github: always generate artifacts for a release

release: 0.4.3
readme: fix the codecov badge
2023-04-11 15:01:41 +02:00 · 2023-04-11 14:41:57 +02:00 · 2023-04-11 14:12:17 +02:00 · 2023-04-11 13:51:02 +02:00 · 2023-04-11 10:57:25 +02:00 · 2023-04-11 11:03:56 +07:00
24 changed files with 374 additions and 505 deletions
--- a/.github/workflows/docker-build-static.yml
+++ b/.github/workflows/docker-build-static.yml
@@ -84,7 +84,7 @@ jobs:
  build-ui:
    runs-on: ubuntu-latest
    needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.event_name == 'release' }}
    container:
      image: nitnelave/rust-dev:latest
    steps:
@@ -123,7 +123,7 @@ jobs:
  build-bin:
    runs-on: ubuntu-latest
    needs: pre_job
-    if: ${{ needs.pre_job.outputs.should_skip != 'true' }}
+    if: ${{ needs.pre_job.outputs.should_skip != 'true' || github.event_name == 'release' }}
    strategy:
      matrix:
        target: [armv7-unknown-linux-gnueabihf, aarch64-unknown-linux-musl, x86_64-unknown-linux-musl]
@@ -180,11 +180,13 @@ jobs:
          ports:
            - 3306:3306
          env:
-            MYSQL_USER: lldapuser
-            MYSQL_PASSWORD: lldappass
-            MYSQL_DATABASE: lldap
-            MYSQL_ROOT_PASSWORD: rootpass
-          options: --name mariadb
+            MARIADB_USER: lldapuser
+            MARIADB_PASSWORD: lldappass
+            MARIADB_DATABASE: lldap
+            MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: 1
+          options: >-
+            --name mariadb
+            --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3

        postgresql:
           image: postgres:latest
@@ -194,7 +196,12 @@ jobs:
             POSTGRES_USER: lldapuser
             POSTGRES_PASSWORD: lldappass
             POSTGRES_DB: lldap
-           options: --name postgresql
+           options: >-
+             --health-cmd pg_isready
+             --health-interval 10s
+             --health-timeout 5s
+             --health-retries 5
+             --name postgresql

    steps:
       - name: Download artifacts
@@ -256,17 +263,27 @@ jobs:
             POSTGRES_USER: lldapuser
             POSTGRES_PASSWORD: lldappass
             POSTGRES_DB: lldap
-           options: --name postgresql
+           options: >-
+             --health-cmd pg_isready
+             --health-interval 10s
+             --health-timeout 5s
+             --health-retries 5
+             --name postgresql
+
        mariadb:
          image: mariadb:latest
          ports:
            - 3306:3306
          env:
-            MYSQL_USER: lldapuser
-            MYSQL_PASSWORD: lldappass
-            MYSQL_DATABASE: lldap
-            MYSQL_ROOT_PASSWORD: rootpass
-          options: --name mariadb
+            MARIADB_USER: lldapuser
+            MARIADB_PASSWORD: lldappass
+            MARIADB_DATABASE: lldap
+            MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: 1
+          options: >-
+            --name mariadb
+            --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3
+
+
        mysql:
          image: mysql:latest
          ports:
@@ -275,8 +292,10 @@ jobs:
            MYSQL_USER: lldapuser
            MYSQL_PASSWORD: lldappass
            MYSQL_DATABASE: lldap
-            MYSQL_ROOT_PASSWORD: rootpass
-          options: --name mysql
+            MYSQL_ALLOW_EMPTY_PASSWORD: 1
+          options: >-
+            --name mysql
+            --health-cmd="mysqladmin ping" --health-interval=5s --health-timeout=2s --health-retries=3


    steps:
@@ -314,7 +333,7 @@ jobs:

       - name: Create dummy user
         run: |
-              TOKEN=$(curl -X POST -H "Content-Type: application/json" -d '{"username": "admin", "password": "ldappass"}' http://localhost:17170/auth/simple/login | cut -c 11-277)
+              TOKEN=$(curl -X POST -H "Content-Type: application/json" -d '{"username": "admin", "password": "ldappass"}' http://localhost:17170/auth/simple/login | jq -r .token)
              echo "$TOKEN"
              curl 'http://localhost:17170/api/graphql' -H 'Content-Type: application/json' -H "Authorization: Bearer ${TOKEN//[$'\t\r\n ']}" --data-binary '{"query":"mutation{\n  createUser(user:\n    {\n      id: \"dummyuser\",\n      email: \"dummyuser@example.com\"\n    }\n  )\n  {\n    id\n    email\n  }\n}\n\n\n"}' --compressed
              bin/lldap_set_password --base-url http://localhost:17170 --admin-username admin --admin-password ldappass --token $TOKEN --username dummyuser --password dummypassword
@@ -328,7 +347,7 @@ jobs:

       - name: Export and Converting to Postgress
         run: |
-              curl -L https://raw.githubusercontent.com/nitnelave/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
+              curl -L https://raw.githubusercontent.com/lldap/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
              chmod +x ./helper.sh
              ./helper.sh | sqlite3 ./users.db > ./dump.sql
              sed -i -r -e "s/X'([[:xdigit:]]+'[^'])/'\\\x\\1/g" -e '1s/^/BEGIN;\n/' -e '$aCOMMIT;' ./dump.sql
@@ -346,7 +365,7 @@ jobs:

       - name: Export and Converting to mariadb
         run: |
-              curl -L https://raw.githubusercontent.com/nitnelave/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
+              curl -L https://raw.githubusercontent.com/lldap/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
              chmod +x ./helper.sh
              ./helper.sh | sqlite3 ./users.db > ./dump.sql
              cp ./dump.sql ./dump-no-sed.sql
@@ -365,7 +384,7 @@ jobs:

       - name: Export and Converting to mysql
         run: |
-              curl -L https://raw.githubusercontent.com/nitnelave/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
+              curl -L https://raw.githubusercontent.com/lldap/lldap/main/scripts/sqlite_dump_commands.sh -o helper.sh
              chmod +x ./helper.sh
              ./helper.sh | sqlite3 ./users.db > ./dump.sql
              sed -i -r -e 's/^INSERT INTO "?([a-zA-Z0-9_]+)"?/INSERT INTO `\1`/' -e '1s/^/START TRANSACTION;\n/' -e '$aCOMMIT;' ./dump.sql
@@ -425,6 +444,34 @@ jobs:
    needs: [build-ui, build-bin]
    name: Build Docker image
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        container: ["debian","alpine"]
+        include:
+          - container: alpine
+            platforms: linux/amd64,linux/arm64
+            tags: |
+                  type=ref,event=pr
+                  type=semver,pattern=v{{version}}
+                  type=semver,pattern=v{{major}}
+                  type=semver,pattern=v{{major}}.{{minor}}
+                  type=semver,pattern=v{{version}},suffix=
+                  type=semver,pattern=v{{major}},suffix=
+                  type=semver,pattern=v{{major}}.{{minor}},suffix=
+                  type=raw,value=latest,enable={{ is_default_branch }}
+                  type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+                  type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }},suffix=
+                  type=raw,value=latest,enable={{ is_default_branch }},suffix=
+          - container: debian
+            platforms: linux/amd64,linux/arm64,linux/arm/v7
+            tags: |
+                  type=ref,event=pr
+                  type=semver,pattern=v{{version}}
+                  type=semver,pattern=v{{major}}
+                  type=semver,pattern=v{{major}}.{{minor}}
+                  type=raw,value=latest,enable={{ is_default_branch }}
+                  type=raw,value=stable,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+
    permissions:
      contents: read
      packages: write
@@ -446,86 +493,66 @@ jobs:
        uses: docker/setup-qemu-action@v2
      - uses: docker/setup-buildx-action@v2

