用 Go 写一个轻量级的 ldap 测试工具

系统调试ing乙：“LDAP 认证走不通啊，你们的 LDAP 是不是有问题哦”默默掏出测试工具甲：“你看，毫无压力”乙：“我再查查看~”

func Example_userAuthentication() {    // The username and password we want to check    // 用来认证的用户名和密码    username := "someuser"    password := "userpassword"
    // 用来获取查询权限的 bind 用户。如果 ldap 禁止了匿名查询，那我们就需要先用这个帐户 bind 以下才能开始查询    // bind 的账号通常要使用完整的 DN 信息。例如 cn=manager,dc=example,dc=org    // 在 AD 上，则可以用诸如 mananger@example.org 的方式来 bind    bindusername := "readonly"    bindpassword := "password"
    l, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", "ldap.example.com", 389))    if err != nil {        log.Fatal(err)    }    defer l.Close()
    // Reconnect with TLS    // 建立 StartTLS 连接，这是建立纯文本上的 TLS 协议，允许你将非加密的通讯升级为 TLS 加密而不需要另外使用一个新的端口。    // 邮件的 POP3 ，IMAP 也有支持类似的 StartTLS，这些都是有 RFC 的    err = l.StartTLS(&tls.Config{InsecureSkipVerify: true})    if err != nil {        log.Fatal(err)    }
    // First bind with a read only user    // 先用我们的 bind 账号给 bind 上去    err = l.Bind(bindusername, bindpassword)    if err != nil {        log.Fatal(err)    }
    // Search for the given username    // 这样我们就有查询权限了，可以构造查询请求了    searchRequest := ldap.NewSearchRequest(        // 这里是 basedn，我们将从这个节点开始搜索        "dc=example,dc=com",        // 这里几个参数分别是 scope, derefAliases, sizeLimit, timeLimit,  typesOnly        // 详情可以参考 RFC4511 中的定义,文末有链接        ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,         // 这里是 LDAP 查询的 Filter。这个例子例子，我们通过查询 uid=username 且 objectClass=organizationalPerson。        // username 即我们需要认证的用户名        fmt.Sprintf("(&(objectClass=organizationalPerson)(uid=%s))", username),        // 这里是查询返回的属性，以数组形式提供。如果为空则会返回所有的属性        []string{"dn"},        nil,    )    // 好了现在可以搜索了，返回的是一个数组    sr, err := l.Search(searchRequest)    if err != nil {        log.Fatal(err)    }
    // 如果没有数据返回或者超过1条数据返回，这对于用户认证而言都是不允许的。    // 前这意味着没有查到用户，后者意味着存在重复数据    if len(sr.Entries) != 1 {        log.Fatal("User does not exist or too many entries returned")    }
    // 如果没有意外，那么我们就可以获取用户的实际 DN 了    userdn := sr.Entries[0].DN
    // Bind as the user to verify their password    // 拿这个 dn 和他的密码去做 bind 验证    err = l.Bind(userdn, password)    if err != nil {        log.Fatal(err)    }
    // Rebind as the read only user for any further queries    // 如果后续还需要做其他操作，那么使用最初的 bind 账号重新 bind 回来。恢复初始权限。    err = l.Bind(bindusername, bindpassword)    if err != nil {        log.Fatal(err)    }}

