The simple OpenID Provider for LDAP like a Microsoft ActiveDirectory(AD).

• OpenID Connect Core 1.0
• OpenID Connect Discovery 1.0
• OpenID Connect RP-Initiated Logout 1.0 - draft 01
• OAuth2 (RFC6749)
• LDAP v3 (use go-ldap)

$ docker run macrat/lauth:latest --version
lauth version 1.0.0

$ go get github.com/macrat/lauth

$ lauth --version
lauth version 1.0.0

First, Generate a config file.

$ lauth gen-client your-client-name -u https://you-client.example.com/callback >> config.toml

Then, start the server.

$ lauth \
  --ldap ldap://ldap.example.com \
  --ldap-user "CN=username,OU=somewhere,DC=example,DC=local" \
  --ldap-password ${LDAP_USER_PASSWORD} \
  --config config.toml

Finally, use it.

• authorization endpoint: http://localhost:8000/login
• token endpoint: http://localhost:8000/login/token
• userinfo endpoint: http://localhost:8000/login/userinfo
• jwks endpoint: http://localhost:8000/login/jwks
• discovery endpoint: http://localhost:8000/.well-known/openid-configuration

See also all options list and example config file.

In the production use-case, please add those options.

• --issuer: External URL of the server.
• --sign-key: RSA private key for signing to the token.
• --tls-cert and --tls-key (or --tls-auto): TLS encryption key files (Or automate generate those with Let's encryption).
• --metrics-username and --metrics-password: Credentials for protect metrics page. (metrics page perhaps interesting hint for an attacker)

Please see example.

This is default page design:

If you want to customize the design, you can use --login-page, --logout-page, and --error-page. Templates using html/template libraries format.

Please see also the default page templates:

• login page
• logged out page
• error page

In default, Lauth uses sAMAccountName as the username. That is the logon ID of Microsoft ActiveDirectory.

Please use --ldap-id-attribute option if you want to use another attribute as the username.

$ lauth --ldap-id-attribute mail  # login with e-mail

Or, you can use a config file.

$ cat <<EOS > config.toml
[ldap]
id_attribute = "mail"
EOS

$ lauth --config config.toml

You can change scope and claims for id_token and userinfo in the config file.

This is default config; That claims for Microsoft ActiveDirectory.

[scope]

profile = [
  { claim = "name",        attribute = "displayName" },
  { claim = "given_name",  attribute = "givenName"   },
  { claim = "family_name", attribute = "sn"          },
]

email = [
  { claim = "email", attribute = "mail" },
]

phone = [
  { claim = "phone_number", attribute = "telephoneNumber" },
]

groups = [
  { claim = "groups", attribute = "memberOf", type = "[]string" },
]

$ lauth [OPTIONS]

$ lauth gen-client CLIENT_ID [OPTIONS]