feature (auth/ldap): add LDAP auth method along with associated accounts and managed groups (#2912)

* feature (auth): required schema changes for auth ldap method (#2669)

chore (auth/ldap): move schema changes to next avail migration number

* feature (auth/ldap): define AuthMethod and all its value objects (#2703)

* feature (auth/ldap): storage protos
* feature (auth/ldap): define AuthMethod and all its value objects

* feature (auth/ldap): add repo and reading an auth method (#2718)

* feature (auth/ldap): add Repository.CreateAuthMethod(...) and Repository.DeleteAuthMethod(...) (#2724)

* feature (auth/ldap): add Repository.UpdateAuthMethod(...) (#2739)

* feature (auth/ldap): add Account

* feature (auth/ldap): add AuthMethod.EnableGroups

* fix (auth/ldap): refactor AuthMethod.oplog to enforce proper constraints

* feature (auth/ldap): add Account repo functions

* refactor (auth/ldap): remove entry attributes from account

Realized the entry attributes could have absolutely anything in them
(including binary data) and since we absolutely don't have to have them
there's just no reason to take on the risk.

* feature (auth/ldap): add AuthMethod.UseTokenGroups

* feature (auth/ldap): add Authenticate(...)

* refactor (auth/ldap): ensure options take a context as the 1st parameter

* feature (auth/ldap): add Account attribute maps

* chore (auth/ldap): make fmt deltas

* feature (auth/ldap): add managed groups (#2760)

* tests (auth/ldap): add missing unit test to Repository.DeleteAccount(...)

Add bits to test the delete operation when you're not able to generate
oplog metadata

* feature (auth/ldap): add managed groups

fixup! feature (auth/ldap): add managed groups (#2760)

* feature (auth/ldap): service proto definition (#2761)

* feature (handlers/authmethods): add handlers for ldap auth method operations (#2794)

* feature (auth/ldap): add Account attribute maps

* chore (auth/ldap): update cap/ldap to latest version

* feature (auth/ldap): add ldap api generation definitions

* feature (authmethods): add ldap repo NewService(...)

* feature (authmethods/ldap): add proper mask_mapping to protobufs

* feature (authmethods): add support to get an ldap auth method

* refactor (auth/ldap): export TestGenerateCA(...)

* feature (authmethods): add support to create an ldap auth method

* feature (authmethods): add support to delete an ldap auth method

* feature (authmethods): add support to list ldap auth methods

* refactor (auth/ldap): make urls optional for NewAuthMethod(...)

* refactor (auth/ldap): export ldap.TestInvalidPem

* chore: make fmt changes

* fix (auth/ldap): properly handle group search config

Add constraints and tests to ensure when an ldap AuthMethod.EnableGroups
is true, and UseTokenGroups is false; that there's a GroupDn configured
for finding a user's associated groups

* feature (authmethods): add support to update an ldap auth methods

* chore (db/ldap): tmp mv migrations so there's no conflict with ongoing work

* feature (verifier): add ldap auth method to verifier bits

* fix (controller): prevent panic when controller stops when there's no listener

* feature (authmethods): add support to authenticate via ldap auth methods

* chore (migrations): fix whitespace in stmt

* chore: fmt fixup

* tests (auth/ldap): invalid err msg

* feature (cli/authmethods): add support for ldap auth-methods CRUD and authenticate (#2810)

* feature (authmethods): add CLI support for ldap auth methods CRUD

* tests (api/auth): ldap auth method classification tests

* feature (authmethods): add CLI support for ldap auth authenticate

* feature (auth/ldap): set request timeouts for ldap server connections

* feature (handlers/authmethods): handle u_anon listing properly.

* feature (account/handers): ldap account and managed group CRUDL APIs (#2852)

* feature (auth/ldap) add repository Listing of ManagedGroupMemberAccount

* feature (controller/handlers): add ldapRepoFn to accounts service

* feature (auth/ldap) register ldap managed group subtype

* feature (account/handlers): ldap account CRUDL APIs

* feature (controller/handlers): add ldapRepo to managed groups service

* feature (account/handlers): ldap managed group CRUDL APIs

* docs (domain): add LDAP accounts, auth-methods and managed groups (#2857)

* feature (ldap/cli) add ldap accounts and managed groups CRUDL commands (#2856)

* fix (handlers/authmethods): fix ldap authorized actions (#2892)