-      - name: Docker meta
+      - name: Docker ${{ matrix.container }} meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          # list of Docker images to use as base name for tags
          images: |
            nitnelave/lldap
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=sha
+            lldap/lldap
+            ghcr.io/lldap/lldap
+          # Wanted Docker tags
+          # vX-alpine
+          # vX.Y-alpine
+          # vX.Y.Z-alpine
+          # latest
+          # latest-alpine
+          # stable
+          # stable-alpine
+          #################
+          # vX-debian
+          # vX.Y-debian
+          # vX.Y.Z-debian
+          # latest-debian
+          # stable-debian
+          #################
+          # Check matrix for tag list definition
+          flavor: |
+            latest=false
+            suffix=-${{ matrix.container }}
+          tags: ${{ matrix.tags }}

-      - name: parse tag
-        uses: gacts/github-slug@v1
-        id: slug
-
-      - name: Login to Docker Hub
+      # Docker login to nitnelave/lldap and lldap/lldap
+      - name: Login to Nitnelave/LLDAP Docker Hub
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: nitnelave
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+
 ########################################
-#### docker image :latest tag build ####
+####       docker image build       ####
 ########################################
-      - name: Build and push latest alpine
-        if: github.event_name != 'release'
+      - name: Build ${{ matrix.container }} Docker Image
        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
-          platforms: linux/amd64,linux/arm64
-          file: ./.github/workflows/Dockerfile.ci.alpine
-          tags: nitnelave/lldap:latest, nitnelave/lldap:latest-alpine
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
-
-      - name: Build and push latest debian
-        if: github.event_name != 'release'
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          file: ./.github/workflows/Dockerfile.ci.debian
-          tags: nitnelave/lldap:latest-debian
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
-
-########################################
-#### docker image :semver tag build ####
-########################################
-      - name: Build and push release alpine
-        if: github.event_name == 'release'
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          # Tag as latest, stable, semver, major, major.minor and major.minor.patch.
-          file: ./.github/workflows/Dockerfile.ci.alpine
-          tags: nitnelave/lldap:stable, nitnelave/lldap:stable-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-semantic }}, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}.${{ steps.slug.outputs.version-patch }}, nitnelave/lldap:v${{ steps.slug.outputs.version-semantic }}-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}-alpine.${{ steps.slug.outputs.version-minor }}-alpine, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}.${{ steps.slug.outputs.version-patch }}-alpine
-          cache-from: type=gha,mode=max
-          cache-to: type=gha,mode=max
-
-      - name: Build and push release debian
-        if: github.event_name == 'release'
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
-          push: true
-          # Tag as latest, stable, semver, major, major.minor and major.minor.patch.
-          file: ./.github/workflows/Dockerfile.ci.debian
-          tags: nitnelave/lldap:stable-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-semantic }}-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}-debian, nitnelave/lldap:v${{ steps.slug.outputs.version-major }}.${{ steps.slug.outputs.version-minor }}.${{ steps.slug.outputs.version-patch }}-debian
+          platforms: ${{ matrix.platforms  }}
+          file: ./.github/workflows/Dockerfile.ci.${{ matrix.container  }}
+          tags: |
+                ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha,mode=max
          cache-to: type=gha,mode=max

@@ -537,6 +564,14 @@ jobs:
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          repository: nitnelave/lldap

+      - name: Update lldap repo description
+        if: github.event_name != 'pull_request'
+        uses: peter-evans/dockerhub-description@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+          repository: lldap/lldap
+
 ###############################################################
 ### Download artifacts, clean up ui, upload to release page ###
 ###############################################################
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -101,6 +101,13 @@ jobs:
        run: cargo llvm-cov --no-run --lcov --output-path lcov.info
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
+        if: github.ref != 'refs/heads/main' || github.event_name != 'push'
+        with:
+          files: lcov.info
+          fail_ci_if_error: true
+      - name: Upload coverage to Codecov (main)
+        uses: codecov/codecov-action@v3
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        with:
          files: lcov.info
          fail_ci_if_error: true
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,35 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [0.4.3] 2023-04-11
+
+The repository has changed from `nitnelave/lldap` to `lldap/lldap`, both on GitHub
+and on DockerHub (although we will keep publishing the images to 
+`nitnelave/lldap` for the foreseeable future). All data on GitHub has been
+migrated, and the new docker images are available both on DockerHub and on the
+GHCR under `lldap/lldap`.
+
+### Added
+
+ - EC private keys are not supported for LDAPS.
+
+### Changed
+
+ - SMTP user no longer has a default value (and instead defaults to unauthenticated).
+
+### Fixed
+
+ - WASM payload is now delivered uncompressed to Safari due to a Safari bug.
+ - Password reset no longer redirects to login page.
+ - NextCloud config should add the "mail" attribute.
+ - GraphQL parameters are now urldecoded, to support special characters in usernames.
+ - Healthcheck correctly checks the server certificate.
+
+### New services
+
+ - Home Assistant
+ - Shaarli
+
 ## [0.4.2] - 2023-03-27

 ### Added
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2404,6 +2404,7 @@ dependencies = [
 "tracing-forest",
 "tracing-log",
 "tracing-subscriber",
+ "urlencoding",
 "uuid 1.3.0",
 "webpki-roots",
 ]
@@ -2418,7 +2419,6 @@ dependencies = [
 "gloo-console",
 "gloo-file",
 "gloo-net",
- "gloo-timers",
 "graphql_client 0.10.0",
 "http",
 "image",
@@ -2428,7 +2428,6 @@ dependencies = [
 "rand 0.8.5",
 "serde",
 "serde_json",
- "sha1",
 "url-escape",
 "validator",
 "validator_derive",
@@ -4395,6 +4394,12 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "urlencoding"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8db7427f936968176eaa7cdf81b7f98b980b18495ec28f1b5791ac3bfe3eea9"
+
 [[package]]
 name = "uuid"
 version = "0.8.2"
--- a/README.md
+++ b/README.md
@@ -23,8 +23,8 @@
      src="https://img.shields.io/badge/unsafe-forbidden-success.svg"
      alt="Unsafe forbidden"/>
  </a>
-  <a href="https://app.codecov.io/gh/nitnelave/lldap">
-    <img alt="Codecov" src="https://img.shields.io/codecov/c/github/nitnelave/lldap" />
+  <a href="https://app.codecov.io/gh/lldap/lldap">
+    <img alt="Codecov" src="https://img.shields.io/codecov/c/github/lldap/lldap" />
  </a>
 </p>

