kvspb/nginx-auth-ldap v1.1.0

1.1.0

on GitHub

Added

• auth_ldap takes variables, and a value of off turns the check off for
  the request, as auth_basic does: a geo or map variable can exempt
  clients or requests without if (#77, #238, PR #257). Quotes
  and backslashes in the realm are escaped.
• Every denied login is logged with the login, the server and the reason
  (wrong password, no such user, requirements not met, cached denial),
  never the password, so that tools such as fail2ban can use the error
  log (#171). Control characters in the login are escaped.
• binddn_passwd_file reads the password of binddn from a file of its own,
  such as a container secret (#105, #217).

Changed

• The error log lines of a failed login now name the login and the server:
  User bind failed for "<login>" on server "<name>" (49: ...) instead of
  User bind failed (49: ...), and Could not find user DN for "<login>" on server "<name>" instead of Could not find user DN. Update log
  filters that match the old text.
• A second auth_ldap in the same block fails nginx -t with
  "is duplicate"; the last one used to win silently.

Fixed

• With several servers in auth_ldap_servers, a server whose connections
  were still being opened, as right after a worker started or after the
  server closed an idle connection, was skipped as if it were unreachable:
  the request went to the next server, or got 503 when that one denied.
  A server is now skipped only once a connection to it has failed.

Full list of changes: v1.0.1...v1.1.0