OP#792 initial commit after fork

internal/config/identity/ldap/config.go

@@ -0,0 +1,331 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ldap
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"sort"
+	"time"
+
+	"github.com/minio/madmin-go/v3"
+	"github.com/minio/minio/internal/config"
+	"github.com/minio/minio/internal/crypto"
+	"github.com/minio/pkg/v3/ldap"
+)
+
+const (
+	defaultLDAPExpiry = time.Hour * 1
+
+	minLDAPExpiry time.Duration = 15 * time.Minute
+	maxLDAPExpiry time.Duration = 365 * 24 * time.Hour
+)
+
+// Config contains AD/LDAP server connectivity information.
+type Config struct {
+	LDAP ldap.Config
+
+	stsExpiryDuration time.Duration // contains converted value
+}
+
+// Enabled returns if LDAP is enabled.
+func (l *Config) Enabled() bool {
+	return l.LDAP.Enabled
+}
+
+// Clone returns a cloned copy of LDAP config.
+func (l *Config) Clone() Config {
+	if l == nil {
+		return Config{}
+	}
+	cfg := Config{
+		LDAP:              l.LDAP.Clone(),
+		stsExpiryDuration: l.stsExpiryDuration,
+	}
+	return cfg
+}
+
+// LDAP keys and envs.
+const (
+	ServerAddr         = "server_addr"
+	SRVRecordName      = "srv_record_name"
+	LookupBindDN       = "lookup_bind_dn"
+	LookupBindPassword = "lookup_bind_password"
+	UserDNSearchBaseDN = "user_dn_search_base_dn"
+	UserDNSearchFilter = "user_dn_search_filter"
+	UserDNAttributes   = "user_dn_attributes"
+	GroupSearchFilter  = "group_search_filter"
+	GroupSearchBaseDN  = "group_search_base_dn"
+	TLSSkipVerify      = "tls_skip_verify"
+	ServerInsecure     = "server_insecure"
+	ServerStartTLS     = "server_starttls"
+
+	EnvServerAddr         = "MINIO_IDENTITY_LDAP_SERVER_ADDR"
+	EnvSRVRecordName      = "MINIO_IDENTITY_LDAP_SRV_RECORD_NAME"
+	EnvTLSSkipVerify      = "MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY"
+	EnvServerInsecure     = "MINIO_IDENTITY_LDAP_SERVER_INSECURE"
+	EnvServerStartTLS     = "MINIO_IDENTITY_LDAP_SERVER_STARTTLS"
+	EnvUsernameFormat     = "MINIO_IDENTITY_LDAP_USERNAME_FORMAT"
+	EnvUserDNSearchBaseDN = "MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN"
+	EnvUserDNSearchFilter = "MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER"
+	EnvUserDNAttributes   = "MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES"
+	EnvGroupSearchFilter  = "MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER"
+	EnvGroupSearchBaseDN  = "MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN"
+	EnvLookupBindDN       = "MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN"
+	EnvLookupBindPassword = "MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD"
+)
+
+var removedKeys = []string{
+	"sts_expiry",
+	"username_format",
+	"username_search_filter",
+	"username_search_base_dn",
+	"group_name_attribute",
+}
+
+// DefaultKVS - default config for LDAP config
+var (
+	DefaultKVS = config.KVS{
+		config.KV{
+			Key:   config.Enable,
+			Value: "",
+		},
+		config.KV{
+			Key:   ServerAddr,
+			Value: "",
+		},
+		config.KV{
+			Key:   SRVRecordName,
+			Value: "",
+		},
+		config.KV{
+			Key:   UserDNSearchBaseDN,
+			Value: "",
+		},
+		config.KV{
+			Key:   UserDNSearchFilter,
+			Value: "",
+		},
+		config.KV{
+			Key:   UserDNAttributes,
+			Value: "",
+		},
+		config.KV{
+			Key:   GroupSearchFilter,
+			Value: "",
+		},
+		config.KV{
+			Key:   GroupSearchBaseDN,
+			Value: "",
+		},
+		config.KV{
+			Key:   TLSSkipVerify,
+			Value: config.EnableOff,
+		},
+		config.KV{
+			Key:   ServerInsecure,
+			Value: config.EnableOff,
+		},
+		config.KV{
+			Key:   ServerStartTLS,
+			Value: config.EnableOff,
+		},
+		config.KV{
+			Key:   LookupBindDN,
+			Value: "",
+		},
+		config.KV{
+			Key:   LookupBindPassword,
+			Value: "",
+		},
+	}
+)
+
+// Enabled returns if LDAP config is enabled.
