From dc89ca28a18a5e9fbe7e47e544a8cda5317cd51c Mon Sep 17 00:00:00 2001 From: Jim Date: Wed, 6 Sep 2023 15:07:45 -0400 Subject: [PATCH] feat: add API support for additional LDAP auth method fields. (#3679) * feat (auth/ldap): add Repo support for max page size and deref aliases (#3670) * chore: update cap/ldap dependency This latest version of cap/ldap adds support for MaxPageSize and DerefAliases * feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto * feat (api/authmethods): add new ldap fields. Add support for maximum_page_size and dereference_aliases * feat (auth/ldap): schema changes to support new LDAP attributes * feat (auth/ldap): add Repo support for max page size and deref aliases * feat (handlers/ldap): add support for new fields (#3674) Added API support for new ldap fields: MaximumPageSize and DereferenceAliases * chore: add CHANGELOG entry for new api auth ldap fields --- CHANGELOG.md | 6 + .../ldap_auth_method_attributes.gen.go | 2 + api/authmethods/option.gen.go | 48 ++ go.mod | 12 +- go.sum | 32 +- internal/auth/ldap/auth_method.go | 26 +- internal/auth/ldap/auth_method_test.go | 39 ++ internal/auth/ldap/deref_aliases.go | 70 +++ internal/auth/ldap/deref_aliases_test.go | 142 +++++ internal/auth/ldap/options.go | 44 ++ internal/auth/ldap/options_test.go | 26 + .../ldap/repository_auth_method_create.go | 7 + .../repository_auth_method_create_test.go | 2 + .../auth/ldap/repository_auth_method_read.go | 5 +- .../ldap/repository_auth_method_read_test.go | 2 + .../ldap/repository_auth_method_update.go | 58 +- .../repository_auth_method_update_test.go | 21 + internal/auth/ldap/repository_authenticate.go | 2 + internal/auth/ldap/store/ldap.pb.go | 522 +++++++++++------- internal/auth/ldap/testing.go | 10 + .../authmethods/authmethod_service.go | 4 + .../authmethods/authmethod_service_test.go | 43 +- .../controller/handlers/authmethods/ldap.go | 13 + .../migrations/oss/postgres/65/01_ldap.up.sql | 2 + .../migrations/oss/postgres/76/01_ldap.up.sql | 126 +++++ .../authmethods/v1/auth_method.proto | 27 + .../storage/auth/ldap/store/v1/ldap.proto | 41 ++ .../resources/authmethods/auth_method.pb.go | 71 ++- 28 files changed, 1166 insertions(+), 237 deletions(-) create mode 100644 internal/auth/ldap/deref_aliases.go create mode 100644 internal/auth/ldap/deref_aliases_test.go create mode 100644 internal/db/schema/migrations/oss/postgres/76/01_ldap.up.sql diff --git a/CHANGELOG.md b/CHANGELOG.md index 271fa2f34..168962a40 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,12 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. ## Next +### New and Improved + +* feat: add API support for additional LDAP auth method fields: + maximum_page_size and dereference_aliases + ([PR](https://github.com/hashicorp/boundary/pull/3679)). + ### Bug Fixes * LDAP auth methods: allow bind-dn and bind-password to be updated diff --git a/api/authmethods/ldap_auth_method_attributes.gen.go b/api/authmethods/ldap_auth_method_attributes.gen.go index b4feed64a..09417bca1 100644 --- a/api/authmethods/ldap_auth_method_attributes.gen.go +++ b/api/authmethods/ldap_auth_method_attributes.gen.go @@ -34,6 +34,8 @@ type LdapAuthMethodAttributes struct { BindPasswordHmac string `json:"bind_password_hmac,omitempty"` UseTokenGroups bool `json:"use_token_groups,omitempty"` AccountAttributeMaps []string `json:"account_attribute_maps,omitempty"` + MaximumPageSize uint32 `json:"maximum_page_size,omitempty"` + DereferenceAliases string `json:"dereference_aliases,omitempty"` } func AttributesMapToLdapAuthMethodAttributes(in map[string]interface{}) (*LdapAuthMethodAttributes, error) { diff --git a/api/authmethods/option.gen.go b/api/authmethods/option.gen.go index abd7b2293..dcba776e6 100644 --- a/api/authmethods/option.gen.go +++ b/api/authmethods/option.gen.go @@ -415,6 +415,30 @@ func DefaultOidcAuthMethodClientSecret() Option { } } +func WithLdapAuthMethodDereferenceAliases(inDereferenceAliases string) Option { + return func(o *options) { + raw, ok := o.postMap["attributes"] + if !ok { + raw = interface{}(map[string]interface{}{}) + } + val := raw.(map[string]interface{}) + val["dereference_aliases"] = inDereferenceAliases + o.postMap["attributes"] = val + } +} + +func DefaultLdapAuthMethodDereferenceAliases() Option { + return func(o *options) { + raw, ok := o.postMap["attributes"] + if !ok { + raw = interface{}(map[string]interface{}{}) + } + val := raw.(map[string]interface{}) + val["dereference_aliases"] = nil + o.postMap["attributes"] = val + } +} + func WithDescription(inDescription string) Option { return func(o *options) { o.postMap["description"] = inDescription @@ -691,6 +715,30 @@ func DefaultOidcAuthMethodMaxAge() Option { } } +func WithLdapAuthMethodMaximumPageSize(inMaximumPageSize uint32) Option { + return func(o *options) { + raw, ok := o.postMap["attributes"] + if !ok { + raw = interface{}(map[string]interface{}{}) + } + val := raw.(map[string]interface{}) + val["maximum_page_size"] = inMaximumPageSize + o.postMap["attributes"] = val + } +} + +func DefaultLdapAuthMethodMaximumPageSize() Option { + return func(o *options) { + raw, ok := o.postMap["attributes"] + if !ok { + raw = interface{}(map[string]interface{}{}) + } + val := raw.(map[string]interface{}) + val["maximum_page_size"] = nil + o.postMap["attributes"] = val + } +} + func WithPasswordAuthMethodMinLoginNameLength(inMinLoginNameLength uint32) Option { return func(o *options) { raw, ok := o.postMap["attributes"] diff --git a/go.mod b/go.mod index 002298d4c..42f09983d 100644 --- a/go.mod +++ b/go.mod @@ -70,10 +70,10 @@ require ( github.com/stretchr/testify v1.8.4 github.com/zalando/go-keyring v0.2.3 go.uber.org/atomic v1.9.0 - golang.org/x/crypto v0.9.0 + golang.org/x/crypto v0.11.0 golang.org/x/sync v0.1.0 - golang.org/x/sys v0.8.0 - golang.org/x/term v0.8.0 + golang.org/x/sys v0.10.0 + golang.org/x/term v0.10.0 golang.org/x/tools v0.6.0 google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e google.golang.org/grpc v1.55.0 @@ -91,7 +91,7 @@ require ( github.com/DATA-DOG/go-sqlmock v1.5.0 github.com/cenkalti/backoff/v4 v4.2.0 github.com/creack/pty v1.1.18 - github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0 + github.com/hashicorp/cap/ldap v0.0.0-20230824195246-512b26a36f79 github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20221122211539-47c893099f13 github.com/hashicorp/go-version v1.6.0 @@ -137,7 +137,7 @@ require ( github.com/dvsekhvalnov/jose2go v1.5.0 // indirect github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect github.com/go-jose/go-jose/v3 v3.0.0 // indirect - github.com/go-ldap/ldap/v3 v3.4.4 // indirect + github.com/go-ldap/ldap/v3 v3.4.5 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.1.0 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect @@ -196,7 +196,7 @@ require ( go.uber.org/goleak v1.1.10 // indirect golang.org/x/mod v0.8.0 // indirect golang.org/x/oauth2 v0.8.0 // indirect - golang.org/x/text v0.9.0 // indirect + golang.org/x/text v0.11.0 // indirect golang.org/x/time v0.3.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect diff --git a/go.sum b/go.sum index 3b3e0b24b..262322d25 100644 --- a/go.sum +++ b/go.sum @@ -68,7 +68,6 @@ github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935 github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= -github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8= github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= @@ -123,6 +122,8 @@ github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRF github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho= github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0= github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30= +github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA= +github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4= github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= github.com/apache/arrow/go/arrow v0.0.0-20210818145353-234c94e4ce64/go.mod h1:2qMFB56yOP3KzkB3PbYZ4AlUFg3a88F67TIx5lB/WwY= @@ -449,8 +450,8 @@ github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY= github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U= github.com/go-ldap/ldap/v3 v3.1.10/go.mod h1:5Zun81jBTabRaI8lzN7E1JjyEl1g6zI6u9pd8luAK4Q= -github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs= -github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI= +github.com/go-ldap/ldap/v3 v3.4.5 h1:ekEKmaDrpvR2yf5Nc/DClsGG9lAmdDixe44mLzlW5r8= +github.com/go-ldap/ldap/v3 v3.4.5/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= @@ -653,8 +654,8 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9K github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4= github.com/hashicorp/cap v0.3.3 h1:qSQs1o9chItmOdotp7b+Vu/LlHCgHxnRyLtYv01Q7VE= github.com/hashicorp/cap v0.3.3/go.mod h1:dHTmyMIVbzT981XxRoci5G//dfWmd/HhuNiCH6J5+IA= -github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0 h1:SFcUsFwjBHGMIXixe/FpNsBlQBJwwXITD936LewHbHs= -github.com/hashicorp/cap/ldap v0.0.0-20230420150311-6d1e00a6c5e0/go.mod h1:9rAvcOfZF5fAYoN4GRtEI5w0F9Uj/oDAqMndkoRnPrI= +github.com/hashicorp/cap/ldap v0.0.0-20230824195246-512b26a36f79 h1:48XGBN1AJzpnclBjiDF2vvT3HYc7A75JgI9CMt4MJvg= +github.com/hashicorp/cap/ldap v0.0.0-20230824195246-512b26a36f79/go.mod h1:dNpIRXh4VO3A4bcWUq20orIN8AofgH/vTJWcl2JZtMg= github.com/hashicorp/dawdle v0.4.0 h1:nAE+aCoAmVulgCPPPrp6oGOykjPhxEe4VUNms/mTKeA= github.com/hashicorp/dawdle v0.4.0/go.mod h1:gOBY8rFXpW4Rw39up1FIacw/1pG/fO779LfchCY3KUw= github.com/hashicorp/dbassert v0.0.0-20230405175854-2d88acd5134b h1:ME5fs1tsrPeLqQj+V4UeV9bf+66rCfHKIOVnwrsQ9xU= @@ -1381,12 +1382,12 @@ golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= +golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE= -golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g= -golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0= +golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= +golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -1497,12 +1498,12 @@ golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211013171255-e13a2654a71e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= @@ -1653,8 +1654,8 @@ golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU= -golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= +golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY= @@ -1662,9 +1663,10 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= -golang.org/x/term v0.8.0 h1:n5xxQn2i3PC0yLAbjTpNT85q/Kgzcr2gIoX9OrJUols= -golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= +golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= +golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1677,8 +1679,10 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE= +golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= +golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= diff --git a/internal/auth/ldap/auth_method.go b/internal/auth/ldap/auth_method.go index e98c730b4..c97ddad00 100644 --- a/internal/auth/ldap/auth_method.go +++ b/internal/auth/ldap/auth_method.go @@ -31,7 +31,8 @@ type AuthMethod struct { // // Supports the options: WithUrls, WithName, WithDescription, WithStartTLS, // WithInsecureTLS, WithDiscoverDN, WithAnonGroupSearch, WithUpnDomain, -// WithUserSearchConf, WithGroupSearchConf, WithCertificates, WithBindCredential +// WithUserSearchConf, WithGroupSearchConf, WithCertificates, +// WithBindCredential, WithDerefAliases, WithMaximumPageSize // are the only valid options and all other options are ignored. func NewAuthMethod(ctx context.Context, scopeId string, opt ...Option) (*AuthMethod, error) { const op = "ldap.NewAuthMethod" @@ -69,6 +70,8 @@ func NewAuthMethod(ctx context.Context, scopeId string, opt ...Option) (*AuthMet Certificates: opts.withCertificates, ClientCertificate: opts.withClientCertificate, ClientCertificateKey: opts.withClientCertificateKey, + DereferenceAliases: string(opts.withDerefAliases), + MaximumPageSize: uint32(opts.withMaximumPageSize), }, } if len(opts.withAccountAttributeMap) > 0 { @@ -139,6 +142,7 @@ type convertedValues struct { ClientCertificate any BindCredential any AccountAttributeMaps []any + DerefAliases any } // convertValueObjects converts the embedded value objects. It will return an @@ -180,6 +184,11 @@ func (am *AuthMethod) convertValueObjects(ctx context.Context) (*convertedValues if converted.AccountAttributeMaps, err = am.convertAccountAttributeMaps(ctx); err != nil { return nil, errors.Wrap(ctx, err, op) } + if am.DereferenceAliases != "" { + if converted.DerefAliases, err = am.convertDerefAliases(ctx); err != nil { + return nil, errors.Wrap(ctx, err, op) + } + } return converted, nil } @@ -286,6 +295,21 @@ func (am *AuthMethod) convertBindCredential(ctx context.Context) (any, error) { return bc, nil } +// convertDerefAliases converts an embedded deref aliases entry into +// an any type. It will return an error if the AuthMethod's public id is not +// set. +func (am *AuthMethod) convertDerefAliases(ctx context.Context) (any, error) { + const op = "ldap.