--- a/app/Cargo.toml
+++ b/app/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "lldap_app"
-version = "0.4.3-alpha"
+version = "0.4.3"
 authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
 edition = "2021"
 include = ["src/**/*", "queries/**/*", "Cargo.toml", "../schema.graphql"]
@@ -19,7 +19,6 @@ serde = "1"
 serde_json = "1"
 url-escape = "0.1.1"
 validator = "=0.14"
-sha1 = "*"
 validator_derive = "*"
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "*"
@@ -28,7 +27,6 @@ yew-router = "0.16"

 # Needed because of https://github.com/tkaitchuck/aHash/issues/95
 indexmap = "=1.6.2"
-gloo-timers = "0.2.6"

 [dependencies.web-sys]
 version = "0.3"
--- a/app/src/components/change_password.rs
+++ b/app/src/components/change_password.rs
@@ -1,5 +1,4 @@
 use crate::{
-    components::password_field::PasswordField,
    components::router::{AppRoute, Link},
    infra::{
        api::HostService,
@@ -255,12 +254,14 @@ impl Component for ChangePasswordForm {
                   {":"}
                </label>
                <div class="col-sm-10">
-                  <PasswordField<FormModel>
+                  <Field
                    form={&self.form}
                    field_name="password"
+                    input_type="password"
                    class="form-control"
                    class_invalid="is-invalid has-error"
                    class_valid="has-success"
+                    autocomplete="new-password"
                    oninput={link.callback(|_| Msg::FormUpdate)} />
                  <div class="invalid-feedback">
                    {&self.form.field_message("password")}
--- a/app/src/components/login.rs
+++ b/app/src/components/login.rs
@@ -149,9 +149,9 @@ impl Component for LoginForm {
        let link = &ctx.link();
        if self.refreshing {
            html! {
-                <div class="spinner-border" role="status">
-                  <span class="sr-only">{"Loading..."}</span>
-                </div>
+              <div>
+                <img src={"spinner.gif"} alt={"Loading"} />
+              </div>
            }
        } else {
            html! {
--- a/app/src/components/mod.rs
+++ b/app/src/components/mod.rs
@@ -10,7 +10,6 @@ pub mod group_details;
 pub mod group_table;
 pub mod login;
 pub mod logout;
-pub mod password_field;
 pub mod remove_user_from_group;
 pub mod reset_password_step1;
 pub mod reset_password_step2;
--- a/app/src/components/password_field.rs
+++ b/app/src/components/password_field.rs
@@ -1,152 +0,0 @@
-use crate::infra::{
-    api::{hash_password, HostService, PasswordHash, PasswordWasLeaked},
-    common_component::{CommonComponent, CommonComponentParts},
-};
-use anyhow::Result;
-use gloo_timers::callback::Timeout;
-use web_sys::{HtmlInputElement, InputEvent};
-use yew::{html, Callback, Classes, Component, Context, Properties};
-use yew_form::{Field, Form, Model};
-
-pub enum PasswordFieldMsg {
-    OnInput(String),
-    OnInputIdle,
-    PasswordCheckResult(Result<(Option<PasswordWasLeaked>, PasswordHash)>),
-}
-
-#[derive(PartialEq)]
-pub enum PasswordState {
-    // Whether the password was found in a leak.
-    Checked(PasswordWasLeaked),
-    // Server doesn't support checking passwords (TODO: move to config).
-    NotSupported,
-    // Requested a check, no response yet from the server.
-    Loading,
-    // User is still actively typing.
-    Typing,
-}
-
-pub struct PasswordField<FormModel: Model> {
-    common: CommonComponentParts<Self>,
-    timeout_task: Option<Timeout>,
-    password: String,
-    password_check_state: PasswordState,
-    _marker: std::marker::PhantomData<FormModel>,
-}
-
-impl<FormModel: Model> CommonComponent<PasswordField<FormModel>> for PasswordField<FormModel> {
-    fn handle_msg(
-        &mut self,
-        ctx: &Context<Self>,
-        msg: <Self as Component>::Message,
-    ) -> anyhow::Result<bool> {
-        match msg {
-            PasswordFieldMsg::OnInput(password) => {
-                self.password = password;
-                if self.password_check_state != PasswordState::NotSupported {
-                    self.password_check_state = PasswordState::Typing;
-                    if self.password.len() >= 8 {
-                        let link = ctx.link().clone();
-                        self.timeout_task = Some(Timeout::new(500, move || {
-                            link.send_message(PasswordFieldMsg::OnInputIdle)
-                        }));
-                    }
-                }
-            }
-            PasswordFieldMsg::PasswordCheckResult(result) => {
-                self.timeout_task = None;
-                // If there's an error from the backend, don't retry.
-                self.password_check_state = PasswordState::NotSupported;
-                if let (Some(check), hash) = result? {
-                    if hash == hash_password(&self.password) {
-                        self.password_check_state = PasswordState::Checked(check)
-                    }
-                }
-            }
-            PasswordFieldMsg::OnInputIdle => {
-                self.timeout_task = None;
-                if self.password_check_state != PasswordState::NotSupported {
-                    self.password_check_state = PasswordState::Loading;
-                    self.common.call_backend(
-                        ctx,
-                        HostService::check_password_haveibeenpwned(hash_password(&self.password)),
-                        PasswordFieldMsg::PasswordCheckResult,
-                    );
-                }
-            }
-        }
-        Ok(true)
-    }
-
-    fn mut_common(&mut self) -> &mut CommonComponentParts<PasswordField<FormModel>> {
-        &mut self.common
-    }
-}
-
-#[derive(Properties, PartialEq, Clone)]
-pub struct PasswordFieldProperties<FormModel: Model> {
-    pub field_name: String,
-    pub form: Form<FormModel>,
-    #[prop_or_else(|| { "form-control".into() })]
-    pub class: Classes,
-    #[prop_or_else(|| { "is-invalid".into() })]
-    pub class_invalid: Classes,
-    #[prop_or_else(|| { "is-valid".into() })]
-    pub class_valid: Classes,
-    #[prop_or_else(Callback::noop)]
-    pub oninput: Callback<String>,
-}
-
-impl<FormModel: Model> Component for PasswordField<FormModel> {
-    type Message = PasswordFieldMsg;
-    type Properties = PasswordFieldProperties<FormModel>;
-
-    fn create(_: &Context<Self>) -> Self {
-        Self {
-            common: CommonComponentParts::<Self>::create(),
-            timeout_task: None,
-            password: String::new(),
-            password_check_state: PasswordState::Typing,
-            _marker: std::marker::PhantomData,
-        }
-    }
-
-    fn update(&mut self, ctx: &Context<Self>, msg: Self::Message) -> bool {
-        CommonComponentParts::<Self>::update(self, ctx, msg)
-    }
-
-    fn view(&self, ctx: &Context<Self>) -> yew::Html {
-        let link = &ctx.link();
-        html! {
-          <div>
-            <Field<FormModel>
-                autocomplete={"new-password"}
-                input_type={"password"}
-                field_name={ctx.props().field_name.clone()}
-                form={ctx.props().form.clone()}
-                class={ctx.props().class.clone()}
-                class_invalid={ctx.props().class_invalid.clone()}
-                class_valid={ctx.props().class_valid.clone()}
-                oninput={link.callback(|e: InputEvent| {
-                    use wasm_bindgen::JsCast;
-                    let target = e.target().unwrap();
-                    let input = target.dyn_into::<HtmlInputElement>().unwrap();
-                    PasswordFieldMsg::OnInput(input.value())
-                })} />
-            {
-                match self.password_check_state {
-                    PasswordState::Checked(PasswordWasLeaked(true)) => html! { <i class="bi bi-x"></i> },
-                    PasswordState::Checked(PasswordWasLeaked(false)) => html! { <i class="bi bi-check"></i> },
-                    PasswordState::NotSupported | PasswordState::Typing => html!{},
-                    PasswordState::Loading =>
-                        html! {
-                          <div class="spinner-border spinner-border-sm" role="status">
-                            <span class="sr-only">{"Loading..."}</span>
-                          </div>
-                        },
-                }
-            }
-          </div>
-        }
-    }
-}
--- a/app/src/components/reset_password_step2.rs
+++ b/app/src/components/reset_password_step2.rs
@@ -1,8 +1,5 @@
 use crate::{
-    components::{
-        password_field::PasswordField,
-        router::{AppRoute, Link},
-    },
+    components::router::{AppRoute, Link},
    infra::{
        api::HostService,
        common_component::{CommonComponent, CommonComponentParts},
@@ -179,12 +176,14 @@ impl Component for ResetPasswordStep2Form {
                  {"New password*:"}
                </label>
                <div class="col-sm-10">
-                  <PasswordField<FormModel>
+                  <Field
                    form={&self.form}
                    field_name="password"
                    class="form-control"
                    class_invalid="is-invalid has-error"
                    class_valid="has-success"
+                    autocomplete="new-password"
+                    input_type="password"
                    oninput={link.callback(|_| Msg::FormUpdate)} />
                  <div class="invalid-feedback">
                    {&self.form.field_message("password")}
--- a/app/src/infra/api.rs
+++ b/app/src/infra/api.rs
@@ -1,4 +1,4 @@
-use crate::infra::cookies::set_cookie;
+use super::cookies::set_cookie;
 use anyhow::{anyhow, Context, Result};
 use gloo_net::http::{Method, Request};
 use graphql_client::GraphQLQuery;
@@ -74,19 +74,6 @@ fn set_cookies_from_jwt(response: login::ServerLoginResponse) -> Result<(String,
        .context("Error setting cookie")
 }

