精简: 去掉 LDAP(目录登录+用户同步): util/ldap 包、同步 job、登录分支、全部 ldap* 设置

internal/web/service/panel/user.go

@@ -10,7 +10,6 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/logger"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
-	ldaputil "github.com/mhsanaei/3x-ui/v3/internal/util/ldap"
 	"github.com/mhsanaei/3x-ui/v3/internal/web/service"
 )
 
@@ -52,36 +51,7 @@ func (s *UserService) CheckUser(username string, password string, twoFactorCode
 	}
 
 	if !crypto.CheckPasswordHash(user.Password, password) {
-		ldapEnabled, _ := s.settingService.GetLdapEnable()
-		if !ldapEnabled {
-			return nil, errors.New("invalid credentials")
-		}
-
-		host, _ := s.settingService.GetLdapHost()
-		port, _ := s.settingService.GetLdapPort()
-		useTLS, _ := s.settingService.GetLdapUseTLS()
-		skipVerify, _ := s.settingService.GetLdapInsecureSkipVerify()
-		bindDN, _ := s.settingService.GetLdapBindDN()
-		ldapPass, _ := s.settingService.GetLdapPassword()
-		baseDN, _ := s.settingService.GetLdapBaseDN()
-		userFilter, _ := s.settingService.GetLdapUserFilter()
-		userAttr, _ := s.settingService.GetLdapUserAttr()
-
-		cfg := ldaputil.Config{
-			Host:               host,
-			Port:               port,
-			UseTLS:             useTLS,
-			InsecureSkipVerify: skipVerify,
-			BindDN:             bindDN,
-			Password:           ldapPass,
-			BaseDN:             baseDN,
-			UserFilter:         userFilter,
-			UserAttr:           userAttr,
-		}
-		ok, err := ldaputil.AuthenticateUser(cfg, username, password)
-		if err != nil || !ok {
-			return nil, errors.New("invalid credentials")
-		}
+		return nil, errors.New("invalid credentials")
 	}
 
 	twoFactorEnable, err := s.settingService.GetTwoFactorEnable()