package main
import (  "fmt"  "strings"
  "github.com/spf13/cobra")
func main() {  // 给后面的 Flags 用的  var echoTimes int
  // cobra 以层次的方式组织命令。从 rootCmd 开始，每一个命令都通过一个 struct 来配置命令的相关信息  // 这一行本来在 example 的最下面，我给挪上来了  var rootCmd = &cobra.Command{Use: "app"}
  // 不同于 rootCmd，我们开始给出比较详细的配置了  var cmdPrint = &cobra.Command{  // 命令的名称，同时 [string to print] 等会在 help 时作为 usage 的内容输出    Use:   "print [string to print]",  // help 时作为 Available Commands 中，cmd 后的短描述    Short: "Print anything to the screen",  // help 时作为 cmd 的长描述    Long: `print is for printing anything back to the screen.For many years people have printed back to the screen.`,  // 限制命令最小参数输入为1，还有其他的参数限制，详见 github 上的说明    Args: cobra.MinimumNArgs(1),  // 命令执行的函数，把命令要干的事情放在这里就好了    Run: func(cmd *cobra.Command, args []string) {      fmt.Println("Print: " + strings.Join(args, " "))    },  }
  var cmdEcho = &cobra.Command{    Use:   "echo [string to echo]",    Short: "Echo anything to the screen",    Long: `echo is for echoing anything back.Echo works a lot like print, except it has a child command.`,    Args: cobra.MinimumNArgs(1),    Run: func(cmd *cobra.Command, args []string) {      fmt.Println("Print: " + strings.Join(args, " "))    },  }
  var cmdTimes = &cobra.Command{    Use:   "times [# times] [string to echo]",    Short: "Echo anything to the screen more times",    Long: `echo things multiple times back to the user by providinga count and a string.`,    Args: cobra.MinimumNArgs(1),    Run: func(cmd *cobra.Command, args []string) {      for i := 0; i < echoTimes; i++ {        fmt.Println("Echo: " + strings.Join(args, " "))      }    },  }
  // 这里为 cmdTimes 对应命令设置了一个 Flag 参数  // 类型为 Int，输入方式为 `--times` 或者 `-t`，默认值时 1，绑定到最开始声明的 `echoTimes` 上。  cmdTimes.Flags().IntVarP(&echoTimes, "times", "t", 1, "times to echo the input")
  // rootCmd 后面 Add 了 cmdPrint, cmdEcho  // 也就是说初始的两个命令是 `print` 和 `echo`  rootCmd.AddCommand(cmdPrint, cmdEcho)  // cmdEcho 后面 Add 了 cmdTimes  // 所以 `echo` 后面还有一个命令时 `times`  cmdEcho.AddCommand(cmdTimes)  rootCmd.Execute()}

├── cmd│   ├── auth.go│   ├── http.go│   ├── root.go│   ├── search.go│   ├── utils.go│   └── version.go├── main.go

GET /api/v1/ldap/healthldap 健康状态监测。请求的时候就去尝试连接一下 ldap，用 bind 账号 bind 测试下。成功的话就返回 ok，否则给个错。 

GET /api/v1/ldap/search/filter/:filter根据 ldap filter 来做查询

GET /api/v1/ldap/search/user/:username根据用户名来查询

POST /api/v1/ldap/search/multi根据用户名同时查询多个用户，以 application/json 方式发送请求数据，例：["user1","user2","user3"]

POST /api/v1/ldap/auth/single单个用户的认证测试，以 application/json 方式发送请求数据，例：{    "username": "user",    "password": "123456"}

POST /api/v1/ldap/auth/multi单个用户的认证测试，以 application/json 方式发送请求数据，例：[{    "username": "user1",    "password": "123456"}, {    "username": "user2",    "password": "654321"}]

# tree.├── cfg.json.example├── cmd│   ├── auth.go│   ├── http.go│   ├── root.go│   ├── search.go│   ├── utils.go│   └── version.go├── g│   ├── cfg.go│   └── const.go├── http│   ├── controllers│   │   ├── authMulti.go│   │   ├── authSingle.go│   │   ├── default.go│   │   ├── health.go│   │   ├── searchFilter.go│   │   ├── searchMulti.go│   │   └── searchUser.go│   ├── http.go│   └── router.go├── LICENSE├── main.go├── models│   ├── funcs.go│   ├── ldap.go│   └── ldap_test.go└── README.MD

go get ./...go build

{    "ldap": {        "addr": "ldap.example.org:389",        "baseDn": "dc=example,dc=org",        "bindDn": "cn=manager,dc=example,dc=org",        "bindPass": "password",        "authFilter": "(&(uid=%s))",        "attributes": ["uid", "cn", "mail"],        "tls":        false,        "startTLS":   false    },    "http": {        "listen": "0.0.0.0:8888"    }}