+func Enabled(kvs config.KVS) bool {
+	return kvs.Get(ServerAddr) != ""
+}
+
+// Lookup - initializes LDAP config, overrides config, if any ENV values are set.
+func Lookup(s config.Config, rootCAs *x509.CertPool) (l Config, err error) {
+	l = Config{}
+
+	// Purge all removed keys first
+	kvs := s[config.IdentityLDAPSubSys][config.Default]
+	if len(kvs) > 0 {
+		for _, k := range removedKeys {
+			kvs.Delete(k)
+		}
+		s[config.IdentityLDAPSubSys][config.Default] = kvs
+	}
+
+	if err := s.CheckValidKeys(config.IdentityLDAPSubSys, removedKeys); err != nil {
+		return l, err
+	}
+
+	getCfgVal := func(cfgParam string) string {
+		// As parameters are already validated, we skip checking
+		// if the config param was found.
+		val, _, _ := s.ResolveConfigParam(config.IdentityLDAPSubSys, config.Default, cfgParam, false)
+		return val
+	}
+
+	ldapServer := getCfgVal(ServerAddr)
+	if ldapServer == "" {
+		return l, nil
+	}
+
+	// Set ServerName in TLS config for proper certificate validation
+	host, _, err := net.SplitHostPort(ldapServer)
+	if err != nil {
+		host = ldapServer
+	}
+
+	l.LDAP = ldap.Config{
+		ServerAddr:    ldapServer,
+		SRVRecordName: getCfgVal(SRVRecordName),
+		TLS: &tls.Config{
+			ServerName:         host,
+			MinVersion:         tls.VersionTLS12,
+			NextProtos:         []string{"h2", "http/1.1"},
+			ClientSessionCache: tls.NewLRUClientSessionCache(100),
+			CipherSuites:       crypto.TLSCiphersBackwardCompatible(), // Contains RSA key exchange
+			RootCAs:            rootCAs,
+		},
+	}
+
+	// Parse explicitly set enable=on/off flag.
+	isEnableFlagExplicitlySet := false
+	if v := getCfgVal(config.Enable); v != "" {
+		isEnableFlagExplicitlySet = true
+		l.LDAP.Enabled, err = config.ParseBool(v)
+		if err != nil {
+			return l, err
+		}
+	}
+
+	l.stsExpiryDuration = defaultLDAPExpiry
+
+	// LDAP connection configuration
+	if v := getCfgVal(ServerInsecure); v != "" {
+		l.LDAP.ServerInsecure, err = config.ParseBool(v)
+		if err != nil {
+			return l, err
+		}
+	}
+	if v := getCfgVal(ServerStartTLS); v != "" {
+		l.LDAP.ServerStartTLS, err = config.ParseBool(v)
+		if err != nil {
+			return l, err
+		}
+	}
+	if v := getCfgVal(TLSSkipVerify); v != "" {
+		l.LDAP.TLS.InsecureSkipVerify, err = config.ParseBool(v)
+		if err != nil {
+			return l, err
+		}
+	}
+
+	// Lookup bind user configuration
+	l.LDAP.LookupBindDN = getCfgVal(LookupBindDN)
+	l.LDAP.LookupBindPassword = getCfgVal(LookupBindPassword)
+
+	// User DN search configuration
+	l.LDAP.UserDNSearchFilter = getCfgVal(UserDNSearchFilter)
+	l.LDAP.UserDNSearchBaseDistName = getCfgVal(UserDNSearchBaseDN)
+	l.LDAP.UserDNAttributes = getCfgVal(UserDNAttributes)
+
+	// Group search params configuration
+	l.LDAP.GroupSearchFilter = getCfgVal(GroupSearchFilter)
+	l.LDAP.GroupSearchBaseDistName = getCfgVal(GroupSearchBaseDN)
+
+	// If enable flag was not explicitly set, we treat it as implicitly set at
+	// this point as necessary configuration is available.
+	if !isEnableFlagExplicitlySet && !l.LDAP.Enabled {
+		l.LDAP.Enabled = true
+	}
+	// Validate and test configuration.