(AuthMethod).convertDerefAliases" + if am.PublicId == "" { + return nil, errors.New(ctx, errors.InvalidPublicId, op, "missing auth method id") + } + da, err := NewDerefAliases(ctx, am.PublicId, DerefAliasType(am.DereferenceAliases)) + if err != nil { + return nil, errors.Wrap(ctx, err, op) + } + return da, nil +} + // convertAccountAttributeMaps converts the embedded account attribute maps from // []string to []interface{} where each slice element is a *AccountAttributeMap. It // will return an error if the AuthMethod's public id is not set or it can diff --git a/internal/auth/ldap/auth_method_test.go b/internal/auth/ldap/auth_method_test.go index 9ef915d60..d4819504b 100644 --- a/internal/auth/ldap/auth_method_test.go +++ b/internal/auth/ldap/auth_method_test.go @@ -64,6 +64,8 @@ func TestNewAuthMethod(t *testing.T) { WithCertificates(testCtx, testCert), WithClientCertificate(testCtx, derPrivKey, testCert), // not a client cert but good enough for this test. WithAccountAttributeMap(testCtx, map[string]AccountToAttribute{"mail": "email"}), + WithDerefAliases(testCtx, DerefAlways), + WithMaximumPageSize(testCtx, 10), }, want: &AuthMethod{ AuthMethod: &store.AuthMethod{ @@ -90,6 +92,8 @@ func TestNewAuthMethod(t *testing.T) { ClientCertificate: testCertEncoded, ClientCertificateKey: derPrivKey, AccountAttributeMaps: []string{"mail=email"}, + DereferenceAliases: string(DerefAlways), + MaximumPageSize: 10, }, }, }, @@ -127,6 +131,18 @@ func TestNewAuthMethod(t *testing.T) { wantErrCode: errors.InvalidParameter, wantErrContains: `https scheme in url "https://alice.com" is not either ldap or ldaps`, }, + { + name: "invalid-deref-aliases", + ctx: testCtx, + scopeId: "global", + urls: TestConvertToUrls(t, "ldaps://alice.com"), + opts: []Option{ + WithDerefAliases(testCtx, "invalid"), + }, + wantErr: true, + wantErrCode: errors.InvalidParameter, + wantErrContains: `"invalid" is not a valid ldap dereference alias type`, + }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { @@ -208,6 +224,8 @@ func TestAuthMethod_clone(t *testing.T) { WithBindCredential(testCtx, "bind-dn", "bind-password"), WithCertificates(testCtx, testCert), WithClientCertificate(testCtx, derPrivKey, testCert), // not a client cert but good enough for this test. + WithDerefAliases(testCtx, DerefAlways), + WithMaximumPageSize(testCtx, 10), ) require.NoError(err) cp := am.clone() @@ -370,6 +388,9 @@ func Test_convertValueObjects(t *testing.T) { testBindCredential, err := NewBindCredential(testCtx, testPublicId, "bind-dn", []byte("bind-password")) require.NoError(t, err) + testDerefAliases, err := NewDerefAliases(testCtx, testPublicId, DerefAlways) + require.NoError(t, err) + tests := []struct { name string am *AuthMethod @@ -393,6 +414,7 @@ func Test_convertValueObjects(t *testing.T) { BindDn: "bind-dn", BindPassword: "bind-password", AccountAttributeMaps: testAttrMaps, + DereferenceAliases: string(DerefAlways), }, }, wantValues: &convertedValues{ @@ -403,6 +425,7 @@ func Test_convertValueObjects(t *testing.T) { ClientCertificate: testClientCertificate, BindCredential: testBindCredential, AccountAttributeMaps: testAccountAttributeMaps, + DerefAliases: testDerefAliases, }, }, { @@ -490,6 +513,17 @@ func Test_convertValueObjects(t *testing.T) { wantErrMatch: errors.T(errors.InvalidParameter), wantErrContains: "failed to parse certificate", }, + { + name: "invalid-deref-aliases", + am: &AuthMethod{ + AuthMethod: &store.AuthMethod{ + PublicId: testPublicId, + DereferenceAliases: "invalid", + }, + }, + wantErrMatch: errors.T(errors.InvalidParameter), + wantErrContains: `"invalid" is not a valid ldap dereference alias type:`, + }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { @@ -561,6 +595,11 @@ func Test_convertValueObjects(t *testing.T) { require.Error(err) assert.Nil(convertedBindCredential) assert.Truef(errors.Match(wantErrMatch, err), "wanted err %q and got: %+v", wantErrMatch.Code, err) + + convertedDerefAliases, err := am.convertDerefAliases(testCtx) + require.Error(err) + assert.Nil(convertedDerefAliases) + assert.Truef(errors.Match(wantErrMatch, err), "wanted err %q and got: %+v", wantErrMatch.Code, err) }) } diff --git a/internal/auth/ldap/deref_aliases.go b/internal/auth/ldap/deref_aliases.go new file mode 100644 index 000000000..9cecd6c66 --- /dev/null +++ b/internal/auth/ldap/deref_aliases.go @@ -0,0 +1,70 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: BUSL-1.1 + +package ldap + +import ( + "context" + + "github.com/hashicorp/boundary/internal/auth/ldap/store" + "github.com/hashicorp/boundary/internal/errors" + "google.golang.org/protobuf/proto" +) + +const derefAliasesTableName = "auth_ldap_deref_aliases" + +// DerefAliases represent optional config parameters which allow Boundary to +// properly dereference aliases when ldap searching +type DerefAliases struct { + *store.DerefAliases + tableName string +} + +// NewDerefAliases creates a new in memory NewDerefAliases. No options are currently supported. +func NewDerefAliases(ctx context.Context, authMethodId string, derefType DerefAliasType) (*DerefAliases, error) { + const op = "ldap.NewDerefAliases" + switch { + case authMethodId == "": + return nil, errors.New(ctx, errors.InvalidParameter, op, "missing auth method id") + case derefType == "": + return nil, errors.New(ctx, errors.InvalidParameter, op, "missing dereference alias type") + default: + if err := derefType.IsValid(ctx); err != nil { + return nil, errors.Wrap(ctx, err, op) + } + } + return &DerefAliases{ + DerefAliases: &store.DerefAliases{ + LdapMethodId: authMethodId, + DereferenceAliases: string(derefType), + }, + }, nil +} + +// allocDerefAliases makes an empty one in memory +func allocDerefAliases() *DerefAliases { + return &DerefAliases{ + DerefAliases: &store.DerefAliases{}, + } +} + +// clone a deref aliases +func (da *DerefAliases) clone() *DerefAliases { + cp := proto.Clone(da.DerefAliases) + return &DerefAliases{ + DerefAliases: cp.(*store.DerefAliases), + } +} + +// TableName returns the table name +func (da *DerefAliases) TableName() string { + if da.tableName != "" { + return da.tableName + } + return derefAliasesTableName +} + +// SetTableName sets the table name. +func (da *DerefAliases) SetTableName(n string) { + da.tableName = n +} diff --git a/internal/auth/ldap/deref_aliases_test.go b/internal/auth/ldap/deref_aliases_test.go new file mode 100644 index 000000000..90efc4dba --- /dev/null +++ b/internal/auth/ldap/deref_aliases_test.go @@ -0,0 +1,142 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: BUSL-1.1 + +package ldap + +import ( + "context" + "testing" + + "github.com/hashicorp/boundary/internal/auth/ldap/store" + "github.com/hashicorp/boundary/internal/errors" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" +) + +func TestNewDerefAliases(t *testing.T) { + t.Parallel() + testCtx := context.Background() + tests := []struct { + name string + ctx context.Context + authMethodId string + derefAliases DerefAliasType + want *DerefAliases + wantErr bool + wantErrCode errors.Code + wantErrContains string + }{ + { + name: "valid-DerefAlways", + ctx: testCtx, + authMethodId: "test-id", + derefAliases: DerefAlways, + want: &DerefAliases{ + DerefAliases: &store.DerefAliases{ + LdapMethodId: "test-id", + DereferenceAliases: string(DerefAlways), + }, + }, + }, + { + name: "missing-auth-method-id", + ctx: testCtx, + derefAliases: DerefAlways, + wantErr: true, + wantErrCode: errors.InvalidParameter, + wantErrContains: "missing auth method id", + }, + { + name: "missing-deref-aliases", + ctx: testCtx, + authMethodId: "test-id", + wantErr: true, + wantErrCode: errors.InvalidParameter, + wantErrContains: "missing dereference alias type", + }, + { + name: "invalid-deref-aliases", + ctx: testCtx, + authMethodId: "test-id", + derefAliases: "invalid", + wantErr: true, + wantErrCode: errors.InvalidParameter, + wantErrContains: `"invalid" is not a valid ldap dereference alias type`, + }, + } + for _, tc := range tests { + tc := tc + t.Run(tc.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + got, err := NewDerefAliases(tc.ctx, tc.authMethodId, tc.derefAliases) + if tc.wantErr { + require.Error(err) + assert.Nil(got) + if tc.wantErrCode != errors.Unknown { + assert.True(errors.Match(errors.T(tc.wantErrCode), err)) + } + if tc.wantErrContains != "" { + assert.Contains(err.Error(), tc.wantErrContains) + } + return + } + require.NoError(err) + assert.Equal(tc.want, got) + }) + } +} + +func TestDerefAliases_SetTableName(t *testing.T) { + t.Parallel() + defaultTableName := derefAliasesTableName + tests := []struct { + name string + setNameTo string + want string + }{ + { + name: "new-name", + setNameTo: "new-name", + want: "new-name", + }, + { + name: "reset to default", + setNameTo: "", + want: defaultTableName, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + deref := allocDerefAliases() + require.Equal(defaultTableName, deref.TableName()) + derefOverriddenTableName := allocDerefAliases() + derefOverriddenTableName.SetTableName(tt.setNameTo) + assert.Equal(tt.want, derefOverriddenTableName.TableName()) + }) + } +} + +func TestDerefAliases_clone(t *testing.T) { + t.Parallel() + testCtx := context.Background() + t.Run("valid", func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + d, err := NewDerefAliases(testCtx, "test-id", DerefFindingBaseObj) + require.NoError(err) + cp := d.clone() + assert.True(proto.Equal(cp.DerefAliases, d.DerefAliases)) + }) + t.Run("not-equal", func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + d, err := NewDerefAliases(testCtx, "test-id", DerefFindingBaseObj) + require.NoError(err) + + d2, err := NewDerefAliases(testCtx, "test-id", DerefAlways) + require.NoError(err) + + cp := d.clone() + assert.True(!proto.Equal(cp.DerefAliases, d2.DerefAliases)) + }) +} diff --git a/internal/auth/ldap/options.go b/internal/auth/ldap/options.go index 3c0630857..fbce8a4d3 100644 --- a/internal/auth/ldap/options.go +++ b/internal/auth/ldap/options.go @@ -46,6 +46,8 @@ type options struct { withMemberOfGroups string withUrls []string withPublicId string + withDerefAliases DerefAliasType + withMaximumPageSize uint32 } // Option - how options are passed as args @@ -369,3 +371,45 @@ func WithPublicId(ctx context.Context, publicId string) Option { return nil } } + +// WithMaximumPageSize provides an option for passing a max page size for group +// searching to the operation +func WithMaximumPageSize(ctx context.Context, max uint32) Option { + const op = "ldap.WithMaximumPageSize" + return func(o *options) error { + o.withMaximumPageSize = max + return nil + } +} + +// WithDerefAliases provides an option for passing in how dereferencing aliases +// should be handled +func WithDerefAliases(ctx context.Context, derefAlias DerefAliasType) Option { + const op = "ldap.WithMaximumPageSize" + return func(o *options) error { + if err := derefAlias.IsValid(ctx); err != nil { + return errors.Wrap(ctx, err, op) + } + o.withDerefAliases = derefAlias + return nil + } +} + +type DerefAliasType string + +const ( + NeverDerefAliases DerefAliasType = "NeverDerefAliases" + DerefInSearching DerefAliasType = "DerefInSearching" + DerefFindingBaseObj DerefAliasType = "DerefFindingBaseObj" + DerefAlways DerefAliasType = "DerefAlways" +) + +func (d DerefAliasType) IsValid(ctx context.Context) error { + const op = "ldap.