# `pamldapd` Simple LDAP server, uses PAM as backend

## Getting Started

### Download and Build

. Clone a repository

  $ git clone https://github.com/eisin/pamldapd
  $ cd pamldapd

. Build

  $ yum install -y gcc golang pam-devel
  $ go get github.com/msteinert/pam
  $ go get github.com/nmcclain/asn1-ber
  $ go get github.com/nmcclain/ldap
  $ go build -a src/pamldapd.go

. Install to PATH directory (optional)

  copy x86-64 binary to bin directory:
  $ sudo install pamldapd-x86-64 /usr/bin/pamldapd

. Prepare configuration file

  $ cp pamldapd.json.example pamldapd.json
  $ vi pamldapd.json

### Start `pamldapd`

While pamldapd uses PAM authentication, root privilege is required.

 $ pamldapd -h
 
 Usage of pamldapd:
   -c string
         Configuration file (default "pamldapd.json")
   -l string
         Log file (STDOUT if blank)

Start using configuration file, puts messages to STDOUT

 # pamldapd -c pamldapd.json
 
Start using configuration file, puts messages to a log file

 # pamldapd -c pamldapd.json -l /var/log/pamldapd.log
 
## Configuration

Example Configuration:

 {
         "listen": "127.0.0.1:10389",
         "pamServicename": "password-auth",
         "peopledn": "ou=people,dc=example,dc=com",
         "groupsdn": "ou=groups,dc=example,dc=com",
         "bindadmindn": "uid=user,dc=example,dc=com",
         "bindadminpassword": "password"
 }

`listen` ::
Listen IP address and port like `0.0.0.0:0000`

You may optionally listen on a UNIX socket by setting the JSON configuration key "network" to "unix" and "listen" to "/path/to/your.sock". You may actually listen on any network that is supported by https://pkg.go.dev/net#Listen -- When you're listening on a UNIX socket, you can use the setgid bit of the directory that will contain your socket file. This way, the socket file will preserve the group ownership of the directory. You can also set the umask to decide who can connect to your socket and who can't. Just make sure that you create the logfile beforehand so that the logfile has different (perhaps more strict) permissions.

`pamservicename` ::
PAM authentication requires service-name like `login`, `su`. You can choose existing service or create a new. Existing service can be seen typing `ls /etc/pam.d/`
For more service, see http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html

`peopledn` ::
Specify base distinguish name of users.

`groupsdn` ::
Specify base distinguish name of groups.

`bindadmindn` ::
Specify distinguish name of administrator account.

`bindadminpassword` ::
Specify password of administrator account.

## LDAP tree structure example

Tree structure of example configuration file `pamldapd.json.example`

 dc=com
     dc=example
         ou=people
             uid=user
                 objectClass=posixAccount
                 cn=user
                 uidNumber=501
                 gidNumber=501
                 homeDirectory=/home/user
                 givenName=User
             uid=user2
                 objectClass=posixAccount
                 :
             :
         ou=groups
             cn=user
                 objectClass=posixGroup
                 cn=user
                 gidNumber=501
                 memberUid=501
             cn=user2
                 objectClass=posixGroup
                 :
             :
         uid=adminuser

## Restriction

While `pamldapd` uses PAM as authentication, some restrictions exist.

* When search operations, filter can be almost two patterns: `(&(uid=user)(objectClass=posixAccount))` or `(&(memberUid=user)(objectClass=posixgroup))`
** Must be included `objectclass` , like `(objectclass=posixAccount)` or `(objectclass=posixGroup)` . Other than that, for example `(objectclass=*)`, it will fail.
** Must be identified one record by specifying username attribute. Enumeration is not supported.

* When search operation, an entry does not have `unixpassword` attribute.