+	valResult := l.LDAP.Validate()
+	if !valResult.IsOk() {
+		// Set to false if configuration fails to validate.
+		l.LDAP.Enabled = false
+		return l, valResult
+	}
+
+	return l, nil
+}
+
+// GetConfigList - returns a list of LDAP configurations.
+func (l *Config) GetConfigList(s config.Config) ([]madmin.IDPListItem, error) {
+	ldapConfigs, err := s.GetAvailableTargets(config.IdentityLDAPSubSys)
+	if err != nil {
+		return nil, err
+	}
+
+	// For now, ldapConfigs will only have a single entry for the default
+	// configuration.
+
+	var res []madmin.IDPListItem
+	for _, cfg := range ldapConfigs {
+		res = append(res, madmin.IDPListItem{
+			Type:    "ldap",
+			Name:    cfg,
+			Enabled: l.Enabled(),
+		})
+	}
+
+	return res, nil
+}
+
+// ErrProviderConfigNotFound - represents a non-existing provider error.
+var ErrProviderConfigNotFound = errors.New("provider configuration not found")
+
+// GetConfigInfo - returns config details for an LDAP configuration.
+func (l *Config) GetConfigInfo(s config.Config, cfgName string) ([]madmin.IDPCfgInfo, error) {
+	// For now only a single LDAP config is supported.
+	if cfgName != madmin.Default {
+		return nil, ErrProviderConfigNotFound
+	}
+	kvsrcs, err := s.GetResolvedConfigParams(config.IdentityLDAPSubSys, cfgName, true)
+	if err != nil {
+		return nil, err
+	}
+
+	res := make([]madmin.IDPCfgInfo, 0, len(kvsrcs))
+	for _, kvsrc := range kvsrcs {
+		// skip default values.
+		if kvsrc.Src == config.ValueSourceDef {
+			continue
+		}
+		res = append(res, madmin.IDPCfgInfo{
+			Key:   kvsrc.Key,
+			Value: kvsrc.Value,
+			IsCfg: true,
+			IsEnv: kvsrc.Src == config.ValueSourceEnv,
+		})
+	}
+
+	// sort the structs by the key
+	sort.Slice(res, func(i, j int) bool {
+		return res[i].Key < res[j].Key
+	})
+
+	return res, nil
+}

internal/config/identity/ldap/help.go

@@ -0,0 +1,112 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ldap
+
+import "github.com/minio/minio/internal/config"
+
+// Help template for LDAP identity feature.
+var (
+	defaultHelpPostfix = func(key string) string {
+		return config.DefaultHelpPostfix(DefaultKVS, key)
+	}
+
+	Help = config.HelpKVS{
+		config.HelpKV{
+			Key:         ServerAddr,
+			Description: `AD/LDAP server address e.g. "myldap.com" or "myldapserver.com:636"` + defaultHelpPostfix(ServerAddr),
+			Type:        "address",
+			Sensitive:   true,
+		},
+		config.HelpKV{
+			Key:         SRVRecordName,
+			Description: `DNS SRV record name for LDAP service, if given, must be one of "ldap", "ldaps" or "on"` + defaultHelpPostfix(SRVRecordName),
+			Optional:    true,
+			Type:        "string",
+			Sensitive:   false,
+		},
+		config.HelpKV{
+			Key:         LookupBindDN,
+			Description: `DN for LDAP read-only service account used to perform DN and group lookups` + defaultHelpPostfix(LookupBindDN),
+			Optional:    true,
+			Type:        "string",
+			Sensitive:   true,
+		},
+		config.HelpKV{
+			Key:         LookupBindPassword,
+			Description: `Password for LDAP read-only service account used to perform DN and group lookups` + defaultHelpPostfix(LookupBindPassword),
+			Optional:    true,
+			Type:        "string",
+			Sensitive:   true,
+			Secret:      true,
+		},
+		config.HelpKV{
+			Key:         UserDNSearchBaseDN,
+			Description: `";" separated list of user search base DNs e.g. "dc=myldapserver,dc=com"` + defaultHelpPostfix(UserDNSearchBaseDN),
+			Optional:    true,
+			Type:        "list",
+		},
+		config.HelpKV{
+			Key:         UserDNSearchFilter,
+			Description: `Search filter to lookup user DN` + defaultHelpPostfix(UserDNSearchFilter),
+			Optional:    true,
+			Type:        "string",
+		},
+		config.HelpKV{
+			Key:         UserDNAttributes,
+			Description: `"," separated list of user DN attributes e.g. "uid,cn,mail,sshPublicKey"` + defaultHelpPostfix(UserDNAttributes),