internal/web/service/setting.go

@@ -55,103 +55,80 @@ var defaultValueMap = map[string]string{
 	// cert are minted lazily on first use, and the node-side trust CA is pasted
 	// in by the operator. Kept out of entity.AllSetting so private keys never
 	// reach the settings UI/export.
-	"nodeMtlsCaCertPem":           "",
-	"nodeMtlsCaKeyPem":            "",
-	"nodeMtlsClientCertPem":       "",
-	"nodeMtlsClientKeyPem":        "",
-	"nodeMtlsClientCertSha256":    "",
-	"nodeMtlsClientCAPem":         "",
-	"webBasePath":                 normalizeBasePath(getEnv("XUI_INIT_WEB_BASE_PATH", "/")),
-	"sessionMaxAge":               "360",
-	"trustedProxyCIDRs":           DefaultTrustedProxyCIDRs,
-	"ipLimitAllowlist":            "",
-	"pageSize":                    "25",
-	"expireDiff":                  "0",
-	"trafficDiff":                 "0",
-	"remarkTemplate":              DefaultRemarkTemplate,
-	"subShowIdentityOnAllLinks":   "false",
-	"timeLocation":                "Local",
-	"tgBotEnable":                 "false",
-	"tgBotToken":                  "",
-	"tgBotProxy":                  "",
-	"tgBotAPIServer":              "",
-	"tgBotChatId":                 "",
-	"tgRunTime":                   "@daily",
-	"tgBotBackup":                 "false",
-	"tgCpu":                       "80",
-	"tgMemory":                    "80",
-	"tgLang":                      "en-US",
-	"twoFactorEnable":             "false",
-	"twoFactorToken":              "",
-	"subEnable":                   "true",
-	"subJsonEnable":               "false",
-	"subJsonAutoDetect":           "false",
-	"subJsonAlwaysArray":          "false",
-	"subJsonUserAgentRegex":       "",
-	"subClashAutoDetect":          "false",
-	"subClashUserAgentRegex":      "",
-	"subTitle":                    "",
-	"subSupportUrl":               "",
-	"subProfileUrl":               "",
-	"subAnnounce":                 "",
-	"subEnableRouting":            "false",
-	"subRoutingRules":             "",
-	"subHideSettings":             "false",
-	"subIncyEnableRouting":        "false",
-	"subIncyRoutingRules":         "",
-	"subListen":                   "",
-	"subPort":                     "2096",
-	"subPath":                     "/sub/",
-	"subDomain":                   "",
-	"subCertFile":                 "",
-	"subKeyFile":                  "",
-	"subUpdates":                  "12",
-	"subEncrypt":                  "true",
-	"subURI":                      "",
-	"subJsonPath":                 "/json/",
-	"subJsonURI":                  "",
-	"subClashEnable":              "false",
-	"subClashPath":                "/clash/",
-	"subClashURI":                 "",
-	"subClashEnableRouting":       "false",
-	"subClashRules":               "",
-	"subJsonMux":                  "",
-	"subJsonRules":                "",
-	"subJsonFinalMask":            "",
-	"subJsonObservatory":          "",
-	"subThemeDir":                 "",
-	"datepicker":                  "gregorian",
-	"warp":                        "",
-	"warpUpdateInterval":          "0",
-	"nord":                        "",
-	"pia":                         "",
-	"restartXrayOnClientDisable":  "true",
-	"xrayOutboundTestUrl":         "https://www.google.com/generate_204",
-	"panelOutbound":               "",
-	"devChannelEnable":            "false",
-
-	// LDAP defaults
-	"ldapEnable":             "false",
-	"ldapHost":               "",
-	"ldapPort":               "389",
-	"ldapUseTLS":             "false",
-	"ldapInsecureSkipVerify": "false",
-	"ldapBindDN":             "",
-	"ldapPassword":           "",
-	"ldapBaseDN":             "",
-	"ldapUserFilter":         "(objectClass=person)",
-	"ldapUserAttr":           "mail",
-	"ldapVlessField":         "vless_enabled",
-	"ldapSyncCron":           "@every 1m",
-	"ldapFlagField":          "",
-	"ldapTruthyValues":       "true,1,yes,on",
-	"ldapInvertFlag":         "false",
-	"ldapInboundTags":        "",
-	"ldapAutoCreate":         "false",
-	"ldapAutoDelete":         "false",
-	"ldapDefaultTotalGB":     "0",
-	"ldapDefaultExpiryDays":  "0",
-	"ldapDefaultLimitIP":     "0",
+	"nodeMtlsCaCertPem":          "",
+	"nodeMtlsCaKeyPem":           "",
+	"nodeMtlsClientCertPem":      "",
+	"nodeMtlsClientKeyPem":       "",
+	"nodeMtlsClientCertSha256":   "",
+	"nodeMtlsClientCAPem":        "",
+	"webBasePath":                normalizeBasePath(getEnv("XUI_INIT_WEB_BASE_PATH", "/")),
+	"sessionMaxAge":              "360",
+	"trustedProxyCIDRs":          DefaultTrustedProxyCIDRs,
+	"ipLimitAllowlist":           "",
+	"pageSize":                   "25",
+	"expireDiff":                 "0",
+	"trafficDiff":                "0",
+	"remarkTemplate":             DefaultRemarkTemplate,
+	"subShowIdentityOnAllLinks":  "false",
+	"timeLocation":               "Local",
+	"tgBotEnable":                "false",
+	"tgBotToken":                 "",
+	"tgBotProxy":                 "",
+	"tgBotAPIServer":             "",
+	"tgBotChatId":                "",
+	"tgRunTime":                  "@daily",
+	"tgBotBackup":                "false",
+	"tgCpu":                      "80",
+	"tgMemory":                   "80",
+	"tgLang":                     "en-US",
+	"twoFactorEnable":            "false",
+	"twoFactorToken":             "",
+	"subEnable":                  "true",
+	"subJsonEnable":              "false",
+	"subJsonAutoDetect":          "false",
+	"subJsonAlwaysArray":         "false",
+	"subJsonUserAgentRegex":      "",
+	"subClashAutoDetect":         "false",
+	"subClashUserAgentRegex":     "",
+	"subTitle":                   "",
+	"subSupportUrl":              "",
+	"subProfileUrl":              "",
+	"subAnnounce":                "",
+	"subEnableRouting":           "false",
+	"subRoutingRules":            "",
+	"subHideSettings":            "false",
+	"subIncyEnableRouting":       "false",
+	"subIncyRoutingRules":        "",
+	"subListen":                  "",
+	"subPort":                    "2096",
+	"subPath":                    "/sub/",
+	"subDomain":                  "",
+	"subCertFile":                "",
+	"subKeyFile":                 "",
+	"subUpdates":                 "12",
+	"subEncrypt":                 "true",
+	"subURI":                     "",
+	"subJsonPath":                "/json/",
+	"subJsonURI":                 "",
+	"subClashEnable":             "false",
+	"subClashPath":               "/clash/",
+	"subClashURI":                "",
+	"subClashEnableRouting":      "false",
+	"subClashRules":              "",
+	"subJsonMux":                 "",
+	"subJsonRules":               "",
+	"subJsonFinalMask":           "",
+	"subJsonObservatory":         "",
+	"subThemeDir":                "",
+	"datepicker":                 "gregorian",
+	"warp":                       "",
+	"warpUpdateInterval":         "0",
+	"nord":                       "",
+	"pia":                        "",
+	"restartXrayOnClientDisable": "true",
+	"xrayOutboundTestUrl":        "https://www.google.com/generate_204",
+	"panelOutbound":              "",
+	"devChannelEnable":           "false",
 
