{"action":"created","comment":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/comments/29785954","id":29785954,"diff_hunk":"@@ -0,0 +1,117 @@\n+package ldap\n+\n+import (\n+\t\"fmt\"\n+\t\"net\"\n+\t\"net/url\"\n+\n+\t\"github.com/hashicorp/vault/logical\"\n+\t\"github.com/hashicorp/vault/logical/framework\"\n+\t\"github.com/mmitton/ldap\"\n+)\n+\n+func pathLogin(b *backend) *framework.Path {\n+\treturn &framework.Path{\n+\t\tPattern: `login`,\n+\t\tFields: map[string]*framework.FieldSchema{\n+\t\t\t\"username\": &framework.FieldSchema{\n+\t\t\t\tType:        framework.TypeString,\n+\t\t\t\tDescription: \"DN (distinguished name) to be used for login.\",\n+\t\t\t},\n+\n+\t\t\t\"password\": &framework.FieldSchema{\n+\t\t\t\tType:        framework.TypeString,\n+\t\t\t\tDescription: \"Password for this user.\",\n+\t\t\t},\n+\t\t},\n+\n+\t\tCallbacks: map[logical.Operation]framework.OperationFunc{\n+\t\t\tlogical.WriteOperation: b.pathLogin,\n+\t\t},\n+\n+\t\tHelpSynopsis:    pathLoginSyn,\n+\t\tHelpDescription: pathLoginDesc,\n+\t}\n+}\n+\n+func (b *backend) pathLogin(\n+\treq *logical.Request, d *framework.FieldData) (*logical.Response, error) {\n+\tusername := d.Get(\"username\").(string)\n+\tpassword := d.Get(\"password\").(string)\n+\n+\tcfg, err := b.Config(req)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\tif cfg == nil {\n+\t\treturn logical.ErrorResponse(\"ldap backend not configured\"), nil\n+\t}\n+\n+\tu, err := url.Parse(cfg.Url)\n+\tif err != nil {\n+\t\treturn nil, err\n+\t}\n+\thost, port, err := net.SplitHostPort(u.Host)\n+\tif err != nil {\n+\t\thost = u.Host\n+\t}\n+\n+\tvar c *ldap.Conn\n+\tvar cerr *ldap.Error\n+\tswitch u.Scheme {\n+\tcase \"ldap\":\n+\t\tif port == \"\" {\n+\t\t\tport = \"389\"\n+\t\t}\n+\t\tc, cerr = ldap.Dial(\"tcp\", host+\":\"+port)\n+\tcase \"ldaps\":\n+\t\tif port == \"\" {\n+\t\t\tport = \"636\"\n+\t\t}\n+\t\tc, cerr = ldap.DialSSL(\"tcp\", host+\":\"+port)\n+\tdefault:\n+\t\treturn logical.ErrorResponse(\"invalid LDAP URL scheme\"), nil\n+\t}\n+\tif cerr != nil {\n+\t\treturn nil, cerr\n+\t}\n+\n+\tbinddn := fmt.Sprintf(\"%s=%s,%s\", cfg.UserAttr, username, cfg.Domain)\n+\tcerr = c.Bind(binddn, password)\n+\tif cerr != nil {\n+\t\treturn logical.ErrorResponse(fmt.Sprintf(\"LDAP bind failed: %s\", cerr.Error())), nil\n+\t}\n+\n+\treturn &logical.Response{\n+\t\tAuth: &logical.Auth{\n+\t\t\tPolicies: []string{\"root\"},","path":"builtin/credential/ldap/path_login.go","position":87,"original_position":87,"commit_id":"fadee1f87d58aa07ad44dfb569c23ddc4e53e0f1","original_commit_id":"fadee1f87d58aa07ad44dfb569c23ddc4e53e0f1","user":{"login":"armon","id":592032,"avatar_url":"https://avatars.githubusercontent.com/u/592032?v=3","gravatar_id":"","url":"https://api.github.com/users/armon","html_url":"https://github.com/armon","followers_url":"https://api.github.com/users/armon/followers","following_url":"https://api.github.com/users/armon/following{/other_user}","gists_url":"https://api.github.com/users/armon/gists{/gist_id}","starred_url":"https://api.github.com/users/armon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/armon/subscriptions","organizations_url":"https://api.github.com/users/armon/orgs","repos_url":"https://api.github.com/users/armon/repos","events_url":"https://api.github.com/users/armon/events{/privacy}","received_events_url":"https://api.github.com/users/armon/received_events","type":"User","site_admin":false},"body":"I'm sure this is part of the WIP, but eventually non-root would be good :)","created_at":"2015-05-06T18:16:10Z","updated_at":"2015-05-06T18:16:10Z","html_url":"https://github.com/hashicorp/vault/pull/151#discussion_r29785954","pull_request_url":"https://api.github.com/repos/hashicorp/vault/pulls/151","_links":{"self":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/comments/29785954"},"html":{"href":"https://github.com/hashicorp/vault/pull/151#discussion_r29785954"},"pull_request":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/151"}}},"pull_request":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/151","id":34798857,"html_url":"https://github.com/hashicorp/vault/pull/151","diff_url":"https://github.com/hashicorp/vault/pull/151.diff","patch_url":"https://github.com/hashicorp/vault/pull/151.patch","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/151","number":151,"state":"open","locked":false,"title":"Implementation of the LDAP credential