LDAP Provider

import (
  "strings"

  "github.com/strata-io/service-extension/orchestrator"
)

// This is an example Simple Authentication Service Extension that shows a quick way
// to test a Bind request using the Simple Authentication method between the
// application and the Orchestrator. In this example, only a user with the username
// of `bob` and the password of `th3Bu!ld3R` to be authenticated.
//
// A production version of this Service Extension would typically retrieve the
// password hash of the user from either `api.Cache` or `api.Session` and would
// compute the hash of the password received and compare it with the one stored. The
// user is typically a short-lived / one-time user created by an Orchestrator serving
// as the identity-aware proxy, after the end-user has been authenticated by
// the configured IdP.
func Authenticate(api orchestrator.Orchestrator, username string, password string) (bool, error) {
  api.Logger().Debug(
    "service", "LDAP Provider",
    "extension", "Authenticate",
    "msg", "authenticating user",
    "username", username,
  )

  if strings.EqualFold(username, "bob") && password == "th3Bu!ld3R" {
    api.Logger().Debug(
      "service", "LDAP Provider",
      "extension", "Authenticate",
      "msg", "user authenticated",
      "username", username,
    )
    return true, nil
  }

  api.Logger().Debug(
    "service", "LDAP Provider",
    "extension", "Authenticate",
    "msg", "user not authenticated",
    "username", username,
  )
  return false, nil
}

import (
  "fmt"

  "github.com/strata-io/go-ntlm"
  "github.com/strata-io/service-extension/orchestrator"
)

var (
  // THIS IS FOR TESTING PURPOSES ONLY. Do not use this pattern in a production
  // deployment.
  testUsers = map[string][]byte{
    fmt.Sprintf("%s:%s", ntlm.ToUnicode("acme"), ntlm.ToUnicode("user123")): ntlm.ToUnicode("abc123"),
  }
)

// This is an example of an NTLM NTLMGetHashedCredentials Service Extension and shows
// a simple way to test users while verifying the LDAP connection between the
// application and the Orchestrator.
//
// A production version of this Service Extension would typically retrieve the
// NT and LM hashes of the user from either `api.Cache` or `api.Session`, which would
// typically be computed by an Orchestrator serving as the application proxy. The
// user is typically a short-lived / one-time user created after the end-user has
// been authenticated and authorized.
func NTLMGetHashedCredentials(
  api orchestrator.Orchestrator,
  user []byte,
  domain []byte,
) (ntHash []byte, lmHash []byte, err error) {
  api.Logger().Debug(
    "service", "LDAP Provider",
    "extension", "NTLMGetHashedCredentials",
    "msg", "retrieving NT and LM hashes for user",
    "domain", fmt.Sprintf("%q", user[:]),
    "user", fmt.Sprintf("%q", user[:]),
  )

  key := fmt.Sprintf("%s:%s", string(domain), string(user))
  pass, ok := testUsers[key]
  if !ok {
    api.Logger().Debug(
      "service", "LDAP Provider",
      "extension", "NTLMGetHashedCredentials",
      "msg", "invalid user",
      "domain", fmt.Sprintf("%q", domain[:]),
      "user", fmt.Sprintf("%q", user[:]),
    )
    return nil, nil, fmt.Errorf("invalid user: %s", key)
  }
  ntHash = ntlm.NTOWFv2(pass, user, domain)
  lmHash = ntlm.LMOWFv2(pass, user, domain)

  api.Logger().Debug(
    "service", "LDAP Provider",
    "extension", "NTLMGetHashedCredentials",
    "msg", "NT and LM hashes found for user",
    "domain", fmt.Sprintf("%q", domain[:]),
    "user", fmt.Sprintf("%q", user[:]),
  )

  return ntHash, lmHash, err
}

import (
  "strings"

  "github.com/strata-io/service-extension/ldap"
  "github.com/strata-io/service-extension/orchestrator"
)

// This is an example of an Search Service Extension and shows a simple way to verify
// the LDAP connection between the application and the Orchestrator. It is configured
// to return hard-coded attributes for a test user, regardless of the Search request
// received.
//
// A production version will be dependant on the application and environment; however,
// typically, attributes originate from the end-users Session and would NOT be
// hardcoded. For example, if the policy requires a user to be authenticated
// using Entra ID, then the attributes would likely come from Entra ID, and stored
// on the cache via the Orchestrator servicing as the proxy for the application.
func Search(api orchestrator.Orchestrator, dn string, filter string, reqAttrs []string) (map[string]map[string]interface{}, error) {
  api.Logger().Debug(
    "service", "LDAP Provider",
    "extension", "Search",
    "msg", "processing request",
    "user", ldap.BindDN(api.Context()),
    "dn", dn,
    "filter", filter,
    "attributes", strings.Join(reqAttrs, ","),
  )

  result := make(map[string]map[string]interface{})

  // User attributes would typically originate from the users Session and would NOT
  // be hardcoded. For example, if the policy requires a user to be authenticated
  // using Entra ID, then the attributes would likely come from Entra ID.
  userAttrs := make(map[string]interface{})
  userAttrs["Name"] = "Test User"
  userAttrs["mail"] = "[email protected]"
  userAttrs["givenName"] = "Test"
  userAttrs["sn"] = "User"

  result["CN=Test,CN=Domain Users,CN=Users,DC=acme,DC=local"] = userAttrs

  api.Logger().Debug(
    "service", "LDAP Provider",
    "extension", "Search",
    "msg", "request processed",
    "dn", dn,
    "filter", filter,
    "attributes", strings.Join(reqAttrs, ","),
  )

  return result, nil
}