{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/34194897","id":34194897,"diff_hunk":"@@ -0,0 +1,227 @@\n+package ldappassword\n+\n+import (\n+\t\"crypto/tls\"\n+\t\"fmt\"\n+\t\"strings\"\n+\n+\t\"github.com/GoogleCloudPlatform/kubernetes/pkg/auth/user\"\n+\t\"github.com/GoogleCloudPlatform/kubernetes/pkg/util\"\n+\n+\t\"github.com/go-ldap/ldap\"\n+\t\"github.com/golang/glog\"\n+\n+\tauthapi \"github.com/openshift/origin/pkg/auth/api\"\n+\t\"github.com/openshift/origin/pkg/auth/authenticator\"\n+)\n+\n+const (\n+\tProtocolLDAP  = \"ldap\"\n+\tProtocolLDAPS = \"ldaps\"\n+)\n+\n+// Options contains configuration for an Authenticator instance\n+type Options struct {\n+\t// URL is a parsed RFC 2255 URL\n+\tURL LDAPURL\n+\t// Insecure specifies if TLS is required for the connection. If true, either an ldap://... URL or StartTLS must be supported by the server\n+\tInsecure bool\n+\t// TLSConfig holds the TLS options. Only used when Insecure=false\n+\tTLSConfig *tls.Config\n+\n+\t// BindDN is the optional username to bind to for the search phase. If specified, BindPassword must also be set.\n+\tBindDN string\n+\t// BindPassword is the optional password to bind to for the search phase.\n+\tBindPassword string\n+\n+\t// AttributeEmail is the optional list of LDAP attributes to use for the email address of the user identity.\n+\t// The first attribute with a non-empty value is used.\n+\tAttributeEmail []string\n+\t// AttributeName is the optional list of LDAP attributes to use for the display name of the user identity.\n+\t// The first attribute with a non-empty value is used.\n+\tAttributeName []string\n+\t// AttributePreferredUsername is the optional list of LDAP attributes to use for the preferred username of the user identity.\n+\t// The first attribute with a non-empty value is used. If not specified, the id determined by AttributeID is used as the preferred login.\n+\tAttributePreferredUsername []string\n+\t// AttributeID is the required list of LDAP attributes to use for the id address of the user identity.\n+\t// The first attribute with a non-empty value is used. If no attributes have values, login fails.\n+\tAttributeID []string\n+}\n+\n+// Authenticator validates username/passwords against an LDAP v3 server\n+type Authenticator struct {\n+\tproviderName string\n+\toptions      Options\n+\tmapper       authapi.UserIdentityMapper\n+}\n+\n+// New returns an authenticator which will validate usernames/passwords using LDAP.\n+func New(providerName string, options Options, mapper authapi.UserIdentityMapper) (authenticator.Password, error) {","path":"pkg/auth/authenticator/password/ldappassword/ldap.go","position":59,"original_position":59,"commit_id":"b51d3a5f78aef2222b31b858ab8618149e7dc2f2","original_commit_id":"af5ef26677fa9ab3f191754ab1c07183053cd06f","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"These options can be invalid for our purposes, I think we should have a validate method.  Particularly for `ldapurl.schema`, `insecure`, `tlsconfig`","created_at":"2015-07-08T20:33:16Z","updated_at":"2015-07-08T20:33:16Z","html_url":"https://github.com/openshift/origin/pull/3558#discussion_r34194897","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/3558","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/34194897"},"html":{"href":"https://github.com/openshift/origin/pull/3558#discussion_r34194897"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/3558"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/3558","id":39143184,"html_url":"https://github.com/openshift/origin/pull/3558","diff_url":"https://github.com/openshift/origin/pull/3558.diff","patch_url":"https://github.com/openshift/origin/pull/3558.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/3558","number":3558,"state":"open","locked":false,"title":"LDAP password authentication","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"- [x] Add LDAP password authenticator\r\n- [x] Godoc\r\n- [x] Unit tests\r\n- [ ] Integration tests\r\n- [ ] open ansible issue\r\n- [ ] open doc issue\r\n- [x] create story for QE - https://trello.com/c/UC2rGgJ2/\r\n\r\nSample configuration to test TLS/StartTLS (`ldap.ca.crt` is the Red Hat CA - https://password.corp.redhat.com/newca.crt):\r\n```\r\n  identityProviders:\r\n  - challenge: true\r\n    login: true\r\n    name: \"secureldap\"\r\n    provider:\r\n      apiVersion: v1\r\n      attributes:\r\n        email:\r\n        - mail\r\n        id:\r\n        - dn\r\n        name:\r\n        - cn\r\n        preferredUsername:\r\n        - uid\r\n      bindDN: \"\"\r\n      bindPassword: \"\"\r\n      ca: ldap.ca.crt\r\n      kind: LDAPPasswordIdentityProvider\r\n      insecure: false\r\n      url: \"ldap://ldap.rdu.redhat.com/ou=users,dc=redhat,dc=com?uid\"\r\n```\r\n\r\n\r\nSample configuration to test `insecure: true` (login with \"newton\" / \"password\"):\r\n```\r\n  identityProviders:\r\n  - challenge: true\r\n    login: true\r\n    name: \"insecureldap\"\r\n    provider:\r\n      apiVersion: v1\r\n      attributes:\r\n        id:\r\n        - dn\r\n        name:\r\n        - cn\r\n        preferredUsername:\r\n        - uid\r\n      bindDN: \"cn=read-only-admin,dc=example,dc=com\"\r\n      bindPassword: \"password\"\r\n      ca: \"\"\r\n      kind: LDAPPasswordIdentityProvider\r\n      insecure: true\r\n      url: \"ldap://ldap.forumsys.com/dc=example,dc=com?uid\"\r\n```","created_at":"2015-07-03T03:16:35Z","updated_at":"2015-07-08T20:33:16Z","closed_at":null,"merged_at":null,"merge_commit_sha":"bdd1f0f7cdf6d07681065723f99c2e6bb817b78c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/3558/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/3558/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/3558/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/b51d3a5f78aef2222b31b858ab8618149e7dc2f2","head":{"label":"liggitt:ldap","ref":"ldap","sha":"b51d3a5f78aef2222b31b858ab8618149e7dc2f2","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"repo":{"id":23198153,"name":"origin","full_name":"liggitt/origin","owner":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/liggitt/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/liggitt/origin","forks_url":"https://api.github.com/repos/liggitt/origin/forks","keys_url":"https://api.github.com/repos/liggitt/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/liggitt/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/liggitt/origin/teams","hooks_url":"https://api.github.com/repos/liggitt/origin/hooks","issue_events_url":"https://api.github.com/repos/liggitt/origin/issues/events{/number}","events_url":"https://api.github.com/repos/liggitt/origin/events","assignees_url":"https://api.github.com/repos/liggitt/origin/assignees{/user}","branches_url":"https://api.github.com/repos/liggitt/origin/branches{/branch}","tags_url":"https://api.github.com/repos/liggitt/origin/tags","blobs_url":"https://api.github.com/repos/liggitt/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/liggitt/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/liggitt/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/liggitt/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/liggitt/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/liggitt/origin/languages","stargazers_url":"https://api.github.com/repos/liggitt/origin/stargazers","contributors_url":"https://api.github.com/repos/liggitt/origin/contributors","subscribers_url":"https://api.github.com/repos/liggitt/origin/subscribers","subscription_url":"https://api.github.com/repos/liggitt/origin/subscription","commits_url":"https://api.github.com/repos/liggitt/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/liggitt/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/liggitt/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/liggitt/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/liggitt/origin/contents/{+path}","compare_url":"https://api.github.com/repos/liggitt/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/liggitt/origin/merges","archive_url":"https://api.github.com/repos/liggitt/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/liggitt/origin/downloads","issues_url":"https://api.github.com/repos/liggitt/origin/issues{/number}","pulls_url":"https://api.github.com/repos/liggitt/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/liggitt/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/liggitt/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/liggitt/origin/labels{/name}","releases_url":"https://api.github.com/repos/liggitt/origin/releases{/id}","created_at":"2014-08-21T18:23:05Z","updated_at":"2015-05-08T13:01:51Z","pushed_at":"2015-07-08T20:32:39Z","git_url":"git://github.com/liggitt/origin.git","ssh_url":"git@github.com:liggitt/origin.git","clone_url":"https://github.com/liggitt/origin.git","svn_url":"https://github.com/liggitt/origin","homepage":"https://openshift.github.io","size":125010,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"3ed8ae3ef1e64f129294ac1675fb317f2793392d","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","created_at":"2014-07-30T20:04:05Z","updated_at":"2015-07-08T14:47:48Z","pushed_at":"2015-07-08T20:32:39Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":184093,"stargazers_count":534,"watchers_count":534,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":286,"mirror_url":null,"open_issues_count":406,"forks":286,"open_issues":406,"watchers":534,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/3558"},"html":{"href":"https://github.com/openshift/origin/pull/3558"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/3558"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/3558/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/3558/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/3558/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/b51d3a5f78aef2222b31b858ab8618149e7dc2f2"}}}}