-#[derive(PartialEq)]
-pub struct PasswordHash(String);
-
-#[derive(PartialEq)]
-pub struct PasswordWasLeaked(pub bool);
-
-pub fn hash_password(password: &str) -> PasswordHash {
-    use sha1::{Digest, Sha1};
-    let mut hasher = Sha1::new();
-    hasher.update(password);
-    PasswordHash(format!("{:X}", hasher.finalize()))
-}
-
 impl HostService {
    pub async fn graphql_query<QueryType>(
        variables: QueryType::Variables,
@@ -207,35 +194,4 @@ impl HostService {
                != http::StatusCode::NOT_FOUND,
        )
    }
-
-    pub async fn check_password_haveibeenpwned(
-        password_hash: PasswordHash,
-    ) -> Result<(Option<PasswordWasLeaked>, PasswordHash)> {
-        use lldap_auth::password_reset::*;
-        let hash_prefix = &password_hash.0[0..5];
-        match call_server_json_with_error_message::<PasswordHashList, _>(
-            &format!("/auth/password/check/{}", hash_prefix),
-            NO_BODY,
-            "Could not validate token",
-        )
-        .await
-        {
-            Ok(r) => {
-                for PasswordHashCount { hash, count } in r.hashes {
-                    if password_hash.0[5..] == hash && count != 0 {
-                        return Ok((Some(PasswordWasLeaked(true)), password_hash));
-                    }
-                }
-                Ok((Some(PasswordWasLeaked(false)), password_hash))
-            }
-            Err(e) => {
-                if e.to_string().contains("[501]:") {
-                    // Unimplemented, no API key.
-                    Ok((None, password_hash))
-                } else {
-                    Err(e)
-                }
-            }
-        }
-    }
 }
--- a/app/static/spinner.gif
+++ b/app/static/spinner.gif
--- a/auth/src/lib.rs
+++ b/auth/src/lib.rs
@@ -102,17 +102,6 @@ pub mod password_reset {
        pub user_id: String,
        pub token: String,
    }
-
-    #[derive(Serialize, Deserialize, Clone)]
-    pub struct PasswordHashCount {
-        pub hash: String,
-        pub count: u64,
-    }
-
-    #[derive(Serialize, Deserialize, Clone)]
-    pub struct PasswordHashList {
-        pub hashes: Vec<PasswordHashCount>,
-    }
 }