(DerefAliasType).IsValid" + switch d { + case NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, DerefAlways: + return nil + default: + return errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("%q is not a valid ldap dereference alias type", d)) + } +} diff --git a/internal/auth/ldap/options_test.go b/internal/auth/ldap/options_test.go index 1f8650036..08f70a5b5 100644 --- a/internal/auth/ldap/options_test.go +++ b/internal/auth/ldap/options_test.go @@ -10,6 +10,7 @@ import ( "crypto/x509" "testing" + "github.com/hashicorp/boundary/internal/errors" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) @@ -324,4 +325,29 @@ func Test_getOpts(t *testing.T) { testOpts.withPublicId = "test" assert.Equal(opts, testOpts) }) + t.Run("WithMaximumPageSize", func(t *testing.T) { + assert := assert.New(t) + opts, err := getOpts(WithMaximumPageSize(testCtx, 10)) + require.NoError(t, err) + testOpts := getDefaultOptions() + assert.NotEqual(opts, testOpts) + testOpts.withMaximumPageSize = 10 + assert.Equal(opts, testOpts) + }) + t.Run("WithDerefAliases", func(t *testing.T) { + assert := assert.New(t) + opts, err := getOpts(WithDerefAliases(testCtx, DerefAlways)) + require.NoError(t, err) + testOpts := getDefaultOptions() + assert.NotEqual(opts, testOpts) + testOpts.withDerefAliases = DerefAlways + assert.Equal(opts, testOpts) + }) + t.Run("WithDerefAliases-invalid", func(t *testing.T) { + assert := assert.New(t) + _, err := getOpts(WithDerefAliases(testCtx, "Invalid")) + require.Error(t, err) + assert.ErrorContains(err, `"Invalid" is not a valid ldap dereference alias type`) + assert.Truef(errors.Match(errors.T(errors.InvalidParameter), err), "want err code: %q got: %q", errors.InvalidParameter, err) + }) } diff --git a/internal/auth/ldap/repository_auth_method_create.go b/internal/auth/ldap/repository_auth_method_create.go index cc990ebdd..2aee67cb3 100644 --- a/internal/auth/ldap/repository_auth_method_create.go +++ b/internal/auth/ldap/repository_auth_method_create.go @@ -159,6 +159,13 @@ func (r *Repository) CreateAuthMethod(ctx context.Context, am *AuthMethod, opt . } msgs = append(msgs, attrMapsOplogMsgs...) } + if cv.DerefAliases != nil { + var daOplogMsg oplog.Message + if err := w.Create(ctx, cv.DerefAliases, db.NewOplogMsg(&daOplogMsg)); err != nil { + return err + } + msgs = append(msgs, &daOplogMsg) + } md, err := am.oplog(ctx, oplog.OpType_OP_TYPE_CREATE) if err != nil { return errors.Wrap(ctx, err, op, errors.WithMsg("unable to generate oplog metadata")) diff --git a/internal/auth/ldap/repository_auth_method_create_test.go b/internal/auth/ldap/repository_auth_method_create_test.go index e7dc8e0ad..6b0497f82 100644 --- a/internal/auth/ldap/repository_auth_method_create_test.go +++ b/internal/auth/ldap/repository_auth_method_create_test.go @@ -63,6 +63,8 @@ func TestRepository_CreateAuthMethod(t *testing.T) { WithAccountAttributeMap(testCtx, map[string]AccountToAttribute{ "mail": ToEmailAttribute, }), + WithDerefAliases(testCtx, DerefFindingBaseObj), + WithMaximumPageSize(testCtx, 10), ) require.NoError(t, err) diff --git a/internal/auth/ldap/repository_auth_method_read.go b/internal/auth/ldap/repository_auth_method_read.go index 5cd79af8c..a2c9dbd6f 100644 --- a/internal/auth/ldap/repository_auth_method_read.go +++ b/internal/auth/ldap/repository_auth_method_read.go @@ -199,7 +199,8 @@ func (r *Repository) getAuthMethods(ctx context.Context, authMethodId string, sc if agg.AccountAttributeMap != "" { am.AccountAttributeMaps = strings.Split(agg.AccountAttributeMap, aggregateDelimiter) } - + am.DereferenceAliases = agg.DereferenceAliases + am.MaximumPageSize = agg.MaximumPageSize authMethods = append(authMethods, &am) } return authMethods, nil @@ -242,6 +243,8 @@ type authMethodAgg struct { BindPasswordHmac []byte BindKeyId string AccountAttributeMap string + DereferenceAliases string + MaximumPageSize uint32 } // TableName returns the table name for gorm diff --git a/internal/auth/ldap/repository_auth_method_read_test.go b/internal/auth/ldap/repository_auth_method_read_test.go index e3c267bbd..a3118a877 100644 --- a/internal/auth/ldap/repository_auth_method_read_test.go +++ b/internal/auth/ldap/repository_auth_method_read_test.go @@ -184,6 +184,8 @@ func TestRepository_getAuthMethods(t *testing.T) { WithCertificates(testCtx, testCert), WithClientCertificate(testCtx, derPrivKey, testCert), // not a client cert but good enough for this test.) WithAccountAttributeMap(testCtx, map[string]AccountToAttribute{"mail": ToEmailAttribute, "displayName": ToFullNameAttribute}), + WithMaximumPageSize(testCtx, 10), + WithDerefAliases(testCtx, DerefAlways), ) return am.PublicId, nil, []*AuthMethod{am} }, diff --git a/internal/auth/ldap/repository_auth_method_update.go b/internal/auth/ldap/repository_auth_method_update.go index 7c789fbe4..2c61c45ad 100644 --- a/internal/auth/ldap/repository_auth_method_update.go +++ b/internal/auth/ldap/repository_auth_method_update.go @@ -45,6 +45,8 @@ const ( BindPasswordField = "BindPassword" AccountAttributeMapsField = "AccountAttributeMaps" GroupNamesField = "GroupNames" + DerefAliasesField = "DereferenceAliases" + MaximumPageSizeField = "MaximumPageSize" ) // isEmpty returns true if all the args are empty. Only supports checking @@ -116,6 +118,8 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi BindPasswordField: am.BindPassword, UrlsField: am.Urls, AccountAttributeMapsField: am.AccountAttributeMaps, + DerefAliasesField: am.DereferenceAliases, + MaximumPageSizeField: am.MaximumPageSize, }, fieldMaskPaths, []string{ @@ -125,6 +129,7 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi AnonGroupSearchField, EnableGroupsField, UseTokenGroupsField, + MaximumPageSizeField, }, ) if len(dbMask) == 0 && len(nullFields) == 0 { @@ -303,6 +308,29 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi } } + var addDerefAliases, deleteDerefAliases any + if strListContainsOneOf(combinedMasks, DerefAliasesField) { + if !isEmpty(origAm.DereferenceAliases) { + d := allocDerefAliases() + d.LdapMethodId = am.PublicId + deleteDerefAliases = d + } + derefAliases := origAm.DereferenceAliases + switch { + case strutil.StrListContains(dbMask, DerefAliasesField): + derefAliases = am.DereferenceAliases + case strutil.StrListContains(nullFields, DerefAliasesField): + derefAliases = "" + } + if !isEmpty(derefAliases) { + d, err := NewDerefAliases(ctx, am.PublicId, DerefAliasType(derefAliases)) + if err != nil { + return nil, db.NoRowsAffected, errors.Wrap(ctx, err, op) + } + addDerefAliases = d + } + } + var filteredDbMask, filteredNullFields []string for _, f := range dbMask { switch f { @@ -313,7 +341,8 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi UserDnField, UserAttrField, UserFilterField, GroupDnField, GroupAttrField, GroupFilterField, ClientCertificateField, ClientCertificateKeyField, - BindDnField, BindPasswordField: + BindDnField, BindPasswordField, + DerefAliasesField: continue default: filteredDbMask = append(filteredDbMask, f) @@ -329,7 +358,8 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi UserDnField, UserAttrField, UserFilterField, GroupDnField, GroupAttrField, GroupFilterField, ClientCertificateField, ClientCertificateKeyField, - BindDnField, BindPasswordField: + BindDnField, BindPasswordField, + DerefAliasesField: continue default: filteredNullFields = append(filteredNullFields, f) @@ -352,7 +382,9 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi addBindCred == nil && deleteBindCred == nil && len(addMaps) == 0 && - len(deleteMaps) == 0 { + len(deleteMaps) == 0 && + addDerefAliases == nil && + deleteDerefAliases == nil { return origAm, db.NoRowsAffected, nil } @@ -529,6 +561,24 @@ func (r *Repository) UpdateAuthMethod(ctx context.Context, am *AuthMethod, versi } msgs = append(msgs, addMapsOplogMsgs...) } + if deleteDerefAliases != nil { + var deleteDerefMsg oplog.Message + rowsDeleted, err := w.Delete(ctx, deleteDerefAliases, db.NewOplogMsg(&deleteDerefMsg)) + if err != nil { + return errors.Wrap(ctx, err, op, errors.WithMsg("unable to delete deref aliases")) + } + if rowsDeleted != 1 { + return errors.New(ctx, errors.MultipleRecords, op, fmt.Sprintf("deref aliases deleted %d did not match request for 1", rowsDeleted)) + } + msgs = append(msgs, &deleteDerefMsg) + } + if addDerefAliases != nil { + var addDerefOplogMsg oplog.Message + if err := w.Create(ctx, addDerefAliases, db.NewOplogMsg(&addDerefOplogMsg)); err != nil { + return errors.Wrap(ctx, err, op, errors.WithMsg("unable to add deref aliases")) + } + msgs = append(msgs, &addDerefOplogMsg) + } metadata, err := updatedAm.oplog(ctx, oplog.OpType_OP_TYPE_UPDATE) if err != nil { @@ -589,6 +639,8 @@ func validateFieldMask(ctx context.Context, fieldMaskPaths []string) error { case strings.EqualFold(BindPasswordField, f): case strings.EqualFold(UrlsField, f): case strings.EqualFold(AccountAttributeMapsField, f): + case strings.EqualFold(DerefAliasesField, f): + case strings.EqualFold(MaximumPageSizeField, f): default: return errors.New(ctx, errors.InvalidParameter, op, fmt.Sprintf("invalid field mask: %q", f)) } diff --git a/internal/auth/ldap/repository_auth_method_update_test.go b/internal/auth/ldap/repository_auth_method_update_test.go index 4e293a299..4690fbad4 100644 --- a/internal/auth/ldap/repository_auth_method_update_test.go +++ b/internal/auth/ldap/repository_auth_method_update_test.go @@ -87,6 +87,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { "displayName": ToFullNameAttribute, "mail": ToEmailAttribute, }), + WithDerefAliases(testCtx, DerefAlways), + WithMaximumPageSize(testCtx, 10), ) }, updateWith: func(orig *AuthMethod) *AuthMethod { @@ -117,6 +119,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { am.AccountAttributeMaps = []string{ fmt.Sprintf("%s=%s", "cn", ToFullNameAttribute), } + am.DereferenceAliases = string(NeverDerefAliases) + am.MaximumPageSize = 100 return &am }, fieldMasks: []string{ @@ -143,6 +147,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { ClientCertificateField, ClientCertificateKeyField, AccountAttributeMapsField, + DerefAliasesField, + MaximumPageSizeField, }, version: 1, want: func(orig, updateWith *AuthMethod) *AuthMethod { @@ -172,6 +178,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { am.ClientCertificate = updateWith.ClientCertificate am.ClientCertificateKeyHmac = updateWith.ClientCertificateKeyHmac am.AccountAttributeMaps = updateWith.AccountAttributeMaps + am.DereferenceAliases = string(NeverDerefAliases) + am.MaximumPageSize = 100 return am }, }, @@ -318,6 +326,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { WithBindCredential(testCtx, "orig-bind-dn", "orig-bind-password"), WithCertificates(testCtx, testCert), WithClientCertificate(testCtx, derPrivKey, testCert), // not a client cert but good enough for this test. + WithDerefAliases(testCtx, DerefAlways), + WithMaximumPageSize(testCtx, 10), ) }, updateWith: func(orig *AuthMethod) *AuthMethod { @@ -335,6 +345,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { UpnDomainField, EnableGroupsField, UseTokenGroupsField, + DerefAliasesField, + MaximumPageSizeField, }, version: 1, want: func(orig, updateWith *AuthMethod) *AuthMethod { @@ -348,6 +360,8 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { am.UpnDomain = updateWith.UpnDomain am.EnableGroups = updateWith.EnableGroups am.UseTokenGroups = updateWith.UseTokenGroups + am.MaximumPageSize = updateWith.MaximumPageSize + am.DereferenceAliases = updateWith.DereferenceAliases return am }, }, @@ -376,6 +390,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { "mail": ToEmailAttribute, "cn": ToFullNameAttribute, }), + WithDerefAliases(testCtx, NeverDerefAliases), ) }, updateWith: func(orig *AuthMethod) *AuthMethod { @@ -394,6 +409,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { am.ClientCertificate = testCertEncoded am.ClientCertificateKey = derPrivKey am.AccountAttributeMaps = []string{"cn=fullName"} + am.DereferenceAliases = string(DerefAlways) return &am }, fieldMasks: []string{ @@ -410,6 +426,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { ClientCertificateField, ClientCertificateKeyField, AccountAttributeMapsField, + DerefAliasesField, }, version: 1, want: func(orig, updateWith *AuthMethod) *AuthMethod { @@ -428,6 +445,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { am.ClientCertificate = updateWith.ClientCertificate am.ClientCertificateKeyHmac = updateWith.ClientCertificateKeyHmac am.AccountAttributeMaps = updateWith.AccountAttributeMaps + am.DereferenceAliases = updateWith.DereferenceAliases return am }, }, @@ -453,6 +471,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { "mail": ToEmailAttribute, "cn": ToFullNameAttribute, }), + WithDerefAliases(testCtx, DerefAlways), ) }, updateWith: func(orig *AuthMethod) *AuthMethod { @@ -473,6 +492,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { ClientCertificateField, ClientCertificateKeyField, AccountAttributeMapsField, + DerefAliasesField, }, version: 1, want: func(orig, updateWith *AuthMethod) *AuthMethod { @@ -491,6 +511,7 @@ func TestRepository_UpdateAuthMethod(t *testing.T) { am.ClientCertificate = updateWith.ClientCertificate am.ClientCertificateKeyHmac = updateWith.ClientCertificateKeyHmac am.AccountAttributeMaps = updateWith.AccountAttributeMaps + am.DereferenceAliases = updateWith.DereferenceAliases return am }, }, diff --git a/internal/auth/ldap/repository_authenticate.go b/internal/auth/ldap/repository_authenticate.go index 9854be711..9d8722962 100644 --- a/internal/auth/ldap/repository_authenticate.go +++ b/internal/auth/ldap/repository_authenticate.go @@ -77,6 +77,8 @@ func (r *Repository) Authenticate(ctx context.Context, authMethodId, loginName, BindDN: am.BindDn, BindPassword: am.BindPassword, RequestTimeout: DefaultRequestTimeout, + DerefAliases: am.DereferenceAliases, + MaximumPageSize: int(am.MaximumPageSize), }) if err != nil { return nil, errors.Wrap(ctx, err, op, errors.WithMsg("unable to initialize ldap client with auth method retrieved from database")) diff --git a/internal/auth/ldap/store/ldap.pb.go b/internal/auth/ldap/store/ldap.pb.go index 8ba85451e..7d8fb2488 100644 --- a/internal/auth/ldap/store/ldap.pb.go +++ b/internal/auth/ldap/store/ldap.pb.go @@ -178,6 +178,19 @@ type AuthMethod struct { // attribute names are case insensitive. // @inject_tag: `gorm:"-"` AccountAttributeMaps []string `protobuf:"bytes,300,rep,name=account_attribute_maps,json=accountAttributeMaps,proto3" json:"account_attribute_maps,omitempty" gorm:"-"` + // MaximumPageSize optionally specifies a maximum ldap search result size to + // use when retrieving the authenticated user's group memberships. This can + // be used to avoid reaching the LDAP server's max result size. + // @inject_tag: `gorm:"not_null;default:0"` + MaximumPageSize uint32 `protobuf:"varint,310,opt,name=maximum_page_size,json=maximumPageSize,proto3" json:"maximum_page_size,omitempty" gorm:"not_null;default:0"` + // dereference_aliases will control how aliases are dereferenced when + // performing the search. Possible values are: never, finding, searching, + // and always. If unset, a default of "never" is used. When set to + // "finding", it will only dereference aliases during name resolution of the + // base. When set to "searching", it will dereference aliases after name + // resolution. + // @inject_tag: `gorm:"-"` + DereferenceAliases string `protobuf:"bytes,320,opt,name=dereference_aliases,json=dereferenceAliases,proto3" json:"dereference_aliases,omitempty" gorm:"-"` } func (x *AuthMethod) Reset() { @@ -429,6 +442,20 @@ func (x *AuthMethod) GetAccountAttributeMaps() []string { return nil } +func (x *AuthMethod) GetMaximumPageSize() uint32 { + if x != nil { + return x.MaximumPageSize + } + return 0 +} + +func (x *AuthMethod) GetDereferenceAliases() string { + if x != nil { + return x.DereferenceAliases + } + return "" +} + // Url represents LDAP URLs that specify LDAP servers to connection to. There // must be at lease on URL for each LDAP auth method. type Url struct { @@ -1280,6 +1307,81 @@ func (x *AccountAttributeMap) GetCreateTime() *timestamp.Timestamp { return nil } +// DerefAliases represent aan optional configuration field used to +// determine how to derefence aliases when searching ldap. +type DerefAliases struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + // create_time is set by the database. + // @inject_tag: `gorm:"default:current_timestamp"` + CreateTime *timestamp.Timestamp `protobuf:"bytes,10,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty" gorm:"default:current_timestamp"` + // ldap_method_id is the FK to the UserEntrySearchConf's LDAP auth method. + // @inject_tag: `gorm:"primary_key"` + LdapMethodId string `protobuf:"bytes,20,opt,name=ldap_method_id,json=ldapMethodId,proto3" json:"ldap_method_id,omitempty" gorm:"primary_key"` + // dereference_aliases will control how aliases are dereferenced when + // performing the search. Possible values are: never, finding, searching, + // and always. If unset, a default of "never" is used. When set to + // "finding", it will only dereference aliases during name resolution of the + // base. When set to "searching", it will dereference aliases after name + // resolution. + DereferenceAliases string `protobuf:"bytes,30,opt,name=dereference_aliases,json=dereferenceAliases,proto3" json:"dereference_aliases,omitempty"` +} + +func (x *DerefAliases) Reset() { + *x = DerefAliases{} + if protoimpl.UnsafeEnabled { + mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[9] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *DerefAliases) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DerefAliases) ProtoMessage() {} + +func (x *DerefAliases) ProtoReflect() protoreflect.Message { + mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[9] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DerefAliases.ProtoReflect.Descriptor instead. +func (*DerefAliases) Descriptor() ([]byte, []int) { + return file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescGZIP(), []int{9} +} + +func (x *DerefAliases) GetCreateTime() *timestamp.Timestamp { + if x != nil { + return x.CreateTime + } + return nil +} + +func (x *DerefAliases) GetLdapMethodId() string { + if x != nil { + return x.LdapMethodId + } + return "" +} + +func (x *DerefAliases) GetDereferenceAliases() string { + if x != nil { + return x.DereferenceAliases + } + return "" +} + // ManagedGroup entries provide an LDAP auth method implementation of managed // groups. type ManagedGroup struct { @@ -1314,7 +1416,7 @@ type ManagedGroup struct { func (x *ManagedGroup) Reset() { *x = ManagedGroup{} if protoimpl.UnsafeEnabled { - mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[9] + mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1327,7 +1429,7 @@ func (x *ManagedGroup) String() string { func (*ManagedGroup) ProtoMessage() {} func (x *ManagedGroup) ProtoReflect() protoreflect.Message { - mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[9] + mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[10] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1340,7 +1442,7 @@ func (x *ManagedGroup) ProtoReflect() protoreflect.Message { // Deprecated: Use ManagedGroup.ProtoReflect.Descriptor instead. func (*ManagedGroup) Descriptor() ([]byte, []int) { - return file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescGZIP(), []int{9} + return file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescGZIP(), []int{10} } func (x *ManagedGroup) GetPublicId() string { @@ -1420,7 +1522,7 @@ type ManagedGroupMemberAccount struct { func (x *ManagedGroupMemberAccount) Reset() { *x = ManagedGroupMemberAccount{} if protoimpl.UnsafeEnabled { - mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[10] + mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1433,7 +1535,7 @@ func (x *ManagedGroupMemberAccount) String() string { func (*ManagedGroupMemberAccount) ProtoMessage() {} func (x *ManagedGroupMemberAccount) ProtoReflect() protoreflect.Message { - mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[10] + mi := &file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[11] if protoimpl.UnsafeEnabled && x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1446,7 +1548,7 @@ func (x *ManagedGroupMemberAccount) ProtoReflect() protoreflect.Message { // Deprecated: Use ManagedGroupMemberAccount.ProtoReflect.Descriptor instead. func (*ManagedGroupMemberAccount) Descriptor() ([]byte, []int) { - return file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescGZIP(), []int{10} + return file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescGZIP(), []int{11} } func (x *ManagedGroupMemberAccount) GetCreateTime() *timestamp.Timestamp { @@ -1484,7 +1586,7 @@ var file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDesc = []byte{ 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, - 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa0, 0x11, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x4d, + 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xee, 0x12, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, @@ -1622,35 +1724,20 @@ var file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDesc = []byte{ 0x12, 0x21, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x73, 0x52, 0x14, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x74, 0x74, 0x72, - 0x69, 0x62, 0x75, 0x74, 0x65, 0x4d, 0x61, 0x70, 0x73, 0x22, 0xc8, 0x01, 0x0a, 0x03, 0x55, 0x72, - 0x6c, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, - 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, - 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, - 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, - 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, - 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, - 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, - 0x6f, 0x64, 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x13, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, - 0x6f, 0x6e, 0x5f, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x18, 0x1e, 0x20, 0x01, 0x28, - 0x0d, 0x52, 0x12, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x69, - 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, - 0x75, 0x72, 0x6c, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x65, - 0x72, 0x55, 0x72, 0x6c, 0x22, 0xdf, 0x01, 0x0a, 0x13, 0x55, 0x73, 0x65, 0x72, 0x45, 0x6e, 0x74, - 0x72, 0x79, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x12, 0x4b, 0x0a, 0x0b, - 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, - 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, - 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, - 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, - 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, - 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, - 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, - 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x64, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, - 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x44, 0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, - 0x5f, 0x61, 0x74, 0x74, 0x72, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, - 0x72, 0x41, 0x74, 0x74, 0x72, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x66, 0x69, - 0x6c, 0x74, 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, - 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0xe6, 0x01, 0x0a, 0x14, 0x47, 0x72, 0x6f, 0x75, 0x70, - 0x45, 0x6e, 0x74, 0x72, 0x79, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x12, + 0x69, 0x62, 0x75, 0x74, 0x65, 0x4d, 0x61, 0x70, 0x73, 0x12, 0x60, 0x0a, 0x11, 0x6d, 0x61, 0x78, + 0x69, 0x6d, 0x75, 0x6d, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18, 0xb6, + 0x02, 0x20, 0x01, 0x28, 0x0d, 0x42, 0x33, 0xc2, 0xdd, 0x29, 0x2f, 0x0a, 0x0f, 0x4d, 0x61, 0x78, + 0x69, 0x6d, 0x75, 0x6d, 0x50, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x1c, 0x61, 0x74, + 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x6d, 0x61, 0x78, 0x69, 0x6d, 0x75, 0x6d, + 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x52, 0x0f, 0x6d, 0x61, 0x78, 0x69, + 0x6d, 0x75, 0x6d, 0x50, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x6a, 0x0a, 0x13, 0x64, + 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, + 0x65, 0x73, 0x18, 0xc0, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x38, 0xc2, 0xdd, 0x29, 0x34, 0x0a, + 0x12, 0x44, 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x41, 0x6c, 0x69, 0x61, + 0x73, 0x65, 0x73, 0x12, 0x1e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, + 0x64, 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, + 0x73, 0x65, 0x73, 0x52, 0x12, 0x64, 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, + 0x41, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x22, 0xc8, 0x01, 0x0a, 0x03, 0x55, 0x72, 0x6c, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, @@ -1658,60 +1745,146 @@ var file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDesc = []byte{ 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, - 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x64, 0x6e, 0x18, 0x1e, - 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x44, 0x6e, 0x12, 0x1d, 0x0a, - 0x0a, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x18, 0x28, 0x20, 0x01, 0x28, - 0x09, 0x52, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x41, 0x74, 0x74, 0x72, 0x12, 0x21, 0x0a, 0x0c, - 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, - 0x28, 0x09, 0x52, 0x0b, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, - 0x94, 0x01, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, - 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, - 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, - 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, - 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, - 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, - 0x6c, 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, - 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, - 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x65, 0x72, 0x74, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, - 0x52, 0x04, 0x63, 0x65, 0x72, 0x74, 0x22, 0xc8, 0x02, 0x0a, 0x11, 0x43, 0x6c, 0x69, 0x65, 0x6e, - 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x4b, 0x0a, 0x0b, - 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, - 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, - 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, - 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, - 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, - 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, - 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, - 0x20, 0x0a, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x1e, - 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, - 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, - 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x63, 0x65, 0x72, 0x74, - 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x74, - 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, - 0x18, 0x32, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x63, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, - 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x14, 0x63, 0x65, 0x72, 0x74, - 