feat: add API support for additional LDAP auth method fields. (#3679)

* feat (auth/ldap): add Repo support for max page size and deref aliases (#3670)

* chore: update cap/ldap dependency

This latest version of cap/ldap adds support for MaxPageSize and
DerefAliases

* feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto

* feat (api/authmethods): add new ldap fields.

Add support for maximum_page_size and dereference_aliases

* feat (auth/ldap): schema changes to support new LDAP attributes

* feat (auth/ldap): add Repo support for max page size and deref aliases

* feat (handlers/ldap): add support for new fields (#3674)

Added API support for new ldap fields: MaximumPageSize and
DereferenceAliases

* chore: add CHANGELOG entry for new api auth ldap fields

internal/daemon/controller/handlers/authmethods/authmethod_service.go

@@ -903,6 +903,7 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 			ClientCertificateKeyHmac: base64.RawURLEncoding.EncodeToString(i.GetClientCertificateKeyHmac()),
 			BindPasswordHmac:         base64.RawURLEncoding.EncodeToString(i.GetBindPasswordHmac()),
 			UseTokenGroups:           i.GetUseTokenGroups(),
+			MaximumPageSize:          i.GetMaximumPageSize(),
 		}
 		if i.GetUpnDomain() != "" {
 			attrs.UpnDomain = wrapperspb.String(i.GetUpnDomain())
@@ -934,6 +935,9 @@ func toAuthMethodProto(ctx context.Context, in auth.AuthMethod, opt ...handlers.
 		if len(i.GetAccountAttributeMaps()) > 0 {
 			attrs.AccountAttributeMaps = i.GetAccountAttributeMaps()
 		}
+		if i.GetDereferenceAliases() != "" {
+			attrs.DereferenceAliases = wrapperspb.String(i.GetDereferenceAliases())
+		}
 
 		out.Attrs = &pb.AuthMethod_LdapAuthMethodsAttributes{
 			LdapAuthMethodsAttributes: attrs,

internal/daemon/controller/handlers/authmethods/authmethod_service_test.go

@@ -170,9 +170,13 @@ func TestGet(t *testing.T) {
 		AuthorizedCollectionActions: authorizedCollectionActions,
 	}
 
-	ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, o.GetPublicId(), []string{"ldaps://ldap1"}, ldap.WithAccountAttributeMap(ctx, map[string]ldap.AccountToAttribute{
-		"mail": ldap.ToEmailAttribute,
-	}))
+	ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, o.GetPublicId(), []string{"ldaps://ldap1"},
+		ldap.WithAccountAttributeMap(ctx, map[string]ldap.AccountToAttribute{
+			"mail": ldap.ToEmailAttribute,
+		}),
+		ldap.WithMaximumPageSize(ctx, 10),
+		ldap.WithDerefAliases(ctx, ldap.DerefAlways),
+	)
 	wantLdap := &pb.AuthMethod{
 		Id:          ldapAm.GetPublicId(),
 		ScopeId:     ldapAm.GetScopeId(),
@@ -184,6 +188,8 @@ func TestGet(t *testing.T) {
 				State:                string(ldap.InactiveState),
 				Urls:                 []string{"ldaps://ldap1"},
 				AccountAttributeMaps: []string{"mail=email"},
+				MaximumPageSize:      10,
+				DereferenceAliases:   wrapperspb.String(string(ldap.DerefAlways)),
 			},
 		},
 		Version: 1,
@@ -362,7 +368,11 @@ func TestList(t *testing.T) {
 		return cp
 	}
 