 #[derive(Clone, Serialize, Deserialize)]
--- a/example_configs/home-assistant.md
+++ b/example_configs/home-assistant.md
@@ -0,0 +1,23 @@
+# Home Assistant Configuration
+
+Home Assistant configures ldap auth via the [Command Line Auth Provider](https://www.home-assistant.io/docs/authentication/providers/#command-line). The wiki mentions a script that can be used for LDAP authentication, but it doesn't work in the container version (it is lacking both `ldapsearch` and `curl` ldap protocol support). Thankfully LLDAP has a graphql API to save the day!
+
+## Graphql-based Auth Script
+
+The [auth script](lldap-ha-auth.sh) attempts to authenticate a user against an LLDAP server, using credentials provided via `username` and `password` environment variables. The first argument must be the URL of your LLDAP server, accessible from Home Assistant. You can provide an additional optional argument to confine allowed logins to a single group. The script will output the user's display name as the `name` variable, if not empty.
+
+1. Copy the [auth script](lldap-ha-auth.sh) to your home assistant instance. In this example, we use `/config/lldap-auth.sh`.
+2. Add the following to your configuration.yaml in Home assistant:
+```yaml
+homeassistant:
+  auth_providers:
+    # Ensure you have the homeassistant provider enabled if you want to continue using your existing accounts
+    - type: homeassistant
+    - type: command_line
+      command: /config/lldap-auth.sh
+      # Only allow users in the 'homeassistant_user' group to login.
+      # Change to ["https://lldap.example.com"] to allow all users
+      args: ["https://lldap.example.com", "homeassistant_user"]
+      meta: true
+```
+3. Reload your config or restart Home Assistant
--- a/example_configs/lldap-ha-auth.sh
+++ b/example_configs/lldap-ha-auth.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# Usernames should be validated using a regular expression to be of
+# a known format. Special characters will be escaped anyway, but it is
+# generally not recommended to allow more than necessary.
+# This pattern is set by default. In your config file, you can either
+# overwrite it with a different one or use "unset USERNAME_PATTERN" to
+# disable validation completely.
+USERNAME_PATTERN='^[a-z|A-Z|0-9|_|-|.]+$'
+
+# When the timeout (in seconds) is exceeded (e.g. due to slow networking),
+# authentication fails.
+TIMEOUT=3
+
+# Log messages to stderr.
+log() {
+	echo "$1" >&2
+}
+
+# Get server address
+if [ -z "$1" ]; then
+	log "Usage: lldap-auth.sh <LLDAP server address> <Optional group to filter>"
+	exit 2
+fi
+SERVER_URL="${1%/}"
+
+# Check username and password are present and not malformed.
+if [ -z "$username" ] || [ -z "$password" ]; then
+	log "Need username and password environment variables."
+	exit 2
+elif [ ! -z "$USERNAME_PATTERN" ]; then
+	username_match=$(echo "$username" | sed -r "s/$USERNAME_PATTERN/x/")
+	if [ "$username_match" != "x" ]; then
+		log "Username '$username' has an invalid format."
+		exit 2
+	fi
+fi
+
+RESPONSE=$(curl -f -s -X POST -m "$TIMEOUT" -H "Content-type: application/json" -d '{"username":"'"$username"'","password":"'"$password"'"}' "$SERVER_URL/auth/simple/login")
+if [[ $? -ne 0 ]]; then
+    log "Auth failed"
+    exit 1
+fi
+TOKEN=$(jq -e -r .token <<< $RESPONSE)
+if [[ $? -ne 0 ]]; then
+    log "Failed to parse token"
+    exit 1
+fi
+
+RESPONSE=$(curl -f -s -m "$TIMEOUT" -H "Content-type: application/json" -H "Authorization: Bearer ${TOKEN}" -d '{"variables":{"id":"'"$username"'"},"query":"query($id:String!){user(userId:$id){displayName groups{displayName}}}"}' "$SERVER_URL/api/graphql")
+if [[ $? -ne 0 ]]; then
+    log "Failed to get user"
+    exit 1
+fi
+
+USER_JSON=$(jq -e .data.user <<< $RESPONSE)
+if [[ $? -ne 0 ]]; then
+    log "Failed to parse user json"
+    exit 1
+fi
+
+if [[ ! -z "$2" ]] && ! jq -e '.groups|map(.displayName)|index("'"$2"'")' <<< $USER_JSON > /dev/null 2>&1; then
+	log "User is not in group '$2'"
+	exit 1
+fi
+
+DISPLAY_NAME=$(jq -r .displayName <<< $USER_JSON)
+
+[[ ! -z "$DISPLAY_NAME" ]] && echo "name = $DISPLAY_NAME"
+
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -2,7 +2,7 @@
 authors = ["Valentin Tolmer <valentin@tolmer.fr>"]
 edition = "2021"
 name = "lldap"
-version = "0.4.3-alpha"
+version = "0.4.3"

 [dependencies]
 actix = "0.13"
@@ -31,8 +31,9 @@ lber = "0.4.1"
 ldap3_proto = ">=0.3.1"
 log = "*"
 orion = "0.17"
-rustls = "0.20"
+rustls-pemfile = "1"
 serde = "*"
+serde_bytes = "0.11"
 serde_json = "1"
 sha2 = "0.10"
 thiserror = "*"
@@ -44,8 +45,7 @@ tracing = "*"
 tracing-actix-web = "0.7"
 tracing-attributes = "^0.1.21"
 tracing-log = "*"
-rustls-pemfile = "1"
-serde_bytes = "0.11"
+urlencoding = "2"
 webpki-roots = "*"

 [dependencies.chrono]
@@ -59,6 +59,7 @@ version = "4"
 [dependencies.figment]
 features = ["env", "toml"]
 version = "*"
+
 [dependencies.tracing-subscriber]
 version = "0.3"
 features = ["env-filter", "tracing-log"]
@@ -113,5 +114,9 @@ version = "0.11"
 default-features = false
 features = ["rustls-tls-webpki-roots"]

+[dependencies.rustls]
+version = "0.20"
+features = ["dangerous_configuration"]
+
 [dev-dependencies]
 mockall = "0.11"
--- a/server/src/infra/auth_service.rs
+++ b/server/src/infra/auth_service.rs
@@ -1,22 +1,21 @@
 use std::collections::{hash_map::DefaultHasher, HashSet};
 use std::hash::{Hash, Hasher};
 use std::pin::Pin;
-use std::task::Poll;
+use std::task::{Context, Poll};

 use actix_web::{
    cookie::{Cookie, SameSite},
    dev::{Service, ServiceRequest, ServiceResponse, Transform},
    error::{ErrorBadRequest, ErrorUnauthorized},
-    web, FromRequest, HttpRequest, HttpResponse,
+    web, HttpRequest, HttpResponse,
 };
 use actix_web_httpauth::extractors::bearer::BearerAuth;
-use anyhow::{bail, Context, Result};
+use anyhow::Result;
 use chrono::prelude::*;
 use futures::future::{ok, Ready};
 use futures_util::FutureExt;
 use hmac::Hmac;
 use jwt::{SignWithKey, VerifyWithKey};
-use secstr::SecUtf8;
 use sha2::Sha512;
 use time::ext::NumericalDuration;
 use tracing::{debug, info, instrument, warn};
@@ -206,24 +205,6 @@ where
        .unwrap_or_else(error_to_http_response)
 }