{    "ldap": {        "addr": "ad.example.org:389",        "baseDn": "dc=example,dc=org",        "bindDn": "manager@example.org",        "bindPass": "password",        "authFilter": "(&(sAMAccountName=%s))",        "attributes": ["sAMAccountName", "displayName", "mail"],        "tls":        false,        "startTLS":   false    },    "http": {        "listen": "0.0.0.0:8888"    }}

# ./ldap-test-tool helpldap-test-tool is a simple tool for ldap testbuild by shanghai-edu.Complete documentation is available at github.com/shanghai-edu/ldap-test-tool
Usage:  ldap-test-tool [flags]  ldap-test-tool [command]
Available Commands:  auth        Auth Test  help        Help about any command  http        Enable a http server for ldap-test-tool  search      Search Test  version     Print the version number of ldap-test-tool
Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")  -h, --help            help for ldap-test-tool
Use "ldap-test-tool [command] --help" for more information about a command.

./ldap-test-tool auth -hAuth Test
Usage:  ldap-test-tool auth [flags]  ldap-test-tool auth [command]
Available Commands:  multi       Multi Auth Test  single      Single Auth Test
Flags:  -h, --help   help for auth
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")
Use "ldap-test-tool auth [command] --help" for more information about a command.

Single Auth Test
Usage:  ldap-test-tool auth single [username] [password] [flags]
Flags:  -h, --help   help for single
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")

./ldap-test-tool auth single qfeng 123456LDAP Auth Start ==================================
qfeng auth test successed 
==================================LDAP Auth Finished, Time Usage 47.821884ms 

# ./ldap-test-tool auth multi -hMulti Auth Test
Usage:  ldap-test-tool auth multi [filename] [flags]
Flags:  -h, --help   help for multi
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")

# cat authusers.txt qfeng,123456qfengtest,111111

# ./ldap-test-tool auth multi authusers.txt LDAP Multi Auth Start ==================================
Successed count 1 Failed count 1 Failed users: -- User: qfengtest , Msg: Cannot find such user 
==================================LDAP Multi Auth Finished, Time Usage 49.582994ms 

# ./ldap-test-tool search -hSearch Test
Usage:  ldap-test-tool search [flags]  ldap-test-tool search [command]
Available Commands:  filter      Search By Filter  multi       Search Multi Users  user        Search Single User
Flags:  -h, --help   help for search
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")
Use "ldap-test-tool search [command] --help" for more information about a command.[root@wiki-qfeng ldap-test-tool]# 

# ./ldap-test-tool search user -hSearch Single User
Usage:  ldap-test-tool search user [username] [flags]
Flags:  -h, --help   help for user
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")[root@wiki-qfeng ldap-test-tool]# 

# ./ldap-test-tool search user qfengLDAP Search Start ==================================

DN: uid=qfeng,ou=people,dc=example,dc=orgAttributes: -- uid  : qfeng  -- cn   : 冯骐测试  -- mail : qfeng@example.org

==================================LDAP Search Finished, Time Usage 44.711268ms 

# ./ldap-test-tool search filter -hSearch By Filter
Usage:  ldap-test-tool search filter [searchFilter] [flags]
Flags:  -h, --help   help for filter
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")

# ./ldap-test-tool search filter "(cn=*测试)"LDAP Search By Filter Start ==================================

DN: uid=test1,ou=people,dc=example,dc=orgAttributes: -- uid  : test1  -- cn   : 一号测试  -- mail : test1@example.org 

DN: uid=test2,ou=people,dc=example,dc=orgAttributes: -- uid  : test2  -- cn   : 二号测试  -- mail : test2@example.org 

DN: uid=test3,ou=people,dc=example,dc=orgAttributes: -- uid  : test3 -- cn   : 三号测试  -- mail : test3@example.org 
results count  3
==================================LDAP Search By Filter Finished, Time Usage 46.071833ms 

# ./ldap-test-tool search multi -hSearch Multi Users
Usage:  ldap-test-tool search multi [filename] [flags]
Flags:  -f, --file   output search to users.csv, failed search to failed.csv  -h, --help   help for multi
Global Flags:  -c, --config string   load config file. default cfg.json (default "cfg.json")