-	ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, oWithAuthMethods.GetPublicId(), []string{"ldaps://ldap1"}, ldap.WithOperationalState(ctx, ldap.ActivePublicState))
+	ldapAm := ldap.TestAuthMethod(t, conn, databaseWrapper, oWithAuthMethods.GetPublicId(), []string{"ldaps://ldap1"},
+		ldap.WithOperationalState(ctx, ldap.ActivePublicState),
+		ldap.WithMaximumPageSize(ctx, 10),
+		ldap.WithDerefAliases(ctx, ldap.DerefAlways),
+	)
 	wantSomeAuthMethods = append(wantSomeAuthMethods, &pb.AuthMethod{
 		Id:          ldapAm.GetPublicId(),
 		ScopeId:     oWithAuthMethods.GetPublicId(),
@@ -373,8 +383,10 @@ func TestList(t *testing.T) {
 		Type:        ldap.Subtype.String(),
 		Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
 			LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
-				State: string(ldap.ActivePublicState),
-				Urls:  []string{"ldaps://ldap1"},
+				State:              string(ldap.ActivePublicState),
+				Urls:               []string{"ldaps://ldap1"},
+				MaximumPageSize:    10,
+				DereferenceAliases: wrapperspb.String(string(ldap.DerefAlways)),
 			},
 		},
 		AuthorizedActions:           ldapAuthorizedActions,
@@ -774,6 +786,8 @@ func TestCreate(t *testing.T) {
 						ClientCertificateKey: wrapperspb.String(string(testEncodedKey)),
 						UseTokenGroups:       true,
 						AccountAttributeMaps: []string{"mail=email"},
+						MaximumPageSize:      10,
+						DereferenceAliases:   wrapperspb.String(string(ldap.DerefAlways)),
 					},
 				},
 			}},
@@ -808,6 +822,8 @@ func TestCreate(t *testing.T) {
 							ClientCertificate:    wrapperspb.String(testEncodedCert),
 							UseTokenGroups:       true,
 							AccountAttributeMaps: []string{"mail=email"},
+							MaximumPageSize:      10,
+							DereferenceAliases:   wrapperspb.String(string(ldap.DerefAlways)),
 						},
 					},
 					AuthorizedActions:           ldapAuthorizedActions,
@@ -1205,6 +1221,21 @@ func TestCreate(t *testing.T) {
 			err:         handlers.ApiErrorWithCode(codes.InvalidArgument),
 			errContains: "is not either ldap or ldaps",
 		},
+		{
+			name: "ldap-auth-method-invalid-deref-aliases",
+			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{
+				ScopeId: o.GetPublicId(),
+				Type:    ldap.Subtype.String(),
+				Attrs: &pb.AuthMethod_LdapAuthMethodsAttributes{
+					LdapAuthMethodsAttributes: &pb.LdapAuthMethodAttributes{
+						Urls:               []string{"ldap://ldap1"},
+						DereferenceAliases: wrapperspb.String("invalid"),
+					},
+				},
+			}},
+			err:         handlers.ApiErrorWithCode(codes.InvalidArgument),
+			errContains: "invalid is not a valid attributes.dereference_aliases",
+		},
 		{
 			name: "ldap-auth-method-invalid-cert",
 			req: &pbs.CreateAuthMethodRequest{Item: &pb.AuthMethod{

internal/daemon/controller/handlers/authmethods/ldap.go

@@ -53,6 +53,7 @@ const (
 	clientCertificateKeyField = "attributes.client_certificate_key"
 	certificatesField         = "attributes.certificates"
 	accountAttributesMapField = "attributes.account_attribute_maps"
+	derefAliasesField         = "attributes.dereference_aliases"
 )
 
 func (s Service) authenticateLdap(ctx context.Context, req *pbs.AuthenticateRequest, authResults *auth.VerifyResults) (*pbs.AuthenticateResponse, error) {
@@ -257,6 +258,12 @@ func toStorageLdapAuthMethod(ctx context.Context, scopeId string, in *pb.AuthMet
 			}
 			opts = append(opts, ldap.WithUrls(ctx, urls...))
 		}
+		if attrs.GetMaximumPageSize() > 0 {
+			opts = append(opts, ldap.WithMaximumPageSize(ctx, attrs.MaximumPageSize))
+		}
+		if attrs.GetDereferenceAliases().GetValue() != "" {
+			opts = append(opts, ldap.WithDerefAliases(ctx, ldap.DerefAliasType(attrs.GetDereferenceAliases().GetValue())))
+		}
 	}
 	u, err := ldap.NewAuthMethod(ctx, scopeId, opts...)
 	if err != nil {
@@ -325,6 +332,12 @@ func validateLdapAttributes(ctx context.Context, attrs *pb.LdapAuthMethodAttribu
 			badFields[accountAttributesMapField] = fmt.Sprintf("invalid %s (unable to parse)", accountAttributesMapField)
 		}
 	}
+	if attrs.GetDereferenceAliases().GetValue() != "" {
+		d := ldap.DerefAliasType(attrs.GetDereferenceAliases().GetValue())
+		if err := d.IsValid(ctx); err != nil {
+			badFields[derefAliasesField] = fmt.Sprintf("%s is not a valid %s", attrs.GetDereferenceAliases().GetValue(), derefAliasesField)
+		}
+	}
 }
 
 func validateAuthenticateLdapRequest(req *pbs.AuthenticateRequest) error {