31b9b295aa
HashiCorp Vault reads the attributes of the user it just bound as by
issuing a base-object "(objectClass=*)" search whose base DN is the
user's own DN, and has no option to turn that step off. Those searches
named a leaf entry rather than a container, so nothing routed them and
login failed with unwillingToPerform.
A single entry is now looked up by ID or name and returned under the DN
the client asked for, advertising objectClass as the other entries do.
An unknown name reports noSuchObject so clients can distinguish it from
an empty result, an entry that does not match the filter succeeds with
no entries as RFC 4511 requires, and filter shapes we cannot evaluate
are refused instead of guessed at. The catch-all route is limited to
base-object scope so searches with an unknown subtree base are still
refused, which keeps a renamed server from answering its old base DN.
💘 Generated with Crush
Assisted-by: Crush:qwen38_flash_next_mtp
|
||
|---|---|---|
| .github/workflows | ||
| internal | ||
| scripts | ||
| .gitignore | ||
| .goreleaser.yml | ||
| AGENTS.md | ||
| Dockerfile | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| main.go | ||
| README.md | ||
NetAuth LDAP Server
The NetAuth LDAP server acts as a bridge that allows legacy systems that understand LDAP to gain a read-only view of data in the NetAuth server.
It is recommended to install the NetAuth LDAP server on each host that requires this interface and to bind it to the loopback interface.
The format that the LDAP bridge exposes data in is slightly different
to that which is presented to an actual NetAuth client. The groups
are presented in a flattened format with all expansions processed, and
all groups are precented under a special ou=groups path. Similarly,
entities are presented under a ou=entities path under the base DN.
Speaking of the base DN, NetAuth doesn't have such a concept, so the
LDAP bridge takes this as a seperate configuration item on startup.
The provided format must be a valid domain name that will be split on
.. Prepended to this will be dc=netauth to clearly signify that
the data retrieved is coming from NetAuth.