+			Optional:    true,
+			Type:        "list",
+		},
+		config.HelpKV{
+			Key:         GroupSearchFilter,
+			Description: `search filter for groups e.g. "(&(objectclass=groupOfNames)(memberUid=%s))"` + defaultHelpPostfix(GroupSearchFilter),
+			Optional:    true,
+			Type:        "string",
+		},
+		config.HelpKV{
+			Key:         GroupSearchBaseDN,
+			Description: `";" separated list of group search base DNs e.g. "dc=myldapserver,dc=com"` + defaultHelpPostfix(GroupSearchBaseDN),
+			Optional:    true,
+			Type:        "list",
+		},
+		config.HelpKV{
+			Key:         TLSSkipVerify,
+			Description: `trust server TLS without verification` + defaultHelpPostfix(TLSSkipVerify),
+			Optional:    true,
+			Type:        "on|off",
+		},
+		config.HelpKV{
+			Key:         ServerInsecure,
+			Description: `allow plain text connection to AD/LDAP server` + defaultHelpPostfix(ServerInsecure),
+			Optional:    true,
+			Type:        "on|off",
+		},
+		config.HelpKV{
+			Key:         ServerStartTLS,
+			Description: `use StartTLS connection to AD/LDAP server` + defaultHelpPostfix(ServerStartTLS),
+			Optional:    true,
+			Type:        "on|off",
+		},
+		config.HelpKV{
+			Key:         config.Comment,
+			Description: config.DefaultComment,
+			Optional:    true,
+			Type:        "sentence",
+		},
+	}
+)

internal/config/identity/ldap/ldap.go

@@ -0,0 +1,422 @@
+// Copyright (c) 2015-2022 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ldap
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	ldap "github.com/go-ldap/ldap/v3"
+	"github.com/minio/minio-go/v7/pkg/set"
+	"github.com/minio/minio/internal/auth"
+	xldap "github.com/minio/pkg/v3/ldap"
+)
+
+// LookupUserDN searches for the full DN and groups of a given short/login
+// username.
+func (l *Config) LookupUserDN(username string) (*xldap.DNSearchResult, []string, error) {
+	conn, err := l.LDAP.Connect()
+	if err != nil {
+		return nil, nil, err
+	}
+	defer conn.Close()
+
+	// Bind to the lookup user account
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, nil, err
+	}
+
+	// Lookup user DN
+	lookupRes, err := l.LDAP.LookupUsername(conn, username)
+	if err != nil {
+		errRet := fmt.Errorf("Unable to find user DN: %w", err)
+		return nil, nil, errRet
+	}
+
+	groups, err := l.LDAP.SearchForUserGroups(conn, username, lookupRes.ActualDN)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return lookupRes, groups, nil
+}
+
+// GetValidatedDNForUsername checks if the given username exists in the LDAP directory.
+// The given username could be just the short "login" username or the full DN.
+//
+// When the username/DN is found, the full DN returned by the **server** is
+// returned, otherwise the returned string is empty. The value returned here is
+// the value sent by the LDAP server and is used in minio as the server performs
+// LDAP specific normalization (including Unicode normalization).
+//
+// If the user is not found, err = nil, otherwise, err != nil.
+func (l *Config) GetValidatedDNForUsername(username string) (*xldap.DNSearchResult, error) {
+	conn, err := l.LDAP.Connect()
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	// Bind to the lookup user account
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, err
+	}
+
+	// Check if the passed in username is a valid DN.
+	if !l.ParsesAsDN(username) {
+		// We consider it as a login username and attempt to check it exists in
+		// the directory.
+		bindDN, err := l.LDAP.LookupUsername(conn, username)
+		if err != nil {
+			if strings.Contains(err.Error(), "User DN not found for") {
+				return nil, nil
+			}
+			return nil, fmt.Errorf("Unable to find user DN: %w", err)
+		}
+		return bindDN, nil
+	}
+
+	// Since the username parses as a valid DN, check that it exists and is
+	// under a configured base DN in the LDAP directory.
