projects/graylog-groups
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A program that controls Graylog privileges based on LDAP groups.
9 commits 1 branch 0 tags 71 KiB
Go 100%
Find a file
Emmanuel BENOîT 4722223603 Refactored into multiple files 
* The main program, command line argument parsing and logging
  initialization remains in main.go
* Configuration structure and loader are in config.go
* LDAP connection and querying is in ldap.go
* Anything that has to do with Graylog, including the privilege mapping,
  is in graylog.go
2021-02-11 20:44:07 +01:00
.gitignore Initial version 2021-02-07 15:05:35 +01:00
config.go Refactored into multiple files 2021-02-11 20:44:07 +01:00
COPYING Documentation and license 2021-02-07 18:42:17 +01:00
go.mod Improved logging 2021-02-10 23:58:14 +01:00
graylog-groups.yml.example Read username from referenced LDAP record 2021-02-09 23:15:24 +01:00
graylog.go Refactored into multiple files 2021-02-11 20:44:07 +01:00
ldap.go Refactored into multiple files 2021-02-11 20:44:07 +01:00
main.go Refactored into multiple files 2021-02-11 20:44:07 +01:00
README.md Improved logging 2021-02-10 23:58:14 +01:00

README.md

graylog-groups

A program that controls Graylog roles and privileges over objects using LDAP groups.

Note My apologies, this is my first actual program in Go, so it must be a terrible example of worst practices. Sorry.

Why?

The community edition of Graylog had the ability to use LDAP group in order to control user access to the various objects (streams and dashboards).

In a somewhat ethically questionable move this capability was removed in version 4.0 and replaced with an enterprise-only feature called teams.

This program is meant to emulate the pre-4.0 LDAP group functionality.

How?

This program is meant to be executed on a regular basis through e.g. cron. It will read its configuration file, and from there :

  • get the list of users on the Graylog side,
  • read the list of members for all LDAP groups that have a mapping defined in the configuration file,
  • compute the roles and object privileges to grant for each Graylog user,
  • optionally delete users that no longer have any privileges according to the mapping and LDAP group membership,
  • set the users' permissions on the various Graylog objects,
  • add or remove Graylog roles from user accounts.

Installing

  • Download and build the program :
git clone https://github.com/tseeker/graylog-groups
cd graylog-groups
go build
  • Copy the resulting binary to whatever box will run it.
  • Create a configuration file based in the example from graylog-groups.yml.example.
  • Set up a cron job or whatever it is you use to schedule tasks to run the synchronization binary on a regular basis.

To Do

  • Proper logging, work in progress:
    • Add logs to the privilege computations and related API calls.
    • Sending logs to... well, Graylog... through CLI switches.
    • Writing logs to a file.
  • Document command line flags.
  • Cache LDAP username lookups
  • Add TLS options (skip checks / specify CA) for the Graylog API.
  • Read object ownership using grn_permissions to preserve privileges on users' own objects
  • Support granting ownership on objects
  • Use goroutines ? Maybe.