In some use-cases, one would like to login using either their username or email. Administrators now don't have to choose a single field but may specify multiple fields to count as "username".
Signed-off-by: Yarden Shoham <git@yardenshoham.com>
This commit enables universal nested group search support across a
variety of LDAP server implementations. It updates the code to allow
recursive group membership discovery during user authentication and
provides CI tests to validate the functionality.
Based on @paroque’s original https://github.com/dexidp/dex/pull/1058
PR.
- Removed `Recursive` boolean flag from config and logic
- Made recursion behavior dependant on presence of `RecursionGroupAttr`
- Updated log messages to reflect changes and follow `slog` structured format
Signed-off-by: Ethan Dieterich <ethandieterich@gmail.com>
* Use scheme without :// suffix
* Make test ldap server listen on custom ports to avoid stepping into go-ldap defaults
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
With the change introduced in https://github.com/dexidp/dex/pull/3372 Dex declines passwords that contain special characters. Since password is not passed to any kind of filters, it is safe to pass a password as is. No LDAP query injections are possible.
This commit is a revert of password escaping.
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
The io/ioutil package has been deprecated as of Go 1.16, see
https://golang.org/doc/go1.16#ioutil. This commit replaces the existing
io/ioutil functions with their new definitions in io and os packages.
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
Now that the ldap tests don't create containers on the fly
they can run the same way as other integration tests.
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
Yarden ShohamandGitHub
Maksim NabokikhandGitHub
EthanDieterichandGitHub
Oleksandr RedkoandGitHub
Sean LiaoandGitHub
hsinhoyehandGitHub
Márk Sági-KazárandGitHub
Josh Soref
Mark Sagi-Kazar
Eng Zer Jun
Salman Ahmed