login record CRD (#2565)

* Signed-off-by: hongming <talonwan@yunify.com>

support ldap identity provider

Signed-off-by: hongming <talonwan@yunify.com>

* add login record

Signed-off-by: Jeff <zw0948@gmail.com>

Co-authored-by: hongming <talonwan@yunify.com>

pkg/apiserver/authentication/identityprovider/github/github.go

@@ -99,7 +99,7 @@ type GithubIdentity struct {
 }
 
 func init() {
-	identityprovider.RegisterOAuthProviderCodec(&Github{})
+	identityprovider.RegisterOAuthProvider(&Github{})
 }
 
 func (g *Github) Type() string {

pkg/apiserver/authentication/identityprovider/identity_provider.go

@@ -16,33 +16,7 @@ limitations under the License.
 
 package identityprovider
 
-import (
-	"errors"
-	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
-)
-
-var (
-	ErrorIdentityProviderNotFound = errors.New("the identity provider was not found")
-	oauthProviders                = make(map[string]OAuthProvider, 0)
-)
-
-type OAuthProvider interface {
-	Type() string
-	Setup(options *oauth.DynamicOptions) (OAuthProvider, error)
-	IdentityExchange(code string) (Identity, error)
-}
 type Identity interface {
 	GetName() string
 	GetEmail() string
 }
-
-func GetOAuthProvider(providerType string, options *oauth.DynamicOptions) (OAuthProvider, error) {
-	if provider, ok := oauthProviders[providerType]; ok {
-		return provider.Setup(options)
-	}
-	return nil, ErrorIdentityProviderNotFound
-}
-
-func RegisterOAuthProviderCodec(provider OAuthProvider) {
-	oauthProviders[provider.Type()] = provider
-}

pkg/apiserver/authentication/identityprovider/ldap_provider.go

@@ -0,0 +1,117 @@
+/*
+
+ Copyright 2020 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package identityprovider
+
+import (
+	"fmt"
+	"github.com/go-ldap/ldap"
+	"gopkg.in/yaml.v3"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/klog"
+	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
+)
+
+const LdapIdentityProvider = "LDAPIdentityProvider"
+
+type LdapProvider interface {
+	Authenticate(username string, password string) (*iamv1alpha2.User, error)
+}
+
+type ldapOptions struct {
+	Host            string `json:"host" yaml:"host"`
+	ManagerDN       string `json:"managerDN"  yaml:"managerDN"`
+	ManagerPassword string `json:"-"  yaml:"managerPassword"`
+	UserSearchBase  string `json:"userSearchBase"  yaml:"userSearchBase"`
+	//This is typically uid
+	LoginAttribute       string `json:"loginAttribute" yaml:"loginAttribute"`
+	MailAttribute        string `json:"mailAttribute" yaml:"mailAttribute"`
+	DisplayNameAttribute string `json:"displayNameAttribute" yaml:"displayNameAttribute"`
+}
+
+type ldapProvider struct {
+	options ldapOptions
+}
+
+func NewLdapProvider(options *oauth.DynamicOptions) (LdapProvider, error) {
+	data, err := yaml.Marshal(options)
+	if err != nil {
+		return nil, err
+	}
+	var ldapOptions ldapOptions
+	err = yaml.Unmarshal(data, &ldapOptions)
+	if err != nil {
+		return nil, err
+	}
+	return &ldapProvider{options: ldapOptions}, nil
+}
+
+func (l ldapProvider) Authenticate(username string, password string) (*iamv1alpha2.User, error) {
+	conn, err := ldap.Dial("tcp", l.options.Host)
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+	defer conn.Close()
+	err = conn.Bind(l.options.ManagerDN, l.options.ManagerPassword)
+
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+
+	filter := fmt.Sprintf("(&(%s=%s))", l.options.LoginAttribute, username)
+
+	result, err := conn.Search(&ldap.SearchRequest{
+		BaseDN:       l.options.UserSearchBase,
+		Scope:        ldap.ScopeWholeSubtree,
+		DerefAliases: ldap.NeverDerefAliases,
+		SizeLimit:    1,
+		TimeLimit:    0,
+		TypesOnly:    false,
+		Filter:       filter,
+		Attributes:   []string{l.options.LoginAttribute, l.options.MailAttribute, l.options.DisplayNameAttribute},
+	})
+
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+
+	if len(result.Entries) == 1 {
+		entry := result.Entries[0]
+		err = conn.Bind(entry.DN, password)
+		if err != nil {
+			klog.Error(err)
+			return nil, err
+		}
+
+		return &iamv1alpha2.User{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: username,
+			},
+			Spec: iamv1alpha2.UserSpec{
+				Email:       entry.GetAttributeValue(l.options.MailAttribute),
+				DisplayName: entry.GetAttributeValue(l.options.DisplayNameAttribute),
+			},
+		}, nil
+	}
+
+	return nil, ldap.NewError(ldap.LDAPResultNoSuchObject, fmt.Errorf(" could not find user %s in LDAP directory", username))
+}

pkg/apiserver/authentication/identityprovider/oauth_provider.go

@@ -0,0 +1,46 @@
+/*
+
+ Copyright 2020 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package identityprovider
+
+import (
+	"errors"
+	"kubesphere.io/kubesphere/pkg/apiserver/authentication/oauth"
+)
+
+var (
+	oauthProviders                = make(map[string]OAuthProvider, 0)
+	ErrorIdentityProviderNotFound = errors.New("the identity provider was not found")
+)
+
+type OAuthProvider interface {
+	Type() string
+	Setup(options *oauth.DynamicOptions) (OAuthProvider, error)
+	IdentityExchange(code string) (Identity, error)
+}
+
+func GetOAuthProvider(providerType string, options *oauth.DynamicOptions) (OAuthProvider, error) {
+	if provider, ok := oauthProviders[providerType]; ok {
+		return provider.Setup(options)
+	}
+	return nil, ErrorIdentityProviderNotFound
+}
+
+func RegisterOAuthProvider(provider OAuthProvider) {
+	oauthProviders[provider.Type()] = provider
+}