backend","user":{"login":"rasky","id":1014109,"avatar_url":"https://avatars.githubusercontent.com/u/1014109?v=3","gravatar_id":"","url":"https://api.github.com/users/rasky","html_url":"https://github.com/rasky","followers_url":"https://api.github.com/users/rasky/followers","following_url":"https://api.github.com/users/rasky/following{/other_user}","gists_url":"https://api.github.com/users/rasky/gists{/gist_id}","starred_url":"https://api.github.com/users/rasky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rasky/subscriptions","organizations_url":"https://api.github.com/users/rasky/orgs","repos_url":"https://api.github.com/users/rasky/repos","events_url":"https://api.github.com/users/rasky/events{/privacy}","received_events_url":"https://api.github.com/users/rasky/received_events","type":"User","site_admin":false},"body":"**This is an early, incomplete PR, just for review** - @armon - Fixes #94 \r\n\r\nAuthentication part is done (though I'm not sure all configuration knobs are exposed), but it's still missing authorization part. I plan to expose an endpoint to configure a mapping between LDAP groups and policies.\r\n\r\nOne thing to notice is that I don't have much experience with Microsoft AD, we use openldap on Linux. So there might be some fixes and/or additional configuration to make the module fully compatible with AD. If somebody wants to provide early testing / feedback, it would be great.\r\n\r\n - [x] Basic authentication via binding\r\n - [x] Support plain and SSL\r\n - [ ] Implement authorization via LDAP groups\r\n - [ ] Decide how to implement auto renew\r\n - [ ] Decide how to do testing\r\n - [ ] Update documentation\r\n\r\nExample of usage:\r\n\r\n```\r\n$ vault auth-enable ldap\r\n$ vault write auth/ldap/config url=ldaps://ldap.example.com domain=\"ou=Users,dc=example,dc=com\"\r\n$ vault auth -method=ldap username=john\r\nPassword (will be hidden):\r\nSuccessfully authenticated! The policies that are associated\r\nwith this token are listed below:\r\n\r\nroot\r\n```\r\n","created_at":"2015-05-06T08:59:49Z","updated_at":"2015-05-06T18:16:10Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f7b54c78e384ea9412504f27257e44598fa81178","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/hashicorp/vault/pulls/151/commits","review_comments_url":"https://api.github.com/repos/hashicorp/vault/pulls/151/comments","review_comment_url":"https://api.github.com/repos/hashicorp/vault/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/151/comments","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/fadee1f87d58aa07ad44dfb569c23ddc4e53e0f1","head":{"label":"rasky:ldap","ref":"ldap","sha":"fadee1f87d58aa07ad44dfb569c23ddc4e53e0f1","user":{"login":"rasky","id":1014109,"avatar_url":"https://avatars.githubusercontent.com/u/1014109?v=3","gravatar_id":"","url":"https://api.github.com/users/rasky","html_url":"https://github.com/rasky","followers_url":"https://api.github.com/users/rasky/followers","following_url":"https://api.github.com/users/rasky/following{/other_user}","gists_url":"https://api.github.com/users/rasky/gists{/gist_id}","starred_url":"https://api.github.com/users/rasky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rasky/subscriptions","organizations_url":"https://api.github.com/users/rasky/orgs","repos_url":"https://api.github.com/users/rasky/repos","events_url":"https://api.github.com/users/rasky/events{/privacy}","received_events_url":"https://api.github.com/users/rasky/received_events","type":"User","site_admin":false},"repo":{"id":35133895,"name":"vault","full_name":"rasky/vault","owner":{"login":"rasky","id":1014109,"avatar_url":"https://avatars.githubusercontent.com/u/1014109?v=3","gravatar_id":"","url":"https://api.github.com/users/rasky","html_url":"https://github.com/rasky","followers_url":"https://api.github.com/users/rasky/followers","following_url":"https://api.github.com/users/rasky/following{/other_user}","gists_url":"https://api.github.com/users/rasky/gists{/gist_id}","starred_url":"https://api.github.com/users/rasky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rasky/subscriptions","organizations_url":"https://api.github.com/users/rasky/orgs","repos_url":"https://api.github.com/users/rasky/repos","events_url":"https://api.github.com/users/rasky/events{/privacy}","received_events_url":"https://api.github.com/users/rasky/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rasky/vault","description":"A tool for managing