Got LDAP working

Author: CommanderKeynes

pgcat.minimal.toml

@@ -12,9 +12,11 @@ admin_auth_ldapurl = "ldap://127.0.0.1:3893"
 admin_auth_ldapsuffix  = "@example.com"
 
 [pools.pgml.users.0]
-username = "postgres"
+username = "jdoe"
 password = "postgres"
-auth_type = "md5"
+auth_type = "ldap"
+auth_ldapurl = "ldap://127.0.0.1:3893"
+auth_ldapsuffix  = "@example.com"
 pool_size = 10
 min_pool_size = 1
 pool_mode = "transaction"

src/auth_passthrough.rs

@@ -72,6 +72,8 @@ impl AuthPassthrough {
         let auth_user = crate::config::User {
             username: self.user.clone(),
             auth_type: "".to_string(),
+            auth_ldapsuffix: None,
+            auth_ldapurl: None,
             password: Some(self.password.clone()),
             server_username: None,
             server_password: None,

src/client.rs

@@ -416,20 +416,20 @@ pub async fn startup_tls(
 
 
 // Pass in username and password to authenticate against LDAP
-async fn authenticate_ldap(username: &str, password: &str) -> bool {
+async fn authenticate_ldap(username: &str, password: &str, ldapurl: &str, ldapsuffix: &str) -> bool {
     // Connection to the LDAP Server
     let ldap_conn_settings = LdapConnSettings::new();
     let (conn, mut ldap) =
         LdapConnAsync::with_settings(
-            ldap_conn_settings, "ldap://127.0.0.1:3893").await.unwrap();
+            ldap_conn_settings, ldapurl).await.unwrap();
     ldap3::drive!(conn);
 
     // Takes the username provided and converts it into an email for validation
     // This is required because LDAP uses either the Distinguished name or Email in order to bind. Username alone will not work :/
-    let email = format!("{}@example.com", username);
+    let email = format!("{}{}", username, ldapsuffix);
 
     // Attempts a simple bind using the passed in values of username and Password
-    println!("{}", password);
+    println!("{:?}", password);
     let result = ldap.simple_bind(email.as_str(), &password).await.unwrap().success();
     ldap.unbind().await.unwrap();
 
@@ -617,15 +617,14 @@ where
                         ))
                     }
                 };
-                let str_password = std::str::from_utf8(&password_response).unwrap();
+                let str_password = String::from_utf8(password_response).unwrap();
+                let str_password = str_password.trim_matches(char::from(0));
                 let unsuccessful_auth = !authenticate_ldap(
                     &config.general.admin_username,
-                    str_password,
-                    // "dogood",
-                    // config.general.admin_auth_ldapurl.expect("ldapurl not set").as_str(),
-                    // config.general.admin_auth_ldapsuffix.expect("ldapsuffix not set").as_str(),
+                    &str_password,
+                    &config.general.admin_auth_ldapurl.unwrap(),
+                    &config.general.admin_auth_ldapsuffix.unwrap(),
                 ).await;
-                println!("{}", unsuccessful_auth);
                 if unsuccessful_auth {
                         wrong_password(&mut write, username).await?;
 
@@ -794,6 +793,62 @@ where
             }
 
             else if let "ldap" =  pool.settings.user.auth_type.as_str() {
+                clear_text_challenge(&mut write).await?;
+                let code = match read.read_u8().await {
+                    Ok(p) => p,
+                    Err(_) => {
+                        return Err(Error::ClientSocketError(
+                            "password code".into(),
+                            client_identifier,
+                        ))
+                    }
+                };
+
+                // PasswordMessage
+                if code as char != 'p' {
+                    return Err(Error::ProtocolSyncError(format!(
+                        "Expected p, got {}",
+                        code as char
+                    )));
+                }
+
+                let len = match read.read_i32().await {
+                    Ok(len) => len,
+                    Err(_) => {
+                        return Err(Error::ClientSocketError(
+                            "password message length".into(),
+                            client_identifier,
+                        ))
+                    }
+                };
+
+                let mut password_response = vec![0u8; (len - 4) as usize];
+
+                match read.read_exact(&mut password_response).await {
+                    Ok(_) => (),
+                    Err(_) => {
+                        return Err(Error::ClientSocketError(
+                            "password message".into(),
+                            client_identifier,
+                        ))
+                    }
+                };
+                let str_password = String::from_utf8(password_response).unwrap();
+                let str_password = str_password.trim_matches(char::from(0));
+                let unsuccessful_auth = !authenticate_ldap(
+                    &pool.settings.user.username.as_str(),
+                    &str_password,
+                    &pool.settings.user.auth_ldapurl.clone().unwrap(),
+                    &pool.settings.user.auth_ldapsuffix.clone().unwrap(),
+                ).await;
+                if unsuccessful_auth {
+                        wrong_password(&mut write, username).await?;
+
+                        return Err(Error::ClientGeneralError(
+                            "Invalid password".into(),
+                            client_identifier,
+                        ));
+                }
 
             }
             let transaction_mode = pool.settings.pool_mode == PoolMode::Transaction;

src/config.rs

@@ -209,6 +209,8 @@ pub struct User {
     pub username: String,
     pub password: Option<String>,
     pub auth_type: String,
+    pub auth_ldapsuffix: Option<String>,
+    pub auth_ldapurl: Option<String>,
     pub server_username: Option<String>,
     pub server_password: Option<String>,
     pub pool_size: u32,
@@ -227,6 +229,8 @@ impl Default for User {
             username: String::from("postgres"),
             password: None,
             auth_type: "md5".to_string(),
+            auth_ldapsuffix: None,
+            auth_ldapurl: None,
             server_username: None,
             server_password: None,
             pool_size: 15,