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61, 0x63, - 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, - 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, - 0x79, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, - 0x64, 0x22, 0x8c, 0x02, 0x0a, 0x0e, 0x42, 0x69, 0x6e, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, - 0x74, 0x69, 0x61, 0x6c, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, - 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, + 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x13, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, + 0x5f, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0d, 0x52, + 0x12, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x69, 0x6f, 0x72, + 0x69, 0x74, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x75, 0x72, + 0x6c, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x55, + 0x72, 0x6c, 0x22, 0xdf, 0x01, 0x0a, 0x13, 0x55, 0x73, 0x65, 0x72, 0x45, 0x6e, 0x74, 0x72, 0x79, + 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, + 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, + 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, + 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, + 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, + 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, + 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x17, 0x0a, + 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x64, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, + 0x75, 0x73, 0x65, 0x72, 0x44, 0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x61, + 0x74, 0x74, 0x72, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x41, + 0x74, 0x74, 0x72, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x66, 0x69, 0x6c, 0x74, + 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x46, 0x69, + 0x6c, 0x74, 0x65, 0x72, 0x22, 0xe6, 0x01, 0x0a, 0x14, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x45, 0x6e, + 0x74, 0x72, 0x79, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x12, 0x4b, 0x0a, + 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, + 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, + 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, + 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, + 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, + 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, + 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x64, 0x6e, 0x18, 0x1e, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x44, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x67, + 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, + 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x41, 0x74, 0x74, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x67, 0x72, + 0x6f, 0x75, 0x70, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, + 0x52, 0x0b, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0x94, 0x01, + 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x4b, 0x0a, + 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, + 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, + 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, + 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, + 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, + 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, + 0x12, 0x12, 0x0a, 0x04, 0x63, 0x65, 0x72, 0x74, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, + 0x63, 0x65, 0x72, 0x74, 0x22, 0xc8, 0x02, 0x0a, 0x11, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, + 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, + 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, + 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, + 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, + 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, + 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, + 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x20, 0x0a, + 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x1e, 0x20, 0x01, + 0x28, 0x0c, 0x52, 0x0b, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, + 0x27, 0x0a, 0x0f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, + 0x65, 0x79, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, + 0x69, 0x63, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x12, 0x63, 0x74, 0x5f, 0x63, + 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x32, + 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x63, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, + 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x14, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, + 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x3c, + 0x20, 0x01, 0x28, 0x0c, 0x52, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, + 0x65, 0x4b, 0x65, 0x79, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, + 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, + 0x8c, 0x02, 0x0a, 0x0e, 0x42, 0x69, 0x6e, 0x64, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, + 0x61, 0x6c, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, + 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, + 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, + 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, + 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, + 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, + 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, + 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x64, 0x6e, 0x18, 0x1e, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x02, 0x64, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, + 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, + 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x74, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, + 0x18, 0x32, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x74, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, + 0x72, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x5f, 0x68, + 0x6d, 0x61, 0x63, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x61, 0x73, 0x73, 0x77, + 0x6f, 0x72, 0x64, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, + 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x90, + 0x04, 0x0a, 0x07, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, + 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, + 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, + 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, + 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, + 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, + 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, + 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, + 0x69, 0x6d, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, - 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, - 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, - 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, - 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x64, 0x6e, 0x18, 0x1e, 0x20, - 0x01, 0x28, 0x09, 0x52, 0x02, 0x64, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, - 0x6f, 0x72, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, - 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x74, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, - 0x72, 0x64, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x74, 0x50, 0x61, 0x73, 0x73, - 0x77, 0x6f, 0x72, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, - 0x5f, 0x68, 0x6d, 0x61, 0x63, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x70, 0x61, 0x73, - 0x73, 0x77, 0x6f, 0x72, 0x64, 0x48, 0x6d, 0x61, 0x63, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, - 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, - 0x22, 0x90, 0x04, 0x0a, 0x07, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, + 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, + 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, + 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d, + 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, + 0x32, 0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, + 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, + 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x3c, 0x20, 0x01, + 0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, + 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, + 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, + 0x19, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x07, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, + 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, + 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x6e, 0x61, + 0x6d, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x4e, + 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x66, 0x75, 0x6c, 0x6c, 0x5f, 0x6e, 0x61, 0x6d, 0x65, + 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x75, 0x6c, 0x6c, 0x4e, 0x61, 0x6d, 0x65, + 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x6e, 0x20, 0x01, 0x28, 0x09, 0x52, + 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x0e, 0x0a, 0x02, 0x64, 0x6e, 0x18, 0x78, 0x20, 0x01, + 0x28, 0x09, 0x52, 0x02, 0x64, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, + 0x5f, 0x6f, 0x66, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x8c, 0x01, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x0e, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x4f, 0x66, 0x47, 0x72, 0x6f, 0x75, 0x70, + 0x73, 0x22, 0xd2, 0x01, 0x0a, 0x13, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x74, 0x74, + 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x4d, 0x61, 0x70, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, + 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, + 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, + 0x25, 0x0a, 0x0e, 0x66, 0x72, 0x6f, 0x6d, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, + 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x66, 0x72, 0x6f, 0x6d, 0x41, 0x74, 0x74, + 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x5f, 0x61, 0x74, 0x74, + 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x74, 0x6f, + 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, + 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, + 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, + 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, + 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, + 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xb2, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x72, 0x65, 0x66, + 0x41, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, + 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, + 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, + 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, + 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, + 0x54, 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x6c, 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, + 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, + 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x13, 0x64, 0x65, + 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x65, + 0x73, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x64, 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, + 0x65, 0x6e, 0x63, 0x65, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x22, 0xb8, 0x03, 0x0a, 0x0c, + 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, @@ -1723,84 +1896,37 @@ var file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDesc = []byte{ 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, - 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, - 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, - 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, - 0x65, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, - 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, - 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x3c, - 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, - 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, - 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, - 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, - 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, - 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x50, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, - 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, - 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x5a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x6f, 0x67, 0x69, - 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x66, 0x75, 0x6c, 0x6c, 0x5f, 0x6e, 0x61, - 0x6d, 0x65, 0x18, 0x64, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x75, 0x6c, 0x6c, 0x4e, 0x61, - 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x6e, 0x20, 0x01, 0x28, - 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x0e, 0x0a, 0x02, 0x64, 0x6e, 0x18, 0x78, - 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x64, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x6d, 