Support multiple LDAP servers in a auth source (#6898)

Signed-off-by: abhishek818 <abhishekguptaatweb17@gmail.com>

cmd/admin_auth_ldap.go

@@ -207,7 +207,7 @@ func parseLdapConfig(c *cli.Context, config *ldap.Source) error {
 		config.Name = c.String("name")
 	}
 	if c.IsSet("host") {
-		config.Host = c.String("host")
+		config.HostList = c.String("hostlist")
 	}
 	if c.IsSet("port") {
 		config.Port = c.Int("port")

cmd/admin_auth_ldap_test.go

@@ -59,7 +59,7 @@ func TestAddLdapBindDn(t *testing.T) {
 				IsSyncEnabled: true,
 				Cfg: &ldap.Source{
 					Name:                  "ldap (via Bind DN) source full",
-					Host:                  "ldap-bind-server full",
+					HostList:              "ldap-bind-server full",
 					Port:                  9876,
 					SecurityProtocol:      ldap.SecurityProtocol(1),
 					SkipVerify:            true,
@@ -99,7 +99,7 @@ func TestAddLdapBindDn(t *testing.T) {
 				IsActive: true,
 				Cfg: &ldap.Source{
 					Name:             "ldap (via Bind DN) source min",
-					Host:             "ldap-bind-server min",
+					HostList:         "ldap-bind-server min",
 					Port:             1234,
 					SecurityProtocol: ldap.SecurityProtocol(0),
 					UserBase:         "ou=Users,dc=min-domain-bind,dc=org",
@@ -280,7 +280,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				IsActive: false,
 				Cfg: &ldap.Source{
 					Name:                  "ldap (simple auth) source full",
-					Host:                  "ldap-simple-server full",
+					HostList:              "ldap-simple-server full",
 					Port:                  987,
 					SecurityProtocol:      ldap.SecurityProtocol(2),
 					SkipVerify:            true,
@@ -317,7 +317,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				IsActive: true,
 				Cfg: &ldap.Source{
 					Name:             "ldap (simple auth) source min",
-					Host:             "ldap-simple-server min",
+					HostList:         "ldap-simple-server min",
 					Port:             123,
 					SecurityProtocol: ldap.SecurityProtocol(0),
 					UserDN:           "cn=%s,ou=Users,dc=min-domain-simple,dc=org",
@@ -526,7 +526,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				IsSyncEnabled: true,
 				Cfg: &ldap.Source{
 					Name:                  "ldap (via Bind DN) source full",
-					Host:                  "ldap-bind-server full",
+					HostList:              "ldap-bind-server full",
 					Port:                  9876,
 					SecurityProtocol:      ldap.SecurityProtocol(1),
 					SkipVerify:            true,
@@ -630,7 +630,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
 			authSource: &auth.Source{
 				Type: auth.LDAP,
 				Cfg: &ldap.Source{
-					Host: "ldap-server",
+					HostList: "ldap-server",
 				},
 			},
 		},
@@ -978,7 +978,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				IsActive: false,
 				Cfg: &ldap.Source{
 					Name:                  "ldap (simple auth) source full",
-					Host:                  "ldap-simple-server full",
+					HostList:              "ldap-simple-server full",
 					Port:                  987,
 					SecurityProtocol:      ldap.SecurityProtocol(2),
 					SkipVerify:            true,
@@ -1078,7 +1078,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 			authSource: &auth.Source{
 				Type: auth.DLDAP,
 				Cfg: &ldap.Source{
-					Host: "ldap-server",
+					HostList: "ldap-server",
 				},
 			},
 		},

routers/web/admin/auths.go

@@ -121,7 +121,7 @@ func parseLDAPConfig(form forms.AuthenticationForm) *ldap.Source {
 	}
 	return &ldap.Source{
 		Name:                  form.Name,
-		Host:                  form.Host,
+		HostList:              form.Host,
 		Port:                  form.Port,
 		SecurityProtocol:      ldap.SecurityProtocol(form.SecurityProtocol),
 		SkipVerify:            form.SkipVerify,

services/auth/source/ldap/source.go

@@ -25,7 +25,7 @@ import (
 // Source Basic LDAP authentication service
 type Source struct {
 	Name                  string // canonical name (ie. corporate.ad)
-	Host                  string // LDAP host
+	HostList              string // list containing LDAP host(s)
 	Port                  int    // port number
 	SecurityProtocol      SecurityProtocol
 	SkipVerify            bool

services/auth/source/ldap/source_search.go

@@ -10,6 +10,7 @@ import (
 	"net"
 	"strconv"
 	"strings"
+	"time"
 