 	// Event bus — per-subscriber event filtering (empty = all disabled)
 	"tgEnabledEvents":   "login.attempt,cpu.high",
@@ -270,7 +247,6 @@ func (s *SettingService) GetAllSettingView() (*entity.AllSettingView, error) {
 	view := &entity.AllSettingView{AllSetting: *allSetting}
 	view.HasTgBotToken = secretConfigured(allSetting.TgBotToken)
 	view.HasTwoFactorToken = secretConfigured(allSetting.TwoFactorToken)
-	view.HasLdapPassword = secretConfigured(allSetting.LdapPassword)
 	view.HasWarpSecret = secretConfigured(mustString(s.GetWarp()))
 	view.HasNordSecret = secretConfigured(mustString(s.GetNord()))
 	view.HasSmtpPassword = secretConfigured(allSetting.SmtpPassword)
@@ -280,7 +256,6 @@ func (s *SettingService) GetAllSettingView() (*entity.AllSettingView, error) {
 	}
 	view.TgBotToken = ""
 	view.TwoFactorToken = ""
-	view.LdapPassword = ""
 	view.SmtpPassword = ""
 	return view, nil
 }
@@ -965,91 +940,6 @@ func (s *SettingService) GetAccessLogEnable() (bool, error) {
 	return (accessLogPath != "none" && accessLogPath != ""), nil
 }
 