+	validDN, isUnderBaseDN, err := l.GetValidatedUserDN(conn, username)
+	if err == nil && !isUnderBaseDN {
+		// Not under any configured base DN, so treat as not found.
+		return nil, nil
+	}
+	return validDN, err
+}
+
+// GetValidatedUserDN validates the given user DN. Will error out if conn is nil. The returned
+// boolean is true iff the user DN is found under one of the LDAP user base DNs.
+func (l *Config) GetValidatedUserDN(conn *ldap.Conn, userDN string) (*xldap.DNSearchResult, bool, error) {
+	return l.GetValidatedDNUnderBaseDN(conn, userDN,
+		l.LDAP.GetUserDNSearchBaseDistNames(), l.LDAP.GetUserDNAttributesList())
+}
+
+// GetValidatedGroupDN validates the given group DN. If conn is nil, creates a
+// connection. The returned boolean is true iff the group DN is found under one
+// of the configured LDAP base DNs.
+func (l *Config) GetValidatedGroupDN(conn *ldap.Conn, groupDN string) (*xldap.DNSearchResult, bool, error) {
+	if conn == nil {
+		var err error
+		conn, err = l.LDAP.Connect()
+		if err != nil {
+			return nil, false, err
+		}
+		defer conn.Close()
+
+		// Bind to the lookup user account
+		if err = l.LDAP.LookupBind(conn); err != nil {
+			return nil, false, err
+		}
+	}
+
+	return l.GetValidatedDNUnderBaseDN(conn, groupDN,
+		l.LDAP.GetGroupSearchBaseDistNames(), nil)
+}
+
+// GetValidatedDNUnderBaseDN checks if the given DN exists in the LDAP
+// directory.
+//
+// The `NormDN` value returned here in the search result may not be equal to the
+// input DN, as LDAP equality is not a simple Golang string equality. However,
+// we assume the value returned by the LDAP server is canonical. Additionally,
+// the attribute type names in the DN are lower-cased.
+//
+// Return values:
+//
+// If the DN is found, the normalized (string) value and any requested
+// attributes are returned and error is nil.
+//
+// If the DN is not found, a nil result and error are returned.
+//
+// The returned boolean is true iff the DN is found under one of the LDAP
+// subtrees listed in `baseDNList`.
+func (l *Config) GetValidatedDNUnderBaseDN(conn *ldap.Conn, dn string, baseDNList []xldap.BaseDNInfo, attrs []string) (*xldap.DNSearchResult, bool, error) {
+	if len(baseDNList) == 0 {
+		return nil, false, errors.New("no Base DNs given")
+	}
+
+	// Check that DN exists in the LDAP directory.
+	searchRes, err := xldap.LookupDN(conn, dn, attrs)
+	if err != nil {
+		return nil, false, fmt.Errorf("Error looking up DN %s: %w", dn, err)
+	}
+	if searchRes == nil {
+		return nil, false, nil
+	}
+
+	// This will not return an error as the argument is validated to be a DN.
+	pdn, _ := ldap.ParseDN(searchRes.NormDN)
+
+	// Check that the DN is under a configured base DN in the LDAP
+	// directory.
+	for _, baseDN := range baseDNList {
+		if baseDN.Parsed.AncestorOf(pdn) {
+			return searchRes, true, nil
+		}
+	}
+
+	// Not under any configured base DN so return false.
+	return searchRes, false, nil
+}
+
+// GetValidatedDNWithGroups - Gets validated DN from given DN or short username
+// and returns the DN and the groups the user is a member of.
+//
+// If username is required in group search but a DN is passed, no groups are
+// returned.
+func (l *Config) GetValidatedDNWithGroups(username string) (*xldap.DNSearchResult, []string, error) {
+	conn, err := l.LDAP.Connect()
+	if err != nil {
+		return nil, nil, err
+	}
+	defer conn.Close()
+
+	// Bind to the lookup user account
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, nil, err
+	}
+
+	var lookupRes *xldap.DNSearchResult
+	shortUsername := ""
+	// Check if the passed in username is a valid DN.
+	if !l.ParsesAsDN(username) {
+		// We consider it as a login username and attempt to check it exists in
+		// the directory.
+		lookupRes, err = l.LDAP.LookupUsername(conn, username)
+		if err != nil {
+			if strings.Contains(err.Error(), "User DN not found for") {
+				return nil, nil, nil
+			}
+			return nil, nil, fmt.Errorf("Unable to find user DN: %w", err)
+		}
+		shortUsername = username
+	} else {
+		// Since the username parses as a valid DN, check that it exists and is
+		// under a configured base DN in the LDAP directory.