# cat searchusers.txt qfengqfengtestnofounduser

# ldap-test-tool.exe search multi .\searchusers.txtLDAP Multi Search Start==================================
Successed users:
DN: uid=qfeng,ou=people,dc=example,dc=orgAttributes: -- uid  : qfeng -- cn   : 冯骐 -- mail : qfeng@example.org

DN: uid=qfengtest,ou=people,dc=example,dc=orgAttributes: -- uid  : qfengtest -- cn   : 冯骐测试 -- mail : qfeng@example.org
nofounduser : Cannot find such user
Successed count 2Failed count 1
==================================LDAP Multi Search Finished, Time Usage 134.744ms

# ./ldap-test-tool search multi searchusers.txt -fLDAP Multi Search Start ==================================
OutPut to csv successed
==================================LDAP Multi Search Finished, Time Usage 88.756956ms 
# ls | grep csvfailed.csvusers.csv

# ldap-test-tool.exe http2018/03/12 14:30:25 [I] http server Running on http://0.0.0.0:8888

# curl http://127.0.0.1:8888/api/v1/ldap/health   {  "msg": "ok",  "success": true}

# curl  http://127.0.0.1:8888/api/v1/ldap/search/user/qfeng{  "user": {    "dn": "uid=qfeng,ou=people,dc=example,dc=org",    "attributes": {      "cn": [        "冯骐"      ],      "mail": [        "qfeng@example.org"      ],      "uid": [        "qfeng"      ]    }  },  "success": true}

# curl  http://127.0.0.1:8888/api/v1/ldap/search/filter/\(cn=*测试\){  "results": [    {      "dn": "uid=test1,ou=people,dc=example,dc=org",      "attributes": {        "cn": [          "一号测试"        ],        "mail": [          "test1@example.org"        ],        "uid": [          "test1"        ]      }    },    {      "dn": "uid=test2,ou=people,dc=example,dc=org",      "attributes": {        "cn": [          "二号测试"        ],        "mail": [          "test2@example.org"        ],        "uid": [          "test2"        ]      }    },    {      "dn": "uid=test3,ou=people,dc=example,dc=org",      "attributes": {        "cn": [          "三号测试"        ],        "mail": [          "test3@example.org"        ],        "uid": [          "test3"        ]      }    },  ],  "success": true}

["qfeng","qfengtest","nofounduser"]

# curl -X POST  -H 'Content-Type:application/json' -d '["qfeng","qfengtest","nofounduser"]' http://127.0.0.1:8888/api/v1/ldap/search/multi{  "success": true,  "result": {    "successed": 2,    "failed": 1,    "users": [      {        "dn": "uid=qfeng,ou=people,dc=example,dc=org",        "attributes": {          "cn": [            "冯骐"          ],          "mail": [            "qfeng@example.org"          ],          "uid": [            "qfeng"          ]        }      },      {        "dn": "uid=qfengtest,ou=people,dc=example,dc=org",        "attributes": {          "cn": [            "冯骐测试"          ],          "mail": [            "qfeng@example.org"          ],          "uid": [            "qfengtest"          ]        }      }    ],    "failed_messages": [      {        "username": "nofounduser",        "message": "Cannot find such user"      }    ]  }}

{    "username": "qfeng",    "password": "123456"}

# curl -X POST  -H 'Content-Type:application/json' -d '{"username":"qfeng","password":"123456"}' http://127.0.0.1:8888/api/v1/ldap/auth/single{  "msg": "user 20150073 Auth Successed",  "success": true}

[{    "username": "qfeng",    "password": "123456"}, {    "username": "qfengtest",    "password": "1111111"}]

# curl -X POST  -H 'Content-Type:application/json' -d '[{"username":"qfeng","password":"123456"},{"username":"qfengtest","password":"1111111"}]' http://127.0.0.1:8888/api/v1/ldap/auth/multi{  "success": true,  "result": {    "successed": 1,    "failed": 1,    "failed_messages": [      {        "username": "qfengtest",        "message": "LDAP Result Code 49 \"Invalid Credentials\": "      }    ]  }}