* feature (cli/ldap/authenticate): use primary auth method if none is provided (#2890)

* fix (auth/ldap): support setting the state attribute

* feature (cli/ldap/authenticate): use primary auth method if none is provided

* feature (wh/ldap) add tests for new ldap auth method and accounts (#2919)

* refactor (migrations/ldap): mv to correct directory

* chore: add copyright headers

* fix (api/authmethods/ldap): renumber new LdapAuthMethodAttributes field

* fix (auth/ldap): allow the auth method state to be updated (#2951)

* chore: update sdk and api versions for llb - this is tmp until merging

* tests (managed groups): add required errContains for new test

internal/proto/controller/api/resources/authmethods/v1/auth_method.proto

@@ -73,6 +73,11 @@ message AuthMethod {
       (custom_options.v1.subtype) = "oidc",
       (google.api.field_visibility).restriction = "INTERNAL"
     ];
+    LdapAuthMethodAttributes ldap_auth_methods_attributes = 103 [
+      (custom_options.v1.generate_sdk_option) = true,
+      (custom_options.v1.subtype) = "ldap",
+      (google.api.field_visibility).restriction = "INTERNAL"
+    ];
   }
 
   // Output only. Whether this auth method is the primary auth method for it's scope.
@@ -303,3 +308,266 @@ message OidcAuthMethodAuthenticateTokenResponse {
   // the consumer.
   string status = 10; // @gotags: `class:"public"`
 }
+
+// The attributes of an LDAP typed auth method.
+message LdapAuthMethodAttributes {
+  // Output only. The state of the auth method. Will be "inactive",
+  // "active-private", or "active-public".
+  string state = 10 [
+    json_name = "state",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.state"
+      that: "OperationalState"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // start_tls if true, issues a StartTLS command after establishing an
+  // unencrypted connection. Defaults to false.
+  bool start_tls = 20 [
+    json_name = "start_tls",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.start_tls"
+      that: "StartTls"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // insecure_tls if true, skips LDAP server SSL certificate validation -
+  // insecure and use with caution. Defaults to false.
+  bool insecure_tls = 30 [
+    json_name = "insecure_tls",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.insecure_tls"
+      that: "InsecureTls"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // discover_dn if true, use anon bind to discover the bind DN of a user.
+  // Defaults to false.
+  bool discover_dn = 40 [
+    json_name = "discover_dn",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.discover_dn"
+      that: "DiscoverDn"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // anon_group_search if true, use anon bind when performing LDAP group
+  // searches. Defaults to false.
+  bool anon_group_search = 50 [
+    json_name = "anon_group_search",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.anon_group_search"
+      that: "AnonGroupSearch"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // upn_domain is the userPrincipalDomain used to construct the UPN string for
+  // the authenticating user. The constructed UPN will appear as
+  // [username]@UPNDomain  Example: example.com, which will cause Boundary to
+  // bind as username@example.com when authenticating the user.
+  google.protobuf.StringValue upn_domain = 60 [
+    json_name = "upn_domain",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.upn_domain"
+      that: "UpnDomain"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // urls are the LDAP URLS that specify LDAP servers to connection to.  There
+  // must be at lease on URL for each LDAP auth method. When attempting to
+  // connect, the URLs are tried in the order specified. These are Value Objects
+  // that will be stored as Url messages, and are operated on as a complete set
+  // (not individually).
+  repeated string urls = 70 [
+    json_name = "urls",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.urls"
+      that: "Urls"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // user_dn (optional) is the base DN under which to perform user search.
+  // Example: ou=Users,dc=example,dc=com
+  google.protobuf.StringValue user_dn = 80 [
+    json_name = "user_dn",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.user_dn"
+      that: "UserDn"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // user_attr (optional) is the attribute on user attribute entry matching the
+  // username passed when authenticating.  Examples: cn, uid
+  google.protobuf.StringValue user_attr = 90 [
+    json_name = "user_attr",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.user_attr"
+      that: "UserAttr"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // user_filter (optional) is a go template used to construct a LDAP user
+  // search filter. The template can access the following context variables:
+  // [UserAttr, Username]. The default userfilter is
+  // ({{.UserAttr}}={{.Username}}) or
+  // (userPrincipalName={{.Username}}@UPNDomain) if the upndomain parameter is
+  // set.
+  google.protobuf.StringValue user_filter = 100 [
+    json_name = "user_filter",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.user_filter",