+		var isUnderBaseDN bool
+		lookupRes, isUnderBaseDN, err = l.GetValidatedUserDN(conn, username)
+		if err == nil && !isUnderBaseDN {
+			return nil, nil, fmt.Errorf("Unable to find user DN: %w", err)
+		}
+	}
+
+	groups, err := l.LDAP.SearchForUserGroups(conn, shortUsername, lookupRes.ActualDN)
+	if err != nil {
+		return nil, nil, err
+	}
+	return lookupRes, groups, nil
+}
+
+// Bind - binds to ldap, searches LDAP and returns the distinguished name of the
+// user and the list of groups.
+func (l *Config) Bind(username, password string) (*xldap.DNSearchResult, []string, error) {
+	conn, err := l.LDAP.Connect()
+	if err != nil {
+		return nil, nil, err
+	}
+	defer conn.Close()
+
+	// Bind to the lookup user account
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, nil, err
+	}
+
+	// Lookup user DN
+	lookupResult, err := l.LDAP.LookupUsername(conn, username)
+	if err != nil {
+		errRet := fmt.Errorf("Unable to find user DN: %w", err)
+		return nil, nil, errRet
+	}
+
+	// Authenticate the user credentials.
+	err = conn.Bind(lookupResult.ActualDN, password)
+	if err != nil {
+		errRet := fmt.Errorf("LDAP auth failed for DN %s: %w", lookupResult.ActualDN, err)
+		return nil, nil, errRet
+	}
+
+	// Bind to the lookup user account again to perform group search.
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, nil, err
+	}
+
+	// User groups lookup.
+	groups, err := l.LDAP.SearchForUserGroups(conn, username, lookupResult.ActualDN)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return lookupResult, groups, nil
+}
+
+// GetExpiryDuration - return parsed expiry duration.
+func (l Config) GetExpiryDuration(dsecs string) (time.Duration, error) {
+	if dsecs == "" {
+		return l.stsExpiryDuration, nil
+	}
+
+	d, err := strconv.Atoi(dsecs)
+	if err != nil {
+		return 0, auth.ErrInvalidDuration
+	}
+
+	dur := time.Duration(d) * time.Second
+
+	if dur < minLDAPExpiry || dur > maxLDAPExpiry {
+		return 0, auth.ErrInvalidDuration
+	}
+	return dur, nil
+}
+
+// ParsesAsDN determines if the given string could be a valid DN based on
+// parsing alone.
+func (l Config) ParsesAsDN(dn string) bool {
+	_, err := ldap.ParseDN(dn)
+	return err == nil
+}
+
+// IsLDAPUserDN determines if the given string could be a user DN from LDAP.
+func (l Config) IsLDAPUserDN(user string) bool {
+	udn, err := ldap.ParseDN(user)
+	if err != nil {
+		return false
+	}
+	for _, baseDN := range l.LDAP.GetUserDNSearchBaseDistNames() {
+		if baseDN.Parsed.AncestorOf(udn) {
+			return true
+		}
+	}
+	return false
+}
+
+// IsLDAPGroupDN determines if the given string could be a group DN from LDAP.
+func (l Config) IsLDAPGroupDN(group string) bool {
+	gdn, err := ldap.ParseDN(group)
+	if err != nil {
+		return false
+	}
+	for _, baseDN := range l.LDAP.GetGroupSearchBaseDistNames() {
+		if baseDN.Parsed.AncestorOf(gdn) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetNonEligibleUserDistNames - find user accounts (DNs) that are no longer
+// present in the LDAP server or do not meet filter criteria anymore
+func (l *Config) GetNonEligibleUserDistNames(userDistNames []string) ([]string, error) {
+	conn, err := l.LDAP.Connect()
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	// Bind to the lookup user account
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, err
+	}
+
+	// Evaluate the filter again with generic wildcard instead of specific values
+	filter := strings.ReplaceAll(l.LDAP.UserDNSearchFilter, "%s", "*")
+
+	nonExistentUsers := []string{}
+	for _, dn := range userDistNames {
+		searchRequest := ldap.NewSearchRequest(
+			dn,
+			ldap.ScopeBaseObject, ldap.NeverDerefAliases, 0, 0, false,
+			filter,
+			[]string{}, // only need DN, so pass no attributes here
+			nil,
+		)
+
+		searchResult, err := conn.Search(searchRequest)
+		if err != nil {
+			// Object does not exist error?
