fix: LDAP sync interval (#304)

Configurable LDAP sync interval for each LDAP provider

README.md

@@ -66,7 +66,6 @@ The following configuration options are available:
 | log_level                       | advanced   | warn                                       | The loglevel, can be one of: trace, debug, info, warn, error.                                                                           |
 | log_pretty                      | advanced   | false                                      | Uses pretty, colorized log messages.                                                                                                    |
 | log_json                        | advanced   | false                                      | Logs in JSON format.                                                                                                                    |
-| ldap_sync_interval              | advanced   | 15m                                        | The time interval after which users will be synchronized from LDAP.                                                                     |
 | start_listen_port               | advanced   | 51820                                      | The first port number that will be used as listening port for new interfaces.                                                           |
 | start_cidr_v4                   | advanced   | 10.11.12.0/24                              | The first IPv4 subnet that will be used for new interfaces.                                                                             |
 | start_cidr_v6                   | advanced   | fdfd:d3ad:c0de:1234::0/64                  | The first IPv6 subnet that will be used for new interfaces.                                                                             |
@@ -127,9 +126,9 @@ The following configuration options are available:
 | field_map                       | auth/ldap  |                                            | Mapping of user fields. Internal fields: user_identifier, email, firstname, lastname, phone, department and memberof.                   |
 | login_filter                    | auth/ldap  |                                            | LDAP filters for users that should be allowed to log in. {{login_identifier}} will be replaced with the login username.                 |
 | admin_group                     | auth/ldap  |                                            | Users in this group are marked as administrators.                                                                                       |
-| synchronize                     | auth/ldap  |                                            | Periodically synchronize users (name, department, phone, status, ...) to the WireGuard Portal database.                                 |
 | disable_missing                 | auth/ldap  |                                            | If synchronization is enabled, missing LDAP users will be disabled in WireGuard Portal.                                                 |
 | sync_filter                     | auth/ldap  |                                            | LDAP filters for users that should be synchronized to WireGuard Portal.                                                                 |
+| sync_interval                   | auth/ldap  |                                            | The time interval after which users will be synchronized from LDAP. Empty value or `0` disables synchronization.                        |
 | registration_enabled            | auth/ldap  |                                            | If registration is enabled, new user accounts will created in WireGuard Portal.                                                         |
 | debug                           | database   | false                                      | Debug database statements (log each statement).                                                                                         |
 | slow_query_threshold            | database   |                                            | A threshold for slow database queries. If the threshold is exceeded, a warning message will be logged.                                  |

internal/app/users/user_manager.go

@@ -26,7 +26,6 @@ type Manager struct {
 	cfg *config.Config
 	bus evbus.MessageBus
 
-	syncInterval time.Duration
 	users UserDatabaseRepo
 	peers PeerDatabaseRepo
 }
@@ -36,7 +35,6 @@ func NewUserManager(cfg *config.Config, bus evbus.MessageBus, users UserDatabase
 		cfg: cfg,
 		bus: bus,
 
-		syncInterval: 10 * time.Second,
 		users: users,
 		peers: peers,
 	}
@@ -311,26 +309,29 @@ func (m Manager) validateDeletion(ctx context.Context, del *domain.User) error {
 }
 
 func (m Manager) runLdapSynchronizationService(ctx context.Context) {
+	for _, ldapCfg := range m.cfg.Auth.Ldap { // LDAP Auth providers
+		go func(cfg config.LdapProvider) {
+			syncInterval := cfg.SyncInterval
+			if syncInterval == 0 {
+				logrus.Debugf("sync disabled for LDAP server: %s", cfg.ProviderName)
+				return
+			