0x65, 0x6d, 0x62, - 0x65, 0x72, 0x5f, 0x6f, 0x66, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x8c, 0x01, 0x20, - 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x4f, 0x66, 0x47, 0x72, 0x6f, - 0x75, 0x70, 0x73, 0x22, 0xd2, 0x01, 0x0a, 0x13, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, - 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x4d, 0x61, 0x70, 0x12, 0x24, 0x0a, 0x0e, 0x6c, - 0x64, 0x61, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, - 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x64, 0x61, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, - 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x66, 0x72, 0x6f, 0x6d, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, - 0x75, 0x74, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x66, 0x72, 0x6f, 0x6d, 0x41, - 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x5f, 0x61, - 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, - 0x74, 0x6f, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x63, - 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, - 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, - 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, - 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, - 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xb8, 0x03, 0x0a, 0x0c, 0x4d, 0x61, 0x6e, - 0x61, 0x67, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x62, - 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, - 0x62, 0x6c, 0x69, 0x63, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, - 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, - 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, - 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, - 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, - 0x69, 0x6d, 0x65, 0x12, 0x4b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, - 0x6d, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, - 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, - 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, - 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, - 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x09, 0x42, 0x10, - 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, 0x61, 0x6d, 0x65, - 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, - 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, 0xc2, 0xdd, 0x29, - 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0b, - 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x64, 0x65, 0x73, - 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, - 0x69, 0x6f, 0x6e, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, - 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, - 0x64, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, - 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x49, 0x0a, 0x0b, 0x67, 0x72, 0x6f, 0x75, - 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, 0x42, 0x28, 0xc2, - 0xdd, 0x29, 0x24, 0x0a, 0x0a, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x12, - 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x67, 0x72, 0x6f, 0x75, - 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x52, 0x0a, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, - 0x6d, 0x65, 0x73, 0x22, 0xaf, 0x01, 0x0a, 0x19, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x64, 0x47, - 0x72, 0x6f, 0x75, 0x70, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, - 0x74, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, - 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, - 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, - 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, - 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x28, - 0x0a, 0x10, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, - 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, - 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x65, 0x6d, 0x62, - 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x65, 0x6d, - 0x62, 0x65, 0x72, 0x49, 0x64, 0x42, 0x3e, 0x5a, 0x3c, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, - 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, - 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, - 0x61, 0x75, 0x74, 0x68, 0x2f, 0x6c, 0x64, 0x61, 0x70, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, - 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x69, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, + 0x09, 0x42, 0x10, 0xc2, 0xdd, 0x29, 0x0c, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x04, 0x6e, + 0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x64, 0x65, 0x73, + 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x32, 0x20, 0x01, 0x28, 0x09, 0x42, 0x1e, + 0xc2, 0xdd, 0x29, 0x1a, 0x0a, 0x0b, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, + 0x6e, 0x12, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, + 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07, 0x76, + 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x3c, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, + 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, + 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x46, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, + 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x49, 0x0a, 0x0b, 0x67, + 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x50, 0x20, 0x01, 0x28, 0x09, + 0x42, 0x28, 0xc2, 0xdd, 0x29, 0x24, 0x0a, 0x0a, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, + 0x65, 0x73, 0x12, 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x67, + 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x52, 0x0a, 0x67, 0x72, 0x6f, 0x75, + 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0xaf, 0x01, 0x0a, 0x19, 0x4d, 0x61, 0x6e, 0x61, 0x67, + 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x41, 0x63, 0x63, + 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, + 0x69, 0x6d, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, + 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, + 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, + 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, + 0x65, 0x12, 0x28, 0x0a, 0x10, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x64, 0x5f, 0x67, 0x72, 0x6f, + 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6d, 0x61, 0x6e, + 0x61, 0x67, 0x65, 0x64, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x6d, + 0x65, 0x6d, 0x62, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, + 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x49, 0x64, 0x42, 0x3e, 0x5a, 0x3c, 0x67, 0x69, 0x74, 0x68, + 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, + 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, + 0x61, 0x6c, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x6c, 0x64, 0x61, 0x70, 0x2f, 0x73, 0x74, 0x6f, + 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( @@ -1815,7 +1941,7 @@ func file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescGZIP() []byte return file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDescData } -var file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes = make([]protoimpl.MessageInfo, 11) +var file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes = make([]protoimpl.MessageInfo, 12) var file_controller_storage_auth_ldap_store_v1_ldap_proto_goTypes = []interface{}{ (*AuthMethod)(nil), // 0: controller.storage.auth.ldap.store.v1.AuthMethod (*Url)(nil), // 1: controller.storage.auth.ldap.store.v1.Url @@ -1826,30 +1952,32 @@ var file_controller_storage_auth_ldap_store_v1_ldap_proto_goTypes = []interface{ (*BindCredential)(nil), // 6: controller.storage.auth.ldap.store.v1.BindCredential (*Account)(nil), // 7: controller.storage.auth.ldap.store.v1.Account (*AccountAttributeMap)(nil), // 8: controller.storage.auth.ldap.store.v1.AccountAttributeMap - (*ManagedGroup)(nil), // 9: controller.storage.auth.ldap.store.v1.ManagedGroup - (*ManagedGroupMemberAccount)(nil), // 10: controller.storage.auth.ldap.store.v1.ManagedGroupMemberAccount - (*timestamp.Timestamp)(nil), // 11: controller.storage.timestamp.v1.Timestamp + (*DerefAliases)(nil), // 9: controller.storage.auth.ldap.store.v1.DerefAliases + (*ManagedGroup)(nil), // 10: controller.storage.auth.ldap.store.v1.ManagedGroup + (*ManagedGroupMemberAccount)(nil), // 11: controller.storage.auth.ldap.store.v1.ManagedGroupMemberAccount + (*timestamp.Timestamp)(nil), // 12: controller.storage.timestamp.v1.Timestamp } var file_controller_storage_auth_ldap_store_v1_ldap_proto_depIdxs = []int32{ - 11, // 0: controller.storage.auth.ldap.store.v1.AuthMethod.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 1: controller.storage.auth.ldap.store.v1.AuthMethod.update_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 2: controller.storage.auth.ldap.store.v1.Url.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 3: controller.storage.auth.ldap.store.v1.UserEntrySearchConf.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 4: controller.storage.auth.ldap.store.v1.GroupEntrySearchConf.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 5: controller.storage.auth.ldap.store.v1.Certificate.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 6: controller.storage.auth.ldap.store.v1.ClientCertificate.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 7: controller.storage.auth.ldap.store.v1.BindCredential.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 8: controller.storage.auth.ldap.store.v1.Account.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 9: controller.storage.auth.ldap.store.v1.Account.update_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 10: controller.storage.auth.ldap.store.v1.AccountAttributeMap.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 11: controller.storage.auth.ldap.store.v1.ManagedGroup.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 12: controller.storage.auth.ldap.store.v1.ManagedGroup.update_time:type_name -> controller.storage.timestamp.v1.Timestamp - 11, // 13: controller.storage.auth.ldap.store.v1.ManagedGroupMemberAccount.create_time:type_name -> controller.storage.timestamp.v1.Timestamp - 14, // [14:14] is the sub-list for method output_type - 14, // [14:14] is the sub-list for method input_type - 14, // [14:14] is the sub-list for extension type_name - 14, // [14:14] is the sub-list for extension extendee - 0, // [0:14] is the sub-list for field type_name + 12, // 0: controller.storage.auth.ldap.store.v1.AuthMethod.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 1: controller.storage.auth.ldap.store.v1.AuthMethod.update_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 2: controller.storage.auth.ldap.store.v1.Url.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 3: controller.storage.auth.ldap.store.v1.UserEntrySearchConf.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 4: controller.storage.auth.ldap.store.v1.GroupEntrySearchConf.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 5: controller.storage.auth.ldap.store.v1.Certificate.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 6: controller.storage.auth.ldap.store.v1.ClientCertificate.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 7: controller.storage.auth.ldap.store.v1.BindCredential.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 8: controller.storage.auth.ldap.store.v1.Account.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 9: controller.storage.auth.ldap.store.v1.Account.update_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 10: controller.storage.auth.ldap.store.v1.AccountAttributeMap.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 11: controller.storage.auth.ldap.store.v1.DerefAliases.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 12: controller.storage.auth.ldap.store.v1.ManagedGroup.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 13: controller.storage.auth.ldap.store.v1.ManagedGroup.update_time:type_name -> controller.storage.timestamp.v1.Timestamp + 12, // 14: controller.storage.auth.ldap.store.v1.ManagedGroupMemberAccount.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 15, // [15:15] is the sub-list for method output_type + 15, // [15:15] is the sub-list for method input_type + 15, // [15:15] is the sub-list for extension type_name + 15, // [15:15] is the sub-list for extension extendee + 0, // [0:15] is the sub-list for field type_name } func init() { file_controller_storage_auth_ldap_store_v1_ldap_proto_init() } @@ -1967,7 +2095,7 @@ func file_controller_storage_auth_ldap_store_v1_ldap_proto_init() { } } file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} { - switch v := v.(*ManagedGroup); i { + switch v := v.(*DerefAliases); i { case 0: return &v.state case 1: @@ -1979,6 +2107,18 @@ func file_controller_storage_auth_ldap_store_v1_ldap_proto_init() { } } file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*ManagedGroup); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } + file_controller_storage_auth_ldap_store_v1_ldap_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} { switch v := v.