https://github.com/thestaticturtle/caddy-client-tls-ldap-validator
Caddy plugin to verify client certificates from an LDAP server
https://github.com/thestaticturtle/caddy-client-tls-ldap-validator
caddy caddy-plugin client-certificate ldap
Last synced: about 1 year ago
JSON representation
Caddy plugin to verify client certificates from an LDAP server
- Host: GitHub
- URL: https://github.com/thestaticturtle/caddy-client-tls-ldap-validator
- Owner: TheStaticTurtle
- License: mit
- Created: 2025-01-17T15:16:00.000Z (about 1 year ago)
- Default Branch: main
- Last Pushed: 2025-01-17T15:18:38.000Z (about 1 year ago)
- Last Synced: 2025-03-14T18:55:28.932Z (about 1 year ago)
- Topics: caddy, caddy-plugin, client-certificate, ldap
- Language: Go
- Homepage:
- Size: 41 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Caddy Client Certificate LDAP Validator Plugin
This caddy plugin enables client certificate validation based on LDAP queries.
# Features
* Custom search filters
* Success caching (eg. certificate was found)
* Failure caching (eg. certificate was not found)
* Caddyfile compatibility
# Getting started
## Installation
You first need to build a new caddy executable with this plugin.
The easiest way is to do this with xcaddy.
Install xcaddy :
```go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest```
After xcaddy installation you can build caddy with this plugin by executing:
```xcaddy build latest --with github.com/thestaticturtle/caddy-client-tls-ldap-validator```
## Configuration examples
These examples will connect to an Active Directory server at `ad.example.lan` as `cn=example_account` and will search the `userCertificate` attribute of user objects in `ou=People` while making sure they aren't disabled. THe result of the search will be cached for 5m (300sec) for a success or failure
```json
"client_authentication": {
"ca": {
"pem_files": ["/etc/caddy/keys/root.crt"], "provider": "file"
},
"verifiers": [
{
"verifier": "ldap_validator",
"server": "ldap://ad.example.lan:389",
"bind_user": "cn=example_account,cn=Users,dc=example,dc=lan",
"bind_password": "example_password",
"search_base": "ou=People,dc=example,dc=lan",
"search_filters": "(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))",
"attributes": {
"user_certificate": "userCertificate"
},
"success_cache": 300,
"failure_cache": 300
}
],
"mode": "require_and_verify"
}
```
```
client_auth {
mode require_and_verify
trust_pool file {
pem_file /etc/caddy/keys/root.crt
}
verifier ldap_validator {
server "ldap://ad.example.lan:389"
bind_user "cn=example_account,cn=Users,dc=example,dc=lan"
bind_password "example_password"
search_base "ou=People,dc=example,dc=lan"
search_filters "(&(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
attributes {
user_certificate "userCertificate"
}
success_cache 300
failure_cache 300
}
}
```
## Todos:
* Verify if the ldap library auto-reconnects in case the connection ot the ldap server is lost