-// GetLdapEnable returns whether LDAP is enabled.
-func (s *SettingService) GetLdapEnable() (bool, error) {
-	return s.getBool("ldapEnable")
-}
-
-func (s *SettingService) GetLdapHost() (string, error) {
-	return s.getString("ldapHost")
-}
-
-func (s *SettingService) GetLdapPort() (int, error) {
-	return s.getInt("ldapPort")
-}
-
-func (s *SettingService) GetLdapUseTLS() (bool, error) {
-	return s.getBool("ldapUseTLS")
-}
-
-func (s *SettingService) GetLdapInsecureSkipVerify() (bool, error) {
-	return s.getBool("ldapInsecureSkipVerify")
-}
-
-func (s *SettingService) GetLdapBindDN() (string, error) {
-	return s.getString("ldapBindDN")
-}
-
-func (s *SettingService) GetLdapPassword() (string, error) {
-	return s.getString("ldapPassword")
-}
-
-func (s *SettingService) GetLdapBaseDN() (string, error) {
-	return s.getString("ldapBaseDN")
-}
-
-func (s *SettingService) GetLdapUserFilter() (string, error) {
-	return s.getString("ldapUserFilter")
-}
-
-func (s *SettingService) GetLdapUserAttr() (string, error) {
-	return s.getString("ldapUserAttr")
-}
-
-func (s *SettingService) GetLdapVlessField() (string, error) {
-	return s.getString("ldapVlessField")
-}
-
-func (s *SettingService) GetLdapSyncCron() (string, error) {
-	return s.getString("ldapSyncCron")
-}
-
-func (s *SettingService) GetLdapFlagField() (string, error) {
-	return s.getString("ldapFlagField")
-}
-
-func (s *SettingService) GetLdapTruthyValues() (string, error) {
-	return s.getString("ldapTruthyValues")
-}
-
-func (s *SettingService) GetLdapInvertFlag() (bool, error) {
-	return s.getBool("ldapInvertFlag")
-}
-
-func (s *SettingService) GetLdapInboundTags() (string, error) {
-	return s.getString("ldapInboundTags")
-}
-
-func (s *SettingService) GetLdapAutoCreate() (bool, error) {
-	return s.getBool("ldapAutoCreate")
-}
-
-func (s *SettingService) GetLdapAutoDelete() (bool, error) {
-	return s.getBool("ldapAutoDelete")
-}
-
-func (s *SettingService) GetLdapDefaultTotalGB() (int, error) {
-	return s.getInt("ldapDefaultTotalGB")
-}
-
-func (s *SettingService) GetLdapDefaultExpiryDays() (int, error) {
-	return s.getInt("ldapDefaultExpiryDays")
-}
-
-func (s *SettingService) GetLdapDefaultLimitIP() (int, error) {
-	return s.getInt("ldapDefaultLimitIP")
-}
-
 // Event bus — per-subscriber event filtering
 
 func (s *SettingService) GetTgEnabledEvents() (string, error) {
@@ -1174,7 +1064,6 @@ func (s *SettingService) SetOutboundDownThreshold(value int) error {
 // blank to the browser) and the stored value is preserved.
 type SecretClears struct {
 	TgBotToken   bool
-	LdapPassword bool
 	SmtpPassword bool
 }
 
@@ -1278,13 +1167,6 @@ func (s *SettingService) preserveRedactedSecrets(allSetting *entity.AllSetting,
 		}
 		allSetting.TgBotToken = value
 	}
-	if !clears.LdapPassword && strings.TrimSpace(allSetting.LdapPassword) == "" {
-		value, err := s.GetLdapPassword()
-		if err != nil {
-			return err
-		}
-		allSetting.LdapPassword = value
-	}
 	if allSetting.TwoFactorEnable && strings.TrimSpace(allSetting.TwoFactorToken) == "" {
 		value, err := s.GetTwoFactorToken()
 		if err != nil {
@@ -1341,7 +1223,7 @@ func validateRemoteRoutingURLSetting(name string, value *string) error {
 
 func (s *SettingService) UpdateSecret(key string, value string) error {
 	switch key {
-	case "tgBotToken", "ldapPassword", "twoFactorToken":
+	case "tgBotToken", "twoFactorToken":
 		return s.saveSetting(key, strings.TrimSpace(value))
 	default:
 		return common.NewError("secret key is not replaceable:", key)
@@ -1476,7 +1358,6 @@ func (s *SettingService) GetDefaultSettings(host string) (any, error) {
 var factoryDefaultSecretKeys = map[string]bool{
 	"tgBotToken":     true,
 	"twoFactorToken": true,
-	"ldapPassword":   true,
 	"smtpPassword":   true,
 }
 

internal/web/service/setting_factory_defaults_test.go

@@ -56,7 +56,6 @@ func TestGetFactoryDefaultsOmitsSensitiveMaterial(t *testing.T) {
 		"xrayTemplateConfig",
 		"tgBotToken",
 		"twoFactorToken",
-		"ldapPassword",
 		"smtpPassword",
 	} {
 		t.Run(key, func(t *testing.T) {