-async fn check_password_reset_token<'a, Backend>(
-    backend_handler: &Backend,
-    token: &Option<&'a str>,
-) -> TcpResult<Option<(&'a str, UserId)>>
-where
-    Backend: TcpBackendHandler + 'static,
-{
-    let token = match token {
-        None => return Ok(None),
-        Some(token) => token,
-    };
-    let user_id = backend_handler
-        .get_user_id_for_password_reset_token(token)
-        .await
-        .map_err(|_| TcpError::UnauthorizedError("Invalid or expired token".to_string()))?;
-    Ok(Some((token, user_id)))
-}
-
 #[instrument(skip_all, level = "debug")]
 async fn get_password_reset_step2<Backend>(
    data: web::Data<AppState<Backend>>,
@@ -232,12 +213,22 @@ async fn get_password_reset_step2<Backend>(
 where
    Backend: TcpBackendHandler + BackendHandler + 'static,
 {
-    let tcp_handler = data.get_tcp_handler();
-    let (token, user_id) =
-        check_password_reset_token(tcp_handler, &request.match_info().get("token"))
-            .await?
-            .ok_or_else(|| TcpError::BadRequest("Missing token".to_string()))?;
-    let _ = tcp_handler.delete_password_reset_token(token).await;
+    let token = request
+        .match_info()
+        .get("token")
+        .ok_or_else(|| TcpError::BadRequest("Missing reset token".to_owned()))?;
+    let user_id = data
+        .get_tcp_handler()
+        .get_user_id_for_password_reset_token(token)
+        .await
+        .map_err(|e| {
+            debug!("Reset token error: {e:#}");
+            TcpError::NotFoundError("Wrong or expired reset token".to_owned())
+        })?;
+    let _ = data
+        .get_tcp_handler()
+        .delete_password_reset_token(token)
+        .await;
    let groups = HashSet::new();
    let token = create_jwt(&data.jwt_key, user_id.to_string(), groups);
    Ok(HttpResponse::Ok()
@@ -412,7 +403,6 @@ where
    Backend: TcpBackendHandler + BackendHandler + OpaqueHandler + LoginHandler + 'static,
 {
    let user_id = UserId::new(&request.username);
-    debug!(?user_id);
    let bind_request = BindRequest {
        name: user_id.clone(),
        password: request.password.clone(),
@@ -459,115 +449,6 @@ where
        .unwrap_or_else(error_to_http_response)
 }

-// Parse the response from the HaveIBeenPwned API. Sample response:
-//
-// 0018A45C4D1DEF81644B54AB7F969B88D65:1
-// 00D4F6E8FA6EECAD2A3AA415EEC418D38EC:2
-// 011053FD0102E94D6AE2F8B83D76FAF94F6:13
-fn parse_hash_list(response: &str) -> Result<password_reset::PasswordHashList> {
-    use password_reset::*;
-    let parse_line = |line: &str| -> Result<PasswordHashCount> {
-        let split = line.trim().split(':').collect::<Vec<_>>();
-        if let [hash, count] = &split[..] {
-            if hash.len() == 35 {
-                if let Ok(count) = str::parse::<u64>(count) {
-                    return Ok(PasswordHashCount {
-                        hash: hash.to_string(),
-                        count,
-                    });
-                }
-            }
-        }
-        bail!("Invalid password hash from API: {}", line)
-    };
-    Ok(PasswordHashList {
-        hashes: response
-            .split('\n')
-            .map(parse_line)
-            .collect::<Result<Vec<_>>>()?,
-    })
-}
-
-// TODO: Refactor that for testing.
-async fn get_password_hash_list(
-    hash: &str,
-    api_key: &SecUtf8,
-) -> Result<password_reset::PasswordHashList> {
-    use reqwest::*;
-    let client = Client::new();
-    let resp = client
-        .get(format!("https://api.pwnedpasswords.com/range/{}", hash))
-        .header(header::USER_AGENT, "LLDAP")
-        .header("hibp-api-key", api_key.unsecure())
-        .send()
-        .await
-        .context("Could not get response from HIBP")?
-        .text()
-        .await?;
-    parse_hash_list(&resp).context("Invalid HIBP response")
-}
-
-async fn check_password_pwned<Backend>(
-    data: web::Data<AppState<Backend>>,
-    request: HttpRequest,
-    payload: web::Payload,
-) -> TcpResult<HttpResponse>
-where
-    Backend: TcpBackendHandler + BackendHandler + OpaqueHandler + 'static,
-{
-    let has_reset_token = check_password_reset_token(
-        data.get_tcp_handler(),
-        &request
-            .headers()
-            .get("reset-token")
-            .map(|v| v.to_str().unwrap()),
-    )
-    .await?
-    .is_some();
-    let inner_payload = &mut payload.into_inner();
-    if !has_reset_token
-        && BearerAuth::from_request(&request, inner_payload)
-            .await
-            .ok()
-            .and_then(|bearer| check_if_token_is_valid(&data, bearer.token()).ok())
-            .is_none()
-    {
-        return Err(TcpError::UnauthorizedError(
-            "No token or invalid token".to_string(),
-        ));
-    }
-    if data.hibp_api_key.unsecure().is_empty() {
-        return Err(TcpError::NotImplemented("No HIBP API key".to_string()));
-    }
-    let hash = request
-        .match_info()
-        .get("hash")
-        .ok_or_else(|| TcpError::BadRequest("Missing hash".to_string()))?;
-    if hash.len() != 5 || !hash.chars().all(|c| c.is_ascii_hexdigit()) {
-        return Err(TcpError::BadRequest(format!(
-            "Bad request: invalid hash format \"{}\"",
-            hash
-        )));
-    }
-    get_password_hash_list(hash, &data.hibp_api_key)
-        .await
-        .map(|hashes| HttpResponse::Ok().json(hashes))
-        .map_err(|e| TcpError::InternalServerError(e.to_string()))
-}
-
-async fn check_password_pwned_handler<Backend>(
-    data: web::Data<AppState<Backend>>,
-    request: HttpRequest,
-    payload: web::Payload,
-) -> HttpResponse
-where
-    Backend: TcpBackendHandler + BackendHandler + OpaqueHandler + 'static,
-{
-    check_password_pwned(data, request, payload)
-        .await
-        .unwrap_or_else(error_to_http_response)
-}
-
 #[instrument(skip_all, level = "debug")]
 async fn opaque_register_start<Backend>(
    request: actix_web::HttpRequest,
@@ -684,7 +565,7 @@ where
    #[allow(clippy::type_complexity)]
    type Future = Pin<Box<dyn core::future::Future<Output = Result<Self::Response, Self::Error>>>>;

-    fn poll_ready(&self, cx: &mut std::task::Context<'_>) -> Poll<Result<(), Self::Error>> {
+    fn poll_ready(&self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
        self.service.poll_ready(cx)
    }

@@ -755,11 +636,6 @@ where
            web::resource("/simple/login").route(web::post().to(simple_login_handler::<Backend>)),
        )
        .service(web::resource("/refresh").route(web::get().to(get_refresh_handler::<Backend>)))
-        .service(
-            web::resource("/password/check/{hash}")
-                .wrap(CookieToHeaderTranslatorFactory)
-                .route(web::get().to(check_password_pwned_handler::<Backend>)),
-        )
        .service(web::resource("/logout").route(web::get().to(get_logout_handler::<Backend>)))
        .service(
            web::scope("/opaque/register")
--- a/server/src/infra/cli.rs
+++ b/server/src/infra/cli.rs
@@ -81,10 +81,6 @@ pub struct RunOpts {
    #[clap(short, long, env = "LLDAP_DATABASE_URL")]
    pub database_url: Option<String>,

-    /// HaveIBeenPwned API key, to check passwords against leaks.
-    #[clap(long, env = "LLDAP_HIBP_API_KEY")]
-    pub hibp_api_key: Option<String>,
-
    #[clap(flatten)]
    pub smtp_opts: SmtpOpts,

