doncicuto/glim

Proxy LDAP to limit scope of access

Closed this issue · 7 comments

westurner commented

Users can run Glim as a {read-only w/ logging,} proxy interface to {other} LDAP servers that expose far too much or don't have any concept of permissions.

westurner commented

From https://ldapwiki.com/wiki/LDAP%20Query%20Basic%20Examples ; the LDAP equivalent of SELECT * :

$ ldapsearch \
   -D "cn=exampleuser,example.com" \
   -w secret -p 389 -h server.example.com \
   -b "dc=example,dc=com" \
   -s sub "(objectclass=*)" # returns all entries

I just found these:

doncicuto commented

Thanks for opening the issue, it means a lot to me get feedback from the community.

According to your comments:

  1. Would you like Glim to be a proxy for other LDAP servers so you can still use simple CLI commands (create, rm, update...) and REST API but not storing users and groups in your own database?
  2. Would you like Glim to block (objectclass=*) by default? I've found some applications that use it to get all entries for authentication, it could be a bad practice I assume.
  3. I'd glad to review all the links you propose to improve Glim's security. I'll open some issues to track them down.

Thanks a lot

westurner commented
  1. Yeah, it may be better to connect an app to (HA) Glim over LDAP, then have Glim do limited queries as specified by config somehow
  2. That sounds like a more default secure default; like blocking rm -rf /$HOMe without -y
  3. Cool. Prior/existing_someday use case: "LDAP with GitLab CE and Mattermost (or Zulip)" for home/school labs without $ to upgrade to EE, which has actual LDAP (instead of omnibus-gitlab):
    • hopefully there's a just the LDAP adapter patch for CE edition somewhere
      • instead, we could just use the GitLab CE auth tables over LDAP with glim
doncicuto commented

Thanks again, I'll keep this issue opened until I create individual issues for these proposals and security enhancements. Eventually if I need more help to define new use cases I'll ping you back.

westurner commented

Possible README example / rephrasing:

  • how to connect Glim to an LDAP query so that that's all an app is aware of
doncicuto commented

Thank you @westurner, I've created a discussion about implementing Glim as a proxy for LDAP requests, for now Glim acts as an identity manager that stores users and groups in a database. I'll have this suggestion in the backlog and will try to implement it as soon as I've finished some prior issues. Also thank you for the security suggestions added to another pending issue.

Closing

westurner commented

Thanks