+      that: "UserFilter"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // enable_groups if true, an authenticated user's groups will be found during
+  // authentication. Defaults to false.
+  bool enable_groups = 110 [
+    json_name = "enable_groups",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.enable_groups"
+      that: "EnableGroups"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // group_dn (optional) is the base DN under which to perform user search.
+  // Example: ou=Groups,dc=example,dc=com
+  //
+  // Note: there is no default, so no base dn will be used for group searches if
+  // it's not specified.
+  google.protobuf.StringValue group_dn = 120 [
+    json_name = "group_dn",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.group_dn"
+      that: "GroupDn"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // group_attr (optional) is the LDAP attribute to follow on objects returned
+  // by GroupFilter in order to enumerate user group membership. Examples: for
+  // GroupFilter queries returning group objects, use: cn. For queries returning
+  // user objects, use: memberOf. The default is cn.
+  google.protobuf.StringValue group_attr = 130 [
+    json_name = "group_attr",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.group_attr"
+      that: "GroupAttr"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // group_filter (optional) is a Go template used when constructing the group
+  // membership query. The template can access the following context variables:
+  // [UserDN, Username]. The default is
+  // (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}})),
+  // which is compatible with several common directory schemas.
+  google.protobuf.StringValue group_filter = 140 [
+    json_name = "group_filter",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.group_filter",
+      that: "GroupFilter"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // certificates are optional PEM encoded x509 certificates in ASN.1 DER form
+  // that can be used as trust anchors when connecting to an LDAP provider.
+  // These are Value Objects that will be stored as Certificate messages, and
+  // are operatated on as a complete set (not individually).
+  repeated string certificates = 150 [
+    json_name = "certificates",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.certificates"
+      that: "Certificates"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // client_certificate is the optional certificate encoded as PEM. It must be
+  // set if an optional client_certificate_key specified
+  google.protobuf.StringValue client_certificate = 160 [
+    json_name = "client_certificate",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.client_certificate",
+      that: "ClientCertificate"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // Input only. The client_certificate_key (optional) is the plain-text of the
+  // certificate key data encoded as PEM.
+  google.protobuf.StringValue client_certificate_key = 170 [
+    json_name = "client_certificate_key",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.client_certificate_key",
+      that: "ClientCertificateKey"
+    }
+  ]; // @gotags: `class:"secret"`
+
+  // Output only. The HMAC'd value of the client certificate key to indicate
+  // whether the certificate key has changed.
+  string client_certificate_key_hmac = 180 [json_name = "client_certificate_key_hmac"]; // @gotags: `class:"public"`
+
+  // bind_dn (optional) is the distinguished name of entry to bind when
+  // performing user and group search. Example:
+  // cn=vault,ou=Users,dc=example,dc=com
+  google.protobuf.StringValue bind_dn = 190 [
+    json_name = "bind_dn",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.bind_dn",
+      that: "BindDn"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // Input only. The bind_password (optional) is the password to use along with
+  // binddn when performing user search.
+  google.protobuf.StringValue bind_password = 200 [
+    json_name = "bind_password",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.bind_password",
+      that: "BindPassword"
+    }
+  ]; // @gotags: `class:"secret"`
+
+  // Output only. The HMAC'd value of the bind password to indicate
+  // whether the password has changed.
+  string bind_password_hmac = 210 [json_name = "bind_password_hmac"]; // @gotags: `class:"public"`
+
+  bool use_token_groups = 220 [
+    json_name = "use_token_groups",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.use_token_groups"
+      that: "UseTokenGroups"
+    }
+  ]; // @gotags: `class:"public"`
+
+  // account_attribute_maps are optional attribute maps from custom attributes
+  // to the standard attributes of fullname and email.  These maps are
+  // represented as key=value where the key equals the from_attribute and the
+  // value equals the to_attribute.  For example "preferredName=fullName".  All
+  // attribute names are case insensitive.
+  repeated string account_attribute_maps = 230 [
+    json_name = "account_attribute_maps",
+    (custom_options.v1.generate_sdk_option) = true,
+    (custom_options.v1.mask_mapping) = {
+      this: "attributes.account_attribute_maps"
+      that: "AccountAttributeMaps"
+    }
+  ]; // @gotags: `class:"public"`
+}