secrets.","fork":true,"url":"https://api.github.com/repos/rasky/vault","forks_url":"https://api.github.com/repos/rasky/vault/forks","keys_url":"https://api.github.com/repos/rasky/vault/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rasky/vault/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rasky/vault/teams","hooks_url":"https://api.github.com/repos/rasky/vault/hooks","issue_events_url":"https://api.github.com/repos/rasky/vault/issues/events{/number}","events_url":"https://api.github.com/repos/rasky/vault/events","assignees_url":"https://api.github.com/repos/rasky/vault/assignees{/user}","branches_url":"https://api.github.com/repos/rasky/vault/branches{/branch}","tags_url":"https://api.github.com/repos/rasky/vault/tags","blobs_url":"https://api.github.com/repos/rasky/vault/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rasky/vault/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rasky/vault/git/refs{/sha}","trees_url":"https://api.github.com/repos/rasky/vault/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rasky/vault/statuses/{sha}","languages_url":"https://api.github.com/repos/rasky/vault/languages","stargazers_url":"https://api.github.com/repos/rasky/vault/stargazers","contributors_url":"https://api.github.com/repos/rasky/vault/contributors","subscribers_url":"https://api.github.com/repos/rasky/vault/subscribers","subscription_url":"https://api.github.com/repos/rasky/vault/subscription","commits_url":"https://api.github.com/repos/rasky/vault/commits{/sha}","git_commits_url":"https://api.github.com/repos/rasky/vault/git/commits{/sha}","comments_url":"https://api.github.com/repos/rasky/vault/comments{/number}","issue_comment_url":"https://api.github.com/repos/rasky/vault/issues/comments{/number}","contents_url":"https://api.github.com/repos/rasky/vault/contents/{+path}","compare_url":"https://api.github.com/repos/rasky/vault/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rasky/vault/merges","archive_url":"https://api.github.com/repos/rasky/vault/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rasky/vault/downloads","issues_url":"https://api.github.com/repos/rasky/vault/issues{/number}","pulls_url":"https://api.github.com/repos/rasky/vault/pulls{/number}","milestones_url":"https://api.github.com/repos/rasky/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/rasky/vault/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rasky/vault/labels{/name}","releases_url":"https://api.github.com/repos/rasky/vault/releases{/id}","created_at":"2015-05-06T01:54:39Z","updated_at":"2015-05-06T01:54:40Z","pushed_at":"2015-05-06T01:55:21Z","git_url":"git://github.com/rasky/vault.git","ssh_url":"git@github.com:rasky/vault.git","clone_url":"https://github.com/rasky/vault.git","svn_url":"https://github.com/rasky/vault","homepage":"http://vaultproject.io","size":5415,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"hashicorp:master","ref":"master","sha":"f2cab3d0f9e2ed03f1044b6f6d3a93160dff1da5","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":31288958,"name":"vault","full_name":"hashicorp/vault","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/vault","description":"A tool for managing secrets.","fork":false,"url":"https://api.github.com/repos/hashicorp/vault","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/vault/events","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","created_at":"2015-02-25T00:15:59Z","updated_at":"2015-05-06T18:08:29Z","pushed_at":"2015-05-06T18:08:29Z","git_url":"git://github.com/hashicorp/vault.git","ssh_url":"git@github.com:hashicorp/vault.git","clone_url":"https://github.com/hashicorp/vault.git","svn_url":"https://github.com/hashicorp/vault","homepage":"http://vaultproject.io","size":5415,"stargazers_count":2069,"watchers_count":2069,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":71,"mirror_url":null,"open_issues_count":28,"forks":71,"open_issues":28,"watchers":2069,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/151"},"html":{"href":"https://github.com/hashicorp/vault/pull/151"},"issue":{"href":"https://api.github.com/repos/hashicorp/vault/issues/151"},"comments":{"href":"https://api.github.com/repos/hashicorp/vault/issues/151/comments"},"review_comments":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/151/comments"},"review_comment":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/151/commits"},"statuses":{"href":"https://api.github.com/repos/hashicorp/vault/statuses/fadee1f87d58aa07ad44dfb569c23ddc4e53e0f1"}}}}