Description

Added optional LDAP directory server functionality, as requested and discussed here and here.

The image now accepts new LDAP_* environment variables to enable and configure the LDAP server.

If enabled, a separate LDAP server starts on another port (3890 by default) to listen to LDAP queries.

The LDAP server is currently read-only and this PR is mostly a PoC, as I'm no expert in LDAP (learned it last night) and additional functionality may be added. It tries to implement most of the common LDAP endpoints and functionality, possibly working as a full replacement for LLDAP. It supports service-account bind, user DN bind, search, compare, RootDSE discoveries, user and group entries, and membership attributes.

It only implements the LDAP endpoints functionality discussed here, allowing other services to use VoidAuth as an LDAP server. It does not implement connecting to an LDAP server and using it as a source for users/groups in VoidAuth.

Documentation was updated too. The frontend is untouched.

Changes

• Add optional LDAP server controlled by LDAP_ENABLED.
• Add LDAP configuration for host, port, base DN, people/groups OUs, service bind DN/password, anonymous search, and LDAPS cert/key files.
• Expose users under ou=people,{LDAP_BASE_DN}.
• Expose groups under ou=groups,{LDAP_BASE_DN}.
• Support LDAP operations:
  • simple bind
  • search
  • compare
  • unbind
  • RootDSE base search
• Support common object classes and attributes:
  • inetOrgPerson
  • posixAccount
  • groupOfNames
  • groupOfUniqueNames
  • posixGroup
  • memberOf
  • member
  • uniqueMember
  • memberUid
• Filter LDAP-visible users using existing VoidAuth user state checks.
• Use VoidAuth password verification for LDAP user binds.
• Add LDAP server documentation and environment variable descriptions.
• Expose default LDAP port 3890 in the Dockerfile.

Related Tickets & Documents

• Issue #237
• Issue #337