mirror of
https://github.com/lldap/lldap.git
synced 2026-04-25 08:15:52 +03:00
[GH-ISSUE #701] Support LDAP over IPC (unix domain sockets) #249
Labels
No labels
backend
blocked
bug
cleanup
dependencies
docker
documentation
duplicate
enhancement
enhancement
frontend
github_actions
good first issue
help wanted
help wanted
integration
invalid
ldap
pull-request
question
rust
rust
tests
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/lldap-lldap#249
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Zepmann on GitHub (Oct 6, 2023).
Original GitHub issue: https://github.com/lldap/lldap/issues/701
For servers which host everything locally, it is unnecessary to use the TCP/IP stack for local client-server connections. Many services which support LDAP for authentication support unix domain sockets. Examples include but are not limited to Authelia, Docker Mailserver and Nextcloud.
To check if your favorite LDAP authenticating software supports LDAP over IPC, see if the ldapi:// URI scheme is supported.
@Zepmann commented on GitHub (Oct 6, 2023):
More information can be found here, including motivation and implementation considerations.
This would seem to fit perfectly with the goal of lldap as a light LDAP implementation for authentication.
@Zepmann commented on GitHub (Oct 6, 2023):
This feature request also extends to HTTP. Reverse proxies such as HAProxy support connecting to unix domain sockets.
@nitnelave commented on GitHub (Oct 6, 2023):
That feature sounds potentially useful. The bulk of the change would have to be in
server/src/infra/ldap_server.rsandserver/src/infra/tcp_server.rs, where we can usebind_udsinstead ofbind.How do you propose to handle the configuration? We'd have to support a socket for LDAP, LDAPS and HTTP. Currently, we have the
ldap_host/ldap_port/ldaps_portand thehttp_host/http_portto configure the LDAP/HTTP servers respectively. There is no standard scheme for UDS as URL (see https://github.com/whatwg/url/issues/577) but we could say that if the host starts with a/it's a UDS.However, we'll need something more for LDAPS if going this way.
@Zepmann commented on GitHub (Oct 6, 2023):
My two cents for LDAP with backwards compatibility in mind:
Add the option
ldaps_host(simplyhostunder[ldaps_options], but I'll refer toldaps_hostandldaps_portfor clarity). This will allow separate binding of LDAPS to different addresses. Ifldaps_hostdoes not exist or is empty and a single address without port number (see next point) is specified inldap_host, use the single address fromldap_hostinstead. This will ensure backwards compatibility.Allow a port number to be specified in a binding (e.g.:
0.0.0.0:389,[::]:389). If a port number is not given for a binding andldap_port/ldaps_portis not set, use default port389or3890(your preference) for LDAP or636or6360(dito) for LDAPS.If an address of
ldap_hostorldaps_hoststarts withunix@, consider everything after that a local unix socket to bind to. I borrowed this idea from HAProxy. E.g.:ldap_host = unix@/run/lldap.sock.Add the options
ldap_unix_modeandldaps_unix_mode. Possible values are file permission modes (e.g.:600) assigned to unix sockets when created. Default value can be666for everyone on the system being able to read from and write to the socket, similar to the default of nginx. Lesser values can be used to locally lock access down further from everyone, to the group, and to the owner (the user running lldap).Optional: Allow multiple addresses in
ldap_hostandldaps_host. Each address is separated by a comma and whitespace is ignored for interpretation (e.g.:ldap_host = unix@/run/lldap.sock, 192.168.1.16:389, 192.168.2.16:3890, [::1]:389). While not part of this feature request, I do miss the ability to bind to multiple local addresses. Example use case: exposing LLDAP running outside of Docker to Docker containers who cannot refer to localhost as the machine itself.For HTTP:
127.0.0.1:17170,[::/1]:17170). If a port number is not given for a binding andhttp_portis not set, use default port17170.http_hoststarts withunix@, consider everything after that a local unix socket to bind to.http_unix_mode. Same as the proposal for LDAP(S). For a management interface, I would imagine one might want to reduce access independently from LDAP(S).@TheRealGramdalf commented on GitHub (Oct 6, 2023):
See https://github.com/lldap/lldap/issues/700#issuecomment-1751126795 for my thoughts on this, I believe it to be relevant
@Zepmann commented on GitHub (Nov 8, 2023):
Another addition to my previous comments:
Unix socket support for creating database connections would also be welcome. This is also supported by other services (Authelia, Nextcloud, ...).
@nitnelave commented on GitHub (Nov 8, 2023):
Connecting to the DB over UDS should be already possible: See https://github.com/launchbadge/sqlx/issues/449 and https://github.com/launchbadge/sqlx/issues/144 for the syntax.
@Zepmann commented on GitHub (Nov 8, 2023):
Thanks for notifying me of that, @nitnelave. I'll test it soon.
@Zepmann commented on GitHub (Nov 8, 2023):
I tested MariaDB over IPC support. Running the following works on an empty database:
Configured with:
lldap outputs:
Tested with Arch Linux and MariaDB.
This makes me assume that MySQL/MariaDB over IPC is not fully supported by lldap.
@nitnelave commented on GitHub (Nov 8, 2023):
@Zepmann That's very strange. Can you open a new issue and post some more details, including the verbose LLDAP logs?
@Zepmann commented on GitHub (Nov 9, 2023):
@nitnelave
It's not a bug in LLDAP, but a result of a too strict systemd service file provided in AUR:
Override the value to add AF_UNIX, and everything works as expected.
Sorry about that. This feature request still remains open for unix socket support for LDAP and HTTP protocols. If support for that is added, the noted problem (and solution) would also apply for these protocols over unix sockets.
If support is added, I'll contact the package maintainer to also add AF_UNIX to the default service file. Having support for unix sockets for the database backend, LDAP and HTTP is a better motivation compared to only support for the database backend.
@nitnelave commented on GitHub (Nov 9, 2023):
I didn't know we had an AUR package. Maybe you can ask for that patch to be included, so the next person doesn't trip over the same problem?
@Zepmann commented on GitHub (Nov 9, 2023):
There are two! There is
lldapandlldap-git, by two different maintainers.I'll contact them on AUR and ask them to add AF_UNIX to the list of supported address families, since it can already be used with lldap (with a real world use case).
By the way, how should lldap be stylized? Is it lldap, LLDAP, ...? I see it written in different ways in different locations.
@nitnelave commented on GitHub (Nov 9, 2023):
In terms of style, I usually use LLDAP in prose, and lldap in code.
@cyprienflx commented on GitHub (Jan 19, 2024):
if you want use socket with postgresql :
replace :
@thielj commented on GitHub (Sep 4, 2025):
unix:///path/to/lldap.sock
tcp://0.0.0.0:17170
tcp://[::/1]:17170
is used for bindings by docker and others.