--- a/server/src/infra/configuration.rs
+++ b/server/src/infra/configuration.rs
@@ -98,8 +98,6 @@ pub struct Configuration {
    pub ldaps_options: LdapsOptions,
    #[builder(default = r#"String::from("http://localhost")"#)]
    pub http_url: String,
-    #[builder(default = r#"SecUtf8::from("")"#)]
-    pub hibp_api_key: SecUtf8,
    #[serde(skip)]
    #[builder(field(private), default = "None")]
    server_setup: Option<ServerSetup>,
@@ -215,10 +213,6 @@ impl ConfigOverrider for RunOpts {
        if let Some(database_url) = self.database_url.as_ref() {
            config.database_url = database_url.to_string();
        }
-
-        if let Some(api_key) = self.hibp_api_key.as_ref() {
-            config.hibp_api_key = SecUtf8::from(api_key.clone());
-        }
        self.smtp_opts.override_config(config);
        self.ldaps_opts.override_config(config);
    }
--- a/server/src/infra/graphql/query.rs
+++ b/server/src/infra/graphql/query.rs
@@ -124,10 +124,12 @@ impl<Handler: BackendHandler> Query<Handler> {
    }

    pub async fn user(context: &Context<Handler>, user_id: String) -> FieldResult<User<Handler>> {
+        use anyhow::Context;
        let span = debug_span!("[GraphQL query] user");
        span.in_scope(|| {
            debug!(?user_id);
        });
+        let user_id = urlencoding::decode(&user_id).context("Invalid user parameter")?;
        let user_id = UserId::new(&user_id);
        let handler = context
            .get_readable_handler(&user_id)
--- a/server/src/infra/healthcheck.rs
+++ b/server/src/infra/healthcheck.rs
@@ -1,4 +1,4 @@
-use crate::infra::configuration::LdapsOptions;
+use crate::infra::{configuration::LdapsOptions, ldap_server::read_certificates};
 use anyhow::{anyhow, bail, ensure, Context, Result};
 use futures_util::SinkExt;
 use ldap3_proto::{
@@ -65,6 +65,7 @@ where
        invalid_answer
    );
    info!("Success");
+    resp.close().await?;
    Ok(())
 }

@@ -85,15 +86,44 @@ fn get_root_certificates() -> rustls::RootCertStore {
    root_store
 }

-fn get_tls_connector() -> Result<RustlsTlsConnector> {
-    use rustls::ClientConfig;
-    let client_config = std::sync::Arc::new(
-        ClientConfig::builder()
-            .with_safe_defaults()
-            .with_root_certificates(get_root_certificates())
-            .with_no_client_auth(),
-    );
-    Ok(client_config.into())
+fn get_tls_connector(ldaps_options: &LdapsOptions) -> Result<RustlsTlsConnector> {
+    let mut client_config = rustls::ClientConfig::builder()
+        .with_safe_defaults()
+        .with_root_certificates(get_root_certificates())
+        .with_no_client_auth();
+    let (certs, _private_key) = read_certificates(ldaps_options)?;
+    // Check that the server cert is the one in the config file.
+    struct CertificateVerifier {
+        certificate: rustls::Certificate,
+        certificate_path: String,
+    }
+    impl rustls::client::ServerCertVerifier for CertificateVerifier {
+        fn verify_server_cert(
+            &self,
+            end_entity: &rustls::Certificate,
+            _intermediates: &[rustls::Certificate],
+            _server_name: &rustls::ServerName,
+            _scts: &mut dyn Iterator<Item = &[u8]>,
+            _ocsp_response: &[u8],
+            _now: std::time::SystemTime,
+        ) -> std::result::Result<rustls::client::ServerCertVerified, rustls::Error> {
+            if end_entity != &self.certificate {
+                return Err(rustls::Error::InvalidCertificateData(format!(
+                    "Server certificate doesn't match the one in the config file {}",
+                    &self.certificate_path
+                )));
+            }
+            Ok(rustls::client::ServerCertVerified::assertion())
+        }
+    }
+    let mut dangerous_config = rustls::client::DangerousClientConfig {
+        cfg: &mut client_config,
+    };
+    dangerous_config.set_certificate_verifier(std::sync::Arc::new(CertificateVerifier {
+        certificate: certs.first().expect("empty certificate chain").clone(),
+        certificate_path: ldaps_options.cert_file.clone(),
+    }));
+    Ok(std::sync::Arc::new(client_config).into())
 }

 #[instrument(skip_all, level = "info", err)]
@@ -102,15 +132,20 @@ pub async fn check_ldaps(ldaps_options: &LdapsOptions) -> Result<()> {
        info!("LDAPS not enabled");
        return Ok(());
    };
-    let tls_connector = get_tls_connector()?;
+    let tls_connector =
+        get_tls_connector(ldaps_options).context("while preparing the tls connection")?;
    let url = format!("localhost:{}", ldaps_options.port);
    check_ldap_endpoint(
        tls_connector
            .connect(
-                rustls::ServerName::try_from(url.as_str())?,
-                TcpStream::connect(&url).await?,
+                rustls::ServerName::try_from("localhost")
+                    .context("while parsing the server name")?,
+                TcpStream::connect(&url)
+                    .await
+                    .context("while connecting TCP")?,
            )
-            .await?,
+            .await
+            .context("while connecting TLS")?,
    )
    .await
 }
--- a/server/src/infra/ldap_server.rs
+++ b/server/src/infra/ldap_server.rs
@@ -4,7 +4,8 @@ use crate::{
        opaque_handler::OpaqueHandler,
    },
    infra::{
-        access_control::AccessControlledBackendHandler, configuration::Configuration,
+        access_control::AccessControlledBackendHandler,
+        configuration::{Configuration, LdapsOptions},
        ldap_handler::LdapHandler,
    },
 };
@@ -94,7 +95,7 @@ where
 }

 fn read_private_key(key_file: &str) -> Result<PrivateKey> {
-    use rustls_pemfile::{pkcs8_private_keys, rsa_private_keys};
+    use rustls_pemfile::{ec_private_keys, pkcs8_private_keys, rsa_private_keys};
    use std::{fs::File, io::BufReader};
    pkcs8_private_keys(&mut BufReader::new(File::open(key_file)?))
        .map_err(anyhow::Error::from)
@@ -112,29 +113,36 @@ fn read_private_key(key_file: &str) -> Result<PrivateKey> {
                        .ok_or_else(|| anyhow!("No PKCS1 key"))
                })
        })
+        .or_else(|_| {
+            ec_private_keys(&mut BufReader::new(File::open(key_file)?))
+                .map_err(anyhow::Error::from)
+                .and_then(|keys| keys.into_iter().next().ok_or_else(|| anyhow!("No EC key")))
+        })
        .with_context(|| {
            format!(
-                "Cannot read either PKCS1 or PKCS8 private key from {}",
+                "Cannot read either PKCS1, PKCS8 or EC private key from {}",
                key_file
            )
        })
        .map(rustls::PrivateKey)
 }