 	"code.gitea.io/gitea/modules/container"
 	"code.gitea.io/gitea/modules/log"
@@ -111,28 +112,47 @@ func (source *Source) findUserDN(l *ldap.Conn, name string) (string, bool) {
 func dial(source *Source) (*ldap.Conn, error) {
 	log.Trace("Dialing LDAP with security protocol (%v) without verifying: %v", source.SecurityProtocol, source.SkipVerify)
 
-	tlsConfig := &tls.Config{
-		ServerName:         source.Host,
-		InsecureSkipVerify: source.SkipVerify,
-	}
+	ldap.DefaultTimeout = time.Second * 15
+	// HostList is a list of hosts separated by commas
+	hostList := strings.Split(source.HostList, ",")
 
-	if source.SecurityProtocol == SecurityProtocolLDAPS {
-		return ldap.DialTLS("tcp", net.JoinHostPort(source.Host, strconv.Itoa(source.Port)), tlsConfig)
-	}
+	for _, host := range hostList {
+		tlsConfig := &tls.Config{
+			ServerName:         host,
+			InsecureSkipVerify: source.SkipVerify,
+		}
 
-	conn, err := ldap.Dial("tcp", net.JoinHostPort(source.Host, strconv.Itoa(source.Port)))
-	if err != nil {
-		return nil, fmt.Errorf("error during Dial: %w", err)
-	}
+		if source.SecurityProtocol == SecurityProtocolLDAPS {
+			conn, err := ldap.DialTLS("tcp", net.JoinHostPort(host, strconv.Itoa(source.Port)), tlsConfig)
 
-	if source.SecurityProtocol == SecurityProtocolStartTLS {
-		if err = conn.StartTLS(tlsConfig); err != nil {
-			conn.Close()
-			return nil, fmt.Errorf("error during StartTLS: %w", err)
+			if err != nil {
+				// Connection failed, try again with the next host.
+				log.Trace("error during Dial for host %s: %w", host, err)
+				continue
+			}
+			conn.SetTimeout(time.Second * 10)
+
+			return conn, err
+		}
+
+		conn, err := ldap.Dial("tcp", net.JoinHostPort(host, strconv.Itoa(source.Port)))
+		if err != nil {
+			log.Trace("error during Dial for host %s: %w", host, err)
+			continue
+		}
+		conn.SetTimeout(time.Second * 10)
+
+		if source.SecurityProtocol == SecurityProtocolStartTLS {
+			if err = conn.StartTLS(tlsConfig); err != nil {
+				conn.Close()
+				log.Trace("error during StartTLS for host %s: %w", host, err)
+				continue
+			}
 		}
 	}
 
-	return conn, nil
+	// All servers were unreachable
+	return nil, fmt.Errorf("dial failed for all provided servers: %s", hostList)
 }
 
 func bindUser(l *ldap.Conn, userDN, passwd string) error {
@@ -257,7 +277,7 @@ func (source *Source) SearchEntry(name, passwd string, directBind bool) *SearchR
 	}
 	l, err := dial(source)
 	if err != nil {
-		log.Error("LDAP Connect error, %s:%v", source.Host, err)
+		log.Error("LDAP Connect error, %s:%v", source.HostList, err)
 		source.Enabled = false
 		return nil
 	}
@@ -421,7 +441,7 @@ func (source *Source) UsePagedSearch() bool {
 func (source *Source) SearchEntries() ([]*SearchResult, error) {
 	l, err := dial(source)
 	if err != nil {
-		log.Error("LDAP Connect error, %s:%v", source.Host, err)
+		log.Error("LDAP Connect error, %s:%v", source.HostList, err)
 		source.Enabled = false
 		return nil, err
 	}