+			if ldap.IsErrorWithCode(err, 32) {
+				ndn, err := ldap.ParseDN(dn)
+				if err != nil {
+					return nil, err
+				}
+				nonExistentUsers = append(nonExistentUsers, ndn.String())
+				continue
+			}
+			return nil, err
+		}
+		if len(searchResult.Entries) == 0 {
+			// DN was not found - this means this user account is
+			// expired.
+			ndn, err := ldap.ParseDN(dn)
+			if err != nil {
+				return nil, err
+			}
+			nonExistentUsers = append(nonExistentUsers, ndn.String())
+		}
+	}
+	return nonExistentUsers, nil
+}
+
+// LookupGroupMemberships - for each DN finds the set of LDAP groups they are a
+// member of.
+func (l *Config) LookupGroupMemberships(userDistNames []string, userDNToUsernameMap map[string]string) (map[string]set.StringSet, error) {
+	conn, err := l.LDAP.Connect()
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	// Bind to the lookup user account
+	if err = l.LDAP.LookupBind(conn); err != nil {
+		return nil, err
+	}
+
+	res := make(map[string]set.StringSet, len(userDistNames))
+	for _, userDistName := range userDistNames {
+		username := userDNToUsernameMap[userDistName]
+		groups, err := l.LDAP.SearchForUserGroups(conn, username, userDistName)
+		if err != nil {
+			return nil, err
+		}
+		res[userDistName] = set.CreateStringSet(groups...)
+	}
+
+	return res, nil
+}
+
+// QuickNormalizeDN - normalizes the given DN without checking if it is valid or
+// exists in the LDAP directory. Returns input if error
+func (l Config) QuickNormalizeDN(dn string) string {
+	if normDN, err := xldap.NormalizeDN(dn); err == nil {
+		return normDN
+	}
+	return dn
+}
+
+// DecodeDN - denormalizes the given DN by unescaping any escaped characters.
+// Returns input if error
+func (l Config) DecodeDN(dn string) string {
+	if decodedDN, err := xldap.DecodeDN(dn); err == nil {
+		return decodedDN
+	}
+	return dn
+}

internal/config/identity/ldap/legacy.go

@@ -0,0 +1,67 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package ldap
+
+import (
+	"github.com/minio/minio/internal/config"
+)
+
+// LegacyConfig contains AD/LDAP server connectivity information from old config
+// V33.
+type LegacyConfig struct {
+	Enabled bool `json:"enabled"`
+
+	// E.g. "ldap.minio.io:636"
+	ServerAddr string `json:"serverAddr"`
+
+	// User DN search parameters
+	UserDNSearchBaseDistName  string   `json:"userDNSearchBaseDN"`
+	UserDNSearchBaseDistNames []string `json:"-"` // Generated field
+	UserDNSearchFilter        string   `json:"userDNSearchFilter"`
+
+	// Group search parameters
+	GroupSearchBaseDistName  string   `json:"groupSearchBaseDN"`
+	GroupSearchBaseDistNames []string `json:"-"` // Generated field
+	GroupSearchFilter        string   `json:"groupSearchFilter"`
+
+	// Lookup bind LDAP service account
+	LookupBindDN       string `json:"lookupBindDN"`
+	LookupBindPassword string `json:"lookupBindPassword"`
+}
+
+// SetIdentityLDAP - One time migration code needed, for migrating from older config to new for LDAPConfig.
+func SetIdentityLDAP(s config.Config, ldapArgs LegacyConfig) {
+	if !ldapArgs.Enabled {
+		// ldap not enabled no need to preserve it in new settings.
+		return
+	}
+	s[config.IdentityLDAPSubSys][config.Default] = config.KVS{
+		config.KV{
+			Key:   ServerAddr,
+			Value: ldapArgs.ServerAddr,
+		},
+		config.KV{
+			Key:   GroupSearchFilter,
+			Value: ldapArgs.GroupSearchFilter,
+		},
+		config.KV{
+			Key:   GroupSearchBaseDN,
+			Value: ldapArgs.GroupSearchBaseDistName,
+		},
+	}
+}