-fn get_tls_acceptor(config: &Configuration) -> Result<RustlsTlsAcceptor> {
-    use rustls::{Certificate, ServerConfig};
-    use rustls_pemfile::certs;
+pub fn read_certificates(
+    ldaps_options: &LdapsOptions,
+) -> Result<(Vec<rustls::Certificate>, rustls::PrivateKey)> {
    use std::{fs::File, io::BufReader};
-    // Load TLS key and cert files
-    let certs = certs(&mut BufReader::new(File::open(
-        &config.ldaps_options.cert_file,
-    )?))?
-    .into_iter()
-    .map(Certificate)
-    .collect::<Vec<_>>();
-    let private_key = read_private_key(&config.ldaps_options.key_file)?;
+    let certs = rustls_pemfile::certs(&mut BufReader::new(File::open(&ldaps_options.cert_file)?))?
+        .into_iter()
+        .map(rustls::Certificate)
+        .collect::<Vec<_>>();
+    let private_key = read_private_key(&ldaps_options.key_file)?;
+    Ok((certs, private_key))
+}
+
+fn get_tls_acceptor(ldaps_options: &LdapsOptions) -> Result<RustlsTlsAcceptor> {
+    let (certs, private_key) = read_certificates(ldaps_options)?;
    let server_config = std::sync::Arc::new(
-        ServerConfig::builder()
+        rustls::ServerConfig::builder()
            .with_safe_defaults()
            .with_no_client_auth()
            .with_single_cert(certs, private_key)?,
@@ -185,7 +193,8 @@ where
    if config.ldaps_options.enabled {
        let tls_context = (
            context_for_tls,
-            get_tls_acceptor(config).context("while setting up the SSL certificate")?,
+            get_tls_acceptor(&config.ldaps_options)
+                .context("while setting up the SSL certificate")?,
        );
        let tls_binder = move || {
            let tls_context = tls_context.clone();
--- a/server/src/infra/tcp_server.rs
+++ b/server/src/infra/tcp_server.rs
@@ -19,7 +19,6 @@ use actix_service::map_config;
 use actix_web::{dev::AppConfig, guard, web, App, HttpResponse, Responder};
 use anyhow::{Context, Result};
 use hmac::Hmac;
-use secstr::SecUtf8;
 use sha2::Sha512;
 use std::collections::HashSet;
 use std::path::PathBuf;
@@ -39,10 +38,10 @@ pub enum TcpError {
    BadRequest(String),
    #[error("Internal server error: `{0}`")]
    InternalServerError(String),
+    #[error("Not found: `{0}`")]
+    NotFoundError(String),
    #[error("Unauthorized: `{0}`")]
    UnauthorizedError(String),
-    #[error("Not implemented: `{0}`")]
-    NotImplemented(String),
 }

 pub type TcpResult<T> = std::result::Result<T, TcpError>;
@@ -61,9 +60,9 @@ pub(crate) fn error_to_http_response(error: TcpError) -> HttpResponse {
            | DomainError::EntityNotFound(_) => HttpResponse::BadRequest(),
        },
        TcpError::BadRequest(_) => HttpResponse::BadRequest(),
+        TcpError::NotFoundError(_) => HttpResponse::NotFound(),
        TcpError::InternalServerError(_) => HttpResponse::InternalServerError(),
        TcpError::UnauthorizedError(_) => HttpResponse::Unauthorized(),
-        TcpError::NotImplemented(_) => HttpResponse::NotImplemented(),
    }
    .body(error.to_string())
 }
@@ -89,7 +88,6 @@ fn http_config<Backend>(
    jwt_blacklist: HashSet<u64>,
    server_url: String,
    mail_options: MailOptions,
-    hibp_api_key: SecUtf8,
 ) where
    Backend: TcpBackendHandler + BackendHandler + LoginHandler + OpaqueHandler + Clone + 'static,
 {
@@ -100,7 +98,6 @@ fn http_config<Backend>(
        jwt_blacklist: RwLock::new(jwt_blacklist),
        server_url,
        mail_options,
-        hibp_api_key,
    }))
    .route(
        "/health",
@@ -136,7 +133,6 @@ pub(crate) struct AppState<Backend> {
    pub jwt_blacklist: RwLock<HashSet<u64>>,
    pub server_url: String,
    pub mail_options: MailOptions,
-    pub hibp_api_key: SecUtf8,
 }

 impl<Backend: BackendHandler> AppState<Backend> {
@@ -177,7 +173,6 @@ where
    let mail_options = config.smtp_options.clone();
    let verbose = config.verbose;
    info!("Starting the API/web server on port {}", config.http_port);
-    let hibp_api_key = config.hibp_api_key.clone();
    server_builder
        .bind(
            "http",
@@ -188,7 +183,6 @@ where
                let jwt_blacklist = jwt_blacklist.clone();
                let server_url = server_url.clone();
                let mail_options = mail_options.clone();
-                let hibp_api_key = hibp_api_key.clone();
                HttpServiceBuilder::default()
                    .finish(map_config(
                        App::new()
@@ -204,7 +198,6 @@ where
                                    jwt_blacklist,
                                    server_url,
                                    mail_options,
-                                    hibp_api_key,
                                )
                            }),
                        |_| AppConfig::default(),
Author	SHA1	Message	Date
Valentin Tolmer	252132430c	github: always generate artifacts for a release	2023-04-11 15:01:41 +02:00
Valentin Tolmer	7f9bc95c5c	release: 0.4.3	2023-04-11 14:41:57 +02:00
Valentin Tolmer	69fca82a86	readme: fix the codecov badge	2023-04-11 14:12:17 +02:00
Valentin Tolmer	9a30cac7b0	healthcheck: check that the server's certificate is the one in the config	2023-04-11 13:51:02 +02:00
Michał Mrozek	558bb37354	server: add support for ec private keys	2023-04-11 10:57:25 +02:00
Dedy Martadinata S	5b74852193	github: Leverage metadata (#532 )	2023-04-11 11:03:56 +07:00
Valentin Tolmer	d18cf1ac37	server: decode graphql parameter	2023-04-10 19:10:42 +02:00
Valentin Tolmer	96f55ff28e	github: use codecov token only for main push, no token for PRs	2023-04-10 17:29:36 +02:00
Dedy Martadinata S	825f37d360	github: add healthcheck to the test DB services	2023-04-10 17:09:54 +02:00
Austin Alvarado	8eb27c5267	docs: Create Home Assistant config (#535 )	2023-04-07 14:59:21 -06:00
budimanjojo	18d9dd6ff9	github: also push to ghcr.io and add docker.io/lldap/lldap	2023-04-05 17:51:23 +02:00
Austin Alvarado	308521c632	Use jq in CI to extract json deterministically (#529 ) cut relies on the string being a fixed length, which is subject to change in the future	2023-04-05 22:20:15 +07:00