Capabilities

Capabilities are a modern implementation of privileges as seen in OpenLDAP and other servers.

Rather than using a tacked-on syntax that requires schema changes, these are encoded as key-value pairs, defining what actions an account can perform, and to what scope.

Example configuration:

1[[users]] 
2  name = "hackers"
3  uidnumber = 5001
4  primarygroup = 5501
5  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
6    [[users.capabilities]] 
7    action = "search"
8    object = "ou=superheros,dc=glauth,dc=com"
[[users]] # [tl! focus]
  name = "hackers"
  uidnumber = 5001
  primarygroup = 5501
  passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
    [[users.capabilities]] # [tl! focus:2]
    action = "search"
    object = "ou=superheros,dc=glauth,dc=com"

Introduced in 2.1.0, this feature continues improving the intrinsic security model of GLAuth.

While some level of access control is already enforced when using an LDAP backend, Capabilities are now part of the Config and Database backends.

Currently, one capability is recognized: “search” – here is how to configure it in a Config yaml file:

 1...
 2[behaviors]
 3  # Ignore all capabilities restrictions, for instance allowing every user to perform a search
 4  IgnoreCapabilities = false
 5...
 6[[users]]
 7  name = "hackers"
 8    [[users.capabilities]]
 9    action = "search"
10    object = "ou=superheros,dc=glauth,dc=com"
11    [[users.capabilities]]
12    action = "search"
13    object = "ou=someotherdn,dc=glauth,dc=com"
14...
15[[users]]
16  name = "serviceuser"
17    [[users.capabilities]]
18    action = "search"
19    object = "*"
20...
...
[behaviors]
  # Ignore all capabilities restrictions, for instance allowing every user to perform a search
  IgnoreCapabilities = false
...
[[users]]
  name = "hackers"
    [[users.capabilities]]
    action = "search"
    object = "ou=superheros,dc=glauth,dc=com"
    [[users.capabilities]]
    action = "search"
    object = "ou=someotherdn,dc=glauth,dc=com"
...
[[users]]
  name = "serviceuser"
    [[users.capabilities]]
    action = "search"
    object = "*"
...

For backward compatibility, you can set IgnoreCapabilities to “true”

If you are using a Database backend, check the plugins README for configuration information.

• Custom Attributes
• OpenSSH Keys