LDAP plugin

connector-ldap/README.md

@@ -0,0 +1,22 @@
+# LDAP connector
+> LDAP connector is a plug-in designed to support login via LDAP or Active Directory, including LDAPS and StartTLS.
+
+## How to use
+
+### Build
+```bash
+./answer build --with github.com/apache/answer-plugins/connector-ldap
+```
+
+### Configuration
+- `Name` - Display name for the connector shown on the login page
+- `Server` - LDAP server URL, e.g. `ldaps://ldap.example.com:636` or `ldap://ldap.example.com:389`
+- `Base DN` - Base DN to search for users, e.g. `dc=example,dc=com`
+- `Bind DN` - DN of the service account used to bind and search the directory
+- `Bind Password` - Password for the bind DN
+- `User Attribute` - LDAP attribute holding the username, e.g. `uid` for OpenLDAP or `sAMAccountName` for Active Directory
+- `TLS CA Certificate Path` - Optional path to a custom CA certificate, used to verify the LDAP server's certificate (e.g. for a private/internal CA)
+
+If the server URL starts with `ldaps://`, the connection is established over TLS directly. Otherwise, a plain connection is opened and upgraded via StartTLS.
+
+Users must have a `mail` attribute set in LDAP, since it is required to create/match the Answer account on login.

connector-ldap/go.mod

@@ -0,0 +1,62 @@
+module github.com/apache/answer-plugins/connector-ldap
+
+go 1.22.0
+
+toolchain go1.24.2
+
+require (
+	github.com/apache/answer v1.4.2-RC1.0.20250107023923-061894735091
+	github.com/apache/answer-plugins/util v1.0.3-0.20250107030257-cf94ebc70954
+	github.com/gin-gonic/gin v1.10.0
+	github.com/go-ldap/ldap/v3 v3.4.10
+	github.com/jimlambrt/gldap v0.1.14
+	github.com/segmentfault/pacman v1.0.5-0.20230822083413-c0075a2d401f
+)
+
+require (
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/LinkinStars/go-i18n/v2 v2.2.2 // indirect
+	github.com/aymerick/douceur v0.2.0 // indirect
+	github.com/bytedance/sonic v1.12.2 // indirect
+	github.com/bytedance/sonic/loader v0.2.0 // indirect
+	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
+	github.com/cloudwego/base64x v0.1.4 // indirect
+	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fatih/color v1.17.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.5 // indirect
+	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.22.1 // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/google/wire v0.5.0 // indirect
+	github.com/gorilla/css v1.0.1 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/segmentfault/pacman/contrib/i18n v0.0.0-20230822083413-c0075a2d401f // indirect
+	github.com/stretchr/testify v1.9.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
+	golang.org/x/arch v0.10.0 // indirect
+	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
+	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)

connector-ldap/i18n/de_DE.yaml

@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+plugin:
+  ldap_connector:
+    backend:
+      login:
+        title:
+          other: Anmeldung
+        subtitle:
+          other: Mit LDAP-Konto anmelden
+        username:
+          other: Benutzername
+        password:
+          other: Passwort
+        submit:
+          other: Anmelden

connector-ldap/i18n/en_US.yaml

@@ -0,0 +1,79 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+plugin:
+  ldap_connector:
+    backend:
+      name:
+        other: LDAP
+      info:
+        name:
+          other: LDAP Connector
+        description:
+          other: Connect to LDAP for third-party login
+      config:
+        name:
+          title:
+            other: LDAP
+          description:
+            other: LDAP connector name
+        server:
+          title:
+            other: LDAP Server
+          description:
+            other: e.g. ldaps://ldap.example.com:636
+        base_dn:
+          title:
+            other: Base DN
+          description:
+            other: e.g. dc=example,dc=com
+        bind_dn:
+          title:
+            other: Bind DN
+          description:
+            other: DN of LDAP bind user
+        bind_password:
+          title:
+            other: Bind Password
+          description:
+            other: Password for bind DN
+        user_attr:
+          title:
+            other: User Attribute
+          description:
+            other: LDAP attribute for username (e.g., uid or sAMAccountName)
+        external_id_attr:
+          title:
+            other: External ID Attribute
+          description:
+            other: Stable LDAP attribute used to identify the user across logins, e.g. entryUUID (OpenLDAP) or objectGUID (Active Directory). Do not use a mutable attribute like uid.
+        tls_ca_cert_path:
+          title:
+            other: TLS CA Certificate Path
+          description:
+            other: Path to custom CA certificate file (optional)
+      login:
+        title:
+          other: Login
+        subtitle:
+          other: Sign in with your LDAP account
+        username:
+          other: Username
+        password:
+          other: Password
+        submit:
+          other: Login

connector-ldap/i18n/translation.go

@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package i18n
+
+const (
+	ConnectorName   = "plugin.ldap_connector.backend.name"
+	InfoName        = "plugin.ldap_connector.backend.info.name"
+	InfoDescription = "plugin.ldap_connector.backend.info.description"
+
+	ConfigNameTitle                 = "plugin.ldap_connector.backend.config.name.title"
+	ConfigNameDescription           = "plugin.ldap_connector.backend.config.name.description"
+	ConfigServerTitle               = "plugin.ldap_connector.backend.config.server.title"
+	ConfigServerDescription         = "plugin.ldap_connector.backend.config.server.description"
+	ConfigBaseDNTitle               = "plugin.ldap_connector.backend.config.base_dn.title"
+	ConfigBaseDNDescription         = "plugin.ldap_connector.backend.config.base_dn.description"
+	ConfigBindDNTitle               = "plugin.ldap_connector.backend.config.bind_dn.title"
+	ConfigBindDNDescription         = "plugin.ldap_connector.backend.config.bind_dn.description"
+	ConfigBindPasswordTitle         = "plugin.ldap_connector.backend.config.bind_password.title"
+	ConfigBindPasswordDescription   = "plugin.ldap_connector.backend.config.bind_password.description"
+	ConfigUserAttrTitle             = "plugin.ldap_connector.backend.config.user_attr.title"
+	ConfigUserAttrDescription       = "plugin.ldap_connector.backend.config.user_attr.description"
+	ConfigExternalIDAttrTitle       = "plugin.ldap_connector.backend.config.external_id_attr.title"
+	ConfigExternalIDAttrDescription = "plugin.ldap_connector.backend.config.external_id_attr.description"
+	ConfigTLSCACertPathTitle        = "plugin.ldap_connector.backend.config.tls_ca_cert_path.title"
+	ConfigTLSCACertPathDescription  = "plugin.ldap_connector.backend.config.tls_ca_cert_path.description"
+
+	LoginTitle    = "plugin.ldap_connector.backend.login.title"
+	LoginSubtitle = "plugin.ldap_connector.backend.login.subtitle"
+	LoginUsername = "plugin.ldap_connector.backend.login.username"
+	LoginPassword = "plugin.ldap_connector.backend.login.password"
+	LoginSubmit   = "plugin.ldap_connector.backend.login.submit"
+)

connector-ldap/info.yaml

@@ -0,0 +1,22 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+slug_name: ldap_connector
+type: connector
+version: 0.1.0
+author: DanielAuerX
+link: https://github.com/apache/answer-plugins/tree/main/connector-ldap