|
|
@@ -30,6 +30,7 @@ var (
|
|
30
|
30
|
ErrLdapBindFailed = errors.New("LdapBindFailed")
|
|
31
|
31
|
ErrLdapToLocalUserFailed = errors.New("LdapToLocalUserFailed")
|
|
32
|
32
|
ErrLdapCreateUserFailed = errors.New("LdapCreateUserFailed")
|
|
|
33
|
+ ErrLdapPasswordNotMatch = errors.New("PasswordNotMatch")
|
|
33
|
34
|
)
|
|
34
|
35
|
|
|
35
|
36
|
// LdapService is responsible for LDAP authentication and user synchronization.
|
|
|
@@ -119,7 +120,7 @@ func (ls *LdapService) connectAndBindAdmin(cfg *config.Ldap) (*ldap.Conn, error)
|
|
119
|
120
|
func (ls *LdapService) verifyCredentials(cfg *config.Ldap, username, password string) error {
|
|
120
|
121
|
ldapConn, err := ls.connectAndBind(cfg, username, password)
|
|
121
|
122
|
if err != nil {
|
|
122
|
|
- return err
|
|
|
123
|
+ return ErrLdapPasswordNotMatch
|
|
123
|
124
|
}
|
|
124
|
125
|
defer ldapConn.Close()
|
|
125
|
126
|
return nil
|
|
|
@@ -136,6 +137,10 @@ func (ls *LdapService) Authenticate(username, password string) (*model.User, err
|
|
136
|
137
|
return nil, ErrLdapUserDisabled
|
|
137
|
138
|
}
|
|
138
|
139
|
cfg := &Config.Ldap
|
|
|
140
|
+ err = ls.verifyCredentials(cfg, ldapUser.Dn, password)
|
|
|
141
|
+ if err != nil {
|
|
|
142
|
+ return nil, err
|
|
|
143
|
+ }
|
|
139
|
144
|
user, err := ls.mapToLocalUser(cfg, ldapUser)
|
|
140
|
145
|
if err != nil {
|
|
141
|
146
|
return nil, errors.Join(ErrLdapToLocalUserFailed, err)
|