenerateFromPassword([]byte("pass"), 14)
+	ok := authStatic("userWRONG", "pass", "user", string(passwordHashBytes))
+	if ok {
+		t.Fatalf("should fail auth")
+	}
+}
+
+func TestStaticAuthPasswordFail(t *testing.T) {
+	passwordHashBytes, _ := bcrypt.GenerateFromPassword([]byte("passWRONG"), 14)
+	ok := authStatic("user", "pass", "user", string(passwordHashBytes))
+	if ok {
+		t.Fatalf("should fail auth")
+	}
+}

cmd/syncthing/mocked_config_test.go

@@ -24,6 +24,10 @@ func (c *mockedConfig) ListenAddresses() []string {
 	return nil
 }
 
+func (c *mockedConfig) LDAP() config.LDAPConfiguration {
+	return config.LDAPConfiguration{}
+}
+
 func (c *mockedConfig) RawCopy() config.Configuration {
 	cfg := config.Configuration{}
 	util.SetDefaults(&cfg.Options)