(*ManagedGroupMemberAccount); i { case 0: return &v.state @@ -1997,7 +2137,7 @@ func file_controller_storage_auth_ldap_store_v1_ldap_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: file_controller_storage_auth_ldap_store_v1_ldap_proto_rawDesc, NumEnums: 0, - NumMessages: 11, + NumMessages: 12, NumExtensions: 0, NumServices: 0, }, diff --git a/internal/auth/ldap/testing.go b/internal/auth/ldap/testing.go index eb262f306..c33bf5f7d 100644 --- a/internal/auth/ldap/testing.go +++ b/internal/auth/ldap/testing.go @@ -140,6 +140,16 @@ func TestAuthMethod(t testing.TB, } am.BindPasswordHmac = bc.PasswordHmac } + if opts.withDerefAliases != "" { + d, err := NewDerefAliases(testCtx, am.PublicId, opts.withDerefAliases) + if err != nil { + return err + } + if err := w.Create(testCtx, d); err != nil { + return err + } + am.DereferenceAliases = d.DereferenceAliases + } return nil }) require.NoError(err) diff --git a/internal/daemon/controller/handlers/authmethods/authmethod_service.go b/internal/daemon/controller/handlers/authmethods/authmethod_service.go index 4063aa5e3..29f2f9ecd 100644 --- a/internal/daemon/controller/handlers/authmethods/authmethod_service.go +++ b/internal/daemon/controller/handlers/authmethods/authmethod_service.go @@ -903,6 +903,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers. ClientCertificateKeyHmac: base64.RawURLEncoding.EncodeToString(i.GetClientCertificateKeyHmac()), BindPasswordHmac: base64.RawURLEncoding.EncodeToString(i.GetBindPasswordHmac()), UseTokenGroups: i.GetUseTokenGroups(), + MaximumPageSize: i.GetMaximumPageSize(), } if i.GetUpnDomain() != "" { attrs.UpnDomain = wrapperspb.String(i.GetUpnDomain()) @@ -934,6 +935,9 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers. if len(i.GetAccountAttributeMaps()) > 0 { attrs.AccountAttributeMaps = i.GetAccountAttributeMaps() } + if i.GetDereferenceAliases() != "" { + attrs.DereferenceAliases = wrapperspb.String(i.GetDereferenceAliases()) + } out.Attrs = &pb.AuthMethod_LdapAuthMethodsAttributes{ LdapAuthMethodsAttributes: attrs, diff --git a/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go b/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go index 4dbca7714..43c566674 100644 --- a/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go +++ b/internal/daemon/controller/handlers/authmethods/authmethod_service_test.go @@ -170,9 +170,13 @@ func TestGet(t *testing.T) { AuthorizedCollectionActions: authorizedCollectionActions, } - ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, o.GetPublicId(), []string{"ldaps://ldap1"}, ldap.WithAccountAttributeMap(ctx, map[string]ldap.AccountToAttribute{ - "mail": ldap.ToEmailAttribute, - })) + ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, o.GetPublicId(), []string{"ldaps://ldap1"}, + ldap.WithAccountAttributeMap(ctx, map[string]ldap.AccountToAttribute{ + "mail": ldap.ToEmailAttribute, + }), + ldap.WithMaximumPageSize(ctx, 10), + ldap.WithDerefAliases(ctx, ldap.DerefAlways), + ) wantLdap := &pb.AuthMethod{ Id: ldapAm.GetPublicId(), ScopeId: ldapAm.GetScopeId(), @@ -184,6 +188,8 @@ func TestGet(t *testing.T) { State: string(ldap.InactiveState), Urls: []string{"ldaps://ldap1"}, AccountAttributeMaps: []string{"mail=email"}, + MaximumPageSize: 10, + DereferenceAliases: wrapperspb.String(string(ldap.DerefAlways)), }, }, Version: 1, @@ -362,7 +368,11 @@ func TestList(t *testing.T) { return cp } - ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, oWithAuthMethods.GetPublicId(), []string{"ldaps://ldap1"}, ldap.WithOperationalState(ctx, ldap.ActivePublicState)) + ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, oWithAuthMethods.GetPublicId(), []string{"ldaps://ldap1"}, + ldap.WithOperationalState(ctx, ldap.ActivePublicState), + ldap.WithMaximumPageSize(ctx, 10), + ldap.WithDerefAliases(ctx, ldap.DerefAlways), + ) wantSomeAuthMethods = append(wantSomeAuthMethods, &pb.AuthMethod{ Id: ldapAm.GetPublicId(), ScopeId: oWithAuthMethods.GetPublicId(), @@ -373,8 +383,10 @@ func TestList(t *testing.T) { Type: ldap.Subtype.String(), Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{ LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{ - State: string(ldap.ActivePublicState), - Urls: []string{"ldaps://ldap1"}, + State: string(ldap.ActivePublicState), + Urls: []string{"ldaps://ldap1"}, + MaximumPageSize: 10, + DereferenceAliases: wrapperspb.String(string(ldap.DerefAlways)), }, }, AuthorizedActions: ldapAuthorizedActions, @@ -774,6 +786,8 @@ func TestCreate(t *testing.T) { ClientCertificateKey: wrapperspb.String(string(testEncodedKey)), UseTokenGroups: true, AccountAttributeMaps: []string{"mail=email"}, + MaximumPageSize: 10, + DereferenceAliases: wrapperspb.String(string(ldap.DerefAlways)), }, }, }}, @@ -808,6 +822,8 @@ func TestCreate(t *testing.T) { ClientCertificate: wrapperspb.String(testEncodedCert), UseTokenGroups: true, AccountAttributeMaps: []string{"mail=email"}, + MaximumPageSize: 10, + DereferenceAliases: wrapperspb.String(string(ldap.DerefAlways)), }, }, AuthorizedActions: ldapAuthorizedActions, @@ -1205,6 +1221,21 @@ func TestCreate(t *testing.T) { err: handlers.ApiErrorWithCode(codes.InvalidArgument), errContains: "is not either ldap or ldaps", }, + { + name: "ldap-auth-method-invalid-deref-aliases", + req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{ + ScopeId: o.GetPublicId(), + Type: ldap.Subtype.String(), + Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{ + LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{ + Urls: []string{"ldap://ldap1"}, + DereferenceAliases: wrapperspb.String("invalid"), + }, + }, + }}, + err: handlers.ApiErrorWithCode(codes.InvalidArgument), + errContains: "invalid is not a valid attributes.dereference_aliases", + }, { name: "ldap-auth-method-invalid-cert", req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{ diff --git a/internal/daemon/controller/handlers/authmethods/ldap.go b/internal/daemon/controller/handlers/authmethods/ldap.go index 9b11667fc..86aefa275 100644 --- a/internal/daemon/controller/handlers/authmethods/ldap.go +++ b/internal/daemon/controller/handlers/authmethods/ldap.go @@ -53,6 +53,7 @@ const ( clientCertificateKeyField = "attributes.client_certificate_key" certificatesField = "attributes.certificates" accountAttributesMapField = "attributes.account_attribute_maps" + derefAliasesField = "attributes.dereference_aliases" ) func (s Service) authenticateLdap(ctx context.Context, req *pbs.AuthenticateRequest, authResults *auth.VerifyResults) (*pbs.AuthenticateResponse, error) { @@ -257,6 +258,12 @@ func toStorageLdapAuthMethod(ctx context.Context, scopeId string, in *pb.AuthMet } opts = append(opts, ldap.WithUrls(ctx, urls...)) } + if attrs.GetMaximumPageSize() > 0 { + opts = append(opts, ldap.WithMaximumPageSize(ctx, attrs.MaximumPageSize)) + } + if attrs.GetDereferenceAliases().GetValue() != "" { + opts = append(opts, ldap.WithDerefAliases(ctx, ldap.DerefAliasType(attrs.GetDereferenceAliases().GetValue()))) + } } u, err := ldap.NewAuthMethod(ctx, scopeId, opts...) if err != nil { @@ -325,6 +332,12 @@ func validateLdapAttributes(ctx context.Context, attrs *pb.LdapAuthMethodAttribu badFields[accountAttributesMapField] = fmt.Sprintf("invalid %s (unable to parse)", accountAttributesMapField) } } + if attrs.GetDereferenceAliases().GetValue() != "" { + d := ldap.DerefAliasType(attrs.GetDereferenceAliases().GetValue()) + if err := d.IsValid(ctx); err != nil { + badFields[derefAliasesField] = fmt.Sprintf("%s is not a valid %s", attrs.GetDereferenceAliases().GetValue(), derefAliasesField) + } + } } func validateAuthenticateLdapRequest(req *pbs.AuthenticateRequest) error { diff --git a/internal/db/schema/migrations/oss/postgres/65/01_ldap.up.sql b/internal/db/schema/migrations/oss/postgres/65/01_ldap.up.sql index acac8e94e..941d42ad2 100644 --- a/internal/db/schema/migrations/oss/postgres/65/01_ldap.up.sql +++ b/internal/db/schema/migrations/oss/postgres/65/01_ldap.up.sql @@ -18,6 +18,7 @@ insert into auth_ldap_method_state_enm(name) ('active-private'), ('active-public'); +-- column added to auth_ldap_method in in 76/01_ldap.up.sql create table auth_ldap_method ( public_id wt_public_id primary key, scope_id wt_scope_id not null, @@ -465,6 +466,7 @@ values ('auth_ldap_managed_group', 1); +-- updated in 76/01_ldap.up.sql -- ldap_auth_method_with_value_obj is useful for reading an ldap auth method -- with its associated value objects (urls, certs, search config, etc). The use -- of the postgres string_agg(...) to aggregate the url and cert value objects diff --git a/internal/db/schema/migrations/oss/postgres/76/01_ldap.up.sql b/internal/db/schema/migrations/oss/postgres/76/01_ldap.up.sql new file mode 100644 index 000000000..92eaa43c4 --- /dev/null +++ b/internal/db/schema/migrations/oss/postgres/76/01_ldap.up.sql @@ -0,0 +1,126 @@ +-- Copyright (c) HashiCorp, Inc. +-- SPDX-License-Identifier: BUSL-1.1 + +begin; + + alter table auth_ldap_method + add column maximum_page_size int not null default 0 + constraint maximum_page_size_greater_or_equal_to_zero + check( + maximum_page_size >= 0 + ); + + create table auth_ldap_deref_aliases_enm ( + name text primary key + constraint only_predefined_deref_aliases_allowed + check ( + name in ( + 'NeverDerefAliases', + 'DerefInSearching', + 'DerefFindingBaseObj', + 'DerefAlways' + ) + ) + ); + comment on table auth_ldap_deref_aliases_enm is + 'auth_ldap_deref_alias_enm is an enumeration table for ldap deref aliases.' + 'It contains rows for representing the NeverDerefAliases, DerefInSearching, ' + 'DerefFindingBaseObj, and DerefAlways deref aliasing.'; + + insert into auth_ldap_deref_aliases_enm (name) + values + ('NeverDerefAliases'), + ('DerefInSearching'), + ('DerefFindingBaseObj'), + ('DerefAlways'); + + create table auth_ldap_deref_aliases ( + create_time wt_timestamp, + ldap_method_id wt_public_id primary key + constraint auth_ldap_method_fkey + references auth_ldap_method (public_id) + on delete cascade + on update cascade, + dereference_aliases text not null + constraint auth_ldap_deref_aliases_enm_fkey + references auth_ldap_deref_aliases_enm (name) + on delete cascade + on update cascade + ); + comment on table auth_ldap_deref_aliases is + 'auth_ldap_deref_aliases are optional and specify how Boundary should handle ' + 'dereferencing aliases durning LDAP searches'; + + -- replaces view from 65/01_ldap.up.sql + drop view ldap_auth_method_with_value_obj; + -- ldap_auth_method_with_value_obj is useful for reading an ldap auth method + -- with its associated value objects (urls, certs, search config, etc). The use + -- of the postgres string_agg(...) to aggregate the url and cert value objects + -- into a column works because we are only pulling in one column from the + -- associated tables and that value is part of the primary key and unique. This + -- view will make things like recursive listing of ldap auth methods fairly + -- straightforward to implement for the ldap repo. The view also includes an + -- is_primary_auth_method bool + create view ldap_auth_method_with_value_obj as + select + case when s.primary_auth_method_id is not null then + true + else false end + as is_primary_auth_method, + am.public_id, + am.scope_id, + am.name, + am.description, + am.create_time, + am.update_time, + am.version, + am.state, + am.start_tls, + am.insecure_tls, + am.discover_dn, + am.anon_group_search, + am.upn_domain, + am.enable_groups, + am.use_token_groups, + am.maximum_page_size, + -- the string_agg(..) column will be null if there are no associated value objects + string_agg(distinct url.url, '|') as urls, + string_agg(distinct cert.certificate, '|') as certs, + string_agg(distinct concat_ws('=', aam.from_attribute, aam.to_attribute), '|') as account_attribute_map, + + -- the rest of the fields are zero to one relationships that are stored in + -- related tables. Since we're outer joining with these tables, we need to + -- either add them to the group by, use an aggregating func, or handle + -- multiple rows returning for each auth method. I've chosen to just use + -- string_agg(...) + string_agg(distinct uc.user_dn, '|') as user_dn, + string_agg(distinct uc.user_attr, '|') as user_attr, + string_agg(distinct uc.user_filter, '|') as user_filter, + string_agg(distinct gc.group_dn, '|') as group_dn, + string_agg(distinct gc.group_attr, '|') as group_attr, + string_agg(distinct gc.group_filter, '|') as group_filter, + string_agg(distinct cc.certificate_key, '|') as client_certificate_key, + string_agg(distinct cc.certificate_key_hmac, '|') as client_certificate_key_hmac, + string_agg(distinct cc.key_id, '|') as client_certificate_key_id, + string_agg(distinct cc.certificate, '|') as client_certificate_cert, + string_agg(distinct bc.dn, '|') as bind_dn, + string_agg(distinct bc.password, '|') as bind_password, + string_agg(distinct bc.password_hmac, '|') as bind_password_hmac, + string_agg(distinct bc.key_id, '|') as bind_password_key_id, + string_agg(distinct df.dereference_aliases, '|') as dereference_aliases + from + auth_ldap_method am + left outer join iam_scope s on am.public_id = s.primary_auth_method_id + left outer join auth_ldap_url url on am.public_id = url.ldap_method_id + left outer join auth_ldap_certificate cert on am.public_id = cert.ldap_method_id + left outer join auth_ldap_account_attribute_map aam on am.public_id = aam.ldap_method_id + left outer join auth_ldap_user_entry_search uc on am.public_id = uc.ldap_method_id + left outer join auth_ldap_group_entry_search gc on am.public_id = gc.ldap_method_id + left outer join auth_ldap_client_certificate cc on am.public_id = cc.ldap_method_id + left outer join auth_ldap_bind_credential bc on am.public_id = bc.ldap_method_id + left outer join auth_ldap_deref_aliases df on am.public_id = df.ldap_method_id + group by am.public_id, is_primary_auth_method; -- there can be only one public_id + is_primary_auth_method, so group by isn't a problem. + comment on view ldap_auth_method_with_value_obj is + 'ldap auth method with its associated value objects (urls, certs, search config, etc)'; + +commit; \ No newline at end of file diff --git a/internal/proto/controller/api/resources/authmethods/v1/auth_method.proto b/internal/proto/controller/api/resources/authmethods/v1/auth_method.proto index c71b66305..e6c363f50 100644 --- a/internal/proto/controller/api/resources/authmethods/v1/auth_method.proto +++ b/internal/proto/controller/api/resources/authmethods/v1/auth_method.proto @@ -570,4 +570,31 @@ message LdapAuthMethodAttributes { that: "AccountAttributeMaps" } ]; // @gotags: `class:"public"` + + // maximum_page_size (optional) specifies a maximum ldap search result size to + // use when retrieving the authenticated user's group memberships. This can + // be used to avoid reaching the LDAP server's max result size. + uint32 maximum_page_size = 240 [ + json_name = "maximum_page_size", + (custom_options.v1.generate_sdk_option) = true, + (custom_options.v1.mask_mapping) = { + this: "attributes.maximum_page_size", + that: "MaximumPageSize" + } + ]; // @gotags: `class:"public"` + + // dereference_aliases (optional) will control how aliases are dereferenced when + // performing the search. Possible values are: never, finding, searching, + // and always. If unset, a default of "never" is used. When set to + // "finding", it will only dereference aliases during name resolution of the + // base. When set to "searching", it will dereference aliases after name + // resolution. + google.protobuf.StringValue dereference_aliases = 250 [ + json_name = "dereference_aliases", + (custom_options.v1.generate_sdk_option) = true, + (custom_options.v1.mask_mapping) = { + this: "attributes.dereference_aliases", + that: "DereferenceAliases" + } + ]; // @gotags: `class:"public"` } diff --git a/internal/proto/controller/storage/auth/ldap/store/v1/ldap.proto b/internal/proto/controller/storage/auth/ldap/store/v1/ldap.proto index 7e6e0d55f..68733c31c 100644 --- a/internal/proto/controller/storage/auth/ldap/store/v1/ldap.proto +++ b/internal/proto/controller/storage/auth/ldap/store/v1/ldap.proto @@ -257,6 +257,27 @@ message AuthMethod { this: "AccountAttributeMaps" that: "attributes.account_attribute_maps" }]; + + // MaximumPageSize optionally specifies a maximum ldap search result size to + // use when retrieving the authenticated user's group memberships. This can + // be used to avoid reaching the LDAP server's max result size. + // @inject_tag: `gorm:"not_null;default:0"` + uint32 maximum_page_size = 310 [(custom_options.v1.mask_mapping) = { + this: "MaximumPageSize" + that: "attributes.maximum_page_size" + }]; + + // dereference_aliases will control how aliases are dereferenced when + // performing the search. Possible values are: never, finding, searching, + // and always. If unset, a default of "never" is used. When set to + // "finding", it will only dereference aliases during name resolution of the + // base. When set to "searching", it will dereference aliases after name + // resolution. + // @inject_tag: `gorm:"-"` + string dereference_aliases = 320 [(custom_options.v1.mask_mapping) = { + this: "DereferenceAliases" + that: "attributes.dereference_aliases" + }]; } // Url represents LDAP URLs that specify LDAP servers to connection to. There @@ -532,6 +553,26 @@ message AccountAttributeMap { timestamp.v1.Timestamp create_time = 40; } +// DerefAliases represent aan optional configuration field used to +// determine how to derefence aliases when searching ldap. +message DerefAliases { + // create_time is set by the database. + // @inject_tag: `gorm:"default:current_timestamp"` + timestamp.v1.Timestamp create_time = 10; + + // ldap_method_id is the FK to the UserEntrySearchConf's LDAP auth method. + // @inject_tag: `gorm:"primary_key"` + string ldap_method_id = 20; + + // dereference_aliases will control how aliases are dereferenced when + // performing the search. Possible values are: never, finding, searching, + // and always. If unset, a default of "never" is used. When set to + // "finding", it will only dereference aliases during name resolution of the + // base. When set to "searching", it will dereference aliases after name + // resolution. + string dereference_aliases = 30; +} + // ManagedGroup entries provide an LDAP auth method implementation of managed // groups. message ManagedGroup { diff --git a/sdk/pbs/controller/api/resources/authmethods/auth_method.pb.go b/sdk/pbs/controller/api/resources/authmethods/auth_method.pb.go index 1a2aba549..89ae70014 100644 --- a/sdk/pbs/controller/api/resources/authmethods/auth_method.pb.go +++ b/sdk/pbs/controller/api/resources/authmethods/auth_method.pb.go @@ -897,6 +897,17 @@ type LdapAuthMethodAttributes struct { // value equals the to_attribute. For example "preferredName=fullName". All // attribute names are case insensitive. AccountAttributeMaps []string `protobuf:"bytes,230,rep,name=account_attribute_maps,proto3" json:"account_attribute_maps,omitempty" class:"public"` // @gotags: `class:"public"` + // maximum_page_size (optional) specifies a maximum ldap search result size to + // use when retrieving the authenticated user's group memberships. This can + // be used to avoid reaching the LDAP server's max result size. + MaximumPageSize uint32 `protobuf:"varint,240,opt,name=maximum_page_size,proto3" json:"maximum_page_size,omitempty" class:"public"` // @gotags: `class:"public"` + // dereference_aliases (optional) will control how aliases are dereferenced when + // performing the search. Possible values are: never, finding, searching, + // and always. If unset, a default of "never" is used. When set to + // "finding", it will only dereference aliases during name resolution of the + // base. When set to "searching", it will dereference aliases after name + // resolution. + DereferenceAliases *wrapperspb.StringValue `protobuf:"bytes,250,opt,name=dereference_aliases,proto3" json:"dereference_aliases,omitempty" class:"public"` // @gotags: `class:"public"` } func (x *LdapAuthMethodAttributes) Reset() { @@ -1092,6 +1103,20 @@ func (x *LdapAuthMethodAttributes) GetAccountAttributeMaps() []string { return nil } +func (x *LdapAuthMethodAttributes) GetMaximumPageSize() uint32 { + if x != nil { + return x.MaximumPageSize + } + return 0 +} + +func (x *LdapAuthMethodAttributes) GetDereferenceAliases() *wrapperspb.StringValue { + if x != nil { + return x.DereferenceAliases + } + return nil +} + var File_controller_api_resources_authmethods_v1_auth_method_proto protoreflect.FileDescriptor var file_controller_api_resources_authmethods_v1_auth_method_proto_rawDesc = []byte{ @@ -1330,7 +1355,7 @@ var file_controller_api_resources_authmethods_v1_auth_method_proto_rawDesc = []b 0x65, 0x74, 0x68, 0x6f, 0x64, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, - 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xc1, 0x11, 0x0a, 0x18, 0x4c, 0x64, 0x61, 0x70, 0x41, + 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xb9, 0x13, 0x0a, 0x18, 0x4c, 0x64, 0x61, 0x70, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x12, 0x42, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x42, 0x2c, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x24, 0x0a, 0x10, 0x61, 0x74, @@ -1470,14 +1495,29 @@ var file_controller_api_resources_authmethods_v1_auth_method_proto_rawDesc = []b 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x73, 0x12, 0x14, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x4d, 0x61, 0x70, 0x73, 0x52, 0x16, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, - 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x73, 0x42, 0x60, 0xa2, 0xe3, 0x29, 0x04, - 0x61, 0x75, 0x74, 0x68, 0x5a, 0x56, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, - 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, - 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, - 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, - 0x72, 0x63, 0x65, 0x73, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, - 0x3b, 0x61, 0x75, 0x74, 0x68, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x62, 0x06, 0x70, 0x72, - 0x6f, 0x74, 0x6f, 0x33, + 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x73, 0x12, 0x66, 0x0a, 0x11, 0x6d, 0x61, + 0x78, 0x69, 0x6d, 0x75, 0x6d, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18, + 0xf0, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x42, 0x37, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x2f, + 0x0a, 0x1c, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x6d, 0x61, 0x78, + 0x69, 0x6d, 0x75, 0x6d, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x0f, + 0x4d, 0x61, 0x78, 0x69, 0x6d, 0x75, 0x6d, 0x50, 0x61, 0x67, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x52, + 0x11, 0x6d, 0x61, 0x78, 0x69, 0x6d, 0x75, 0x6d, 0x5f, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x69, + 0x7a, 0x65, 0x12, 0x8d, 0x01, 0x0a, 0x13, 0x64, 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, + 0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x18, 0xfa, 0x01, 0x20, 0x01, 0x28, + 0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, + 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, + 0x3c, 0xa0, 0xda, 0x29, 0x01, 0xc2, 0xdd, 0x29, 0x34, 0x0a, 0x1e, 0x61, 0x74, 0x74, 0x72, 0x69, + 0x62, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x64, 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, + 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x12, 0x12, 0x44, 0x65, 0x72, 0x65, 0x66, + 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x65, 0x73, 0x52, 0x13, 0x64, + 0x65, 0x72, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63, 0x65, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, + 0x65, 0x73, 0x42, 0x60, 0xa2, 0xe3, 0x29, 0x04, 0x61, 0x75, 0x74, 0x68, 0x5a, 0x56, 0x67, 0x69, + 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, + 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, + 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, + 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x61, 0x75, 0x74, + 0x68, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x3b, 0x61, 0x75, 0x74, 0x68, 0x6d, 0x65, 0x74, + 0x68, 0x6f, 0x64, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( @@ -1538,12 +1578,13 @@ var file_controller_api_resources_authmethods_v1_auth_method_proto_depIdxs = []i 11, // 23: controller.api.resources.authmethods.v1.LdapAuthMethodAttributes.client_certificate_key:type_name -> google.protobuf.StringValue 11, // 24: controller.api.resources.authmethods.v1.LdapAuthMethodAttributes.bind_dn:type_name -> google.protobuf.StringValue 11, // 25: controller.api.resources.authmethods.v1.LdapAuthMethodAttributes.bind_password:type_name -> google.protobuf.StringValue - 15, // 26: controller.api.resources.authmethods.v1.AuthMethod.AuthorizedCollectionActionsEntry.value:type_name -> google.protobuf.ListValue - 27, // [27:27] is the sub-list for method output_type - 27, // [27:27] is the sub-list for method input_type - 27, // [27:27] is the sub-list for extension type_name - 27, // [27:27] is the sub-list for extension extendee - 0, // [0:27] is the sub-list for field type_name + 11, // 26: controller.api.resources.authmethods.v1.LdapAuthMethodAttributes.dereference_aliases:type_name -> google.protobuf.StringValue + 15, // 27: controller.api.resources.authmethods.v1.AuthMethod.AuthorizedCollectionActionsEntry.value:type_name -> google.protobuf.ListValue + 28, // [28:28] is the sub-list for method output_type + 28, // [28:28] is the sub-list for method input_type + 28, // [28:28] is the sub-list for extension type_name + 28, // [28:28] is the sub-list for extension extendee + 0, // [0:28] is the sub-list for field type_name } func init() { file_controller_api_resources_authmethods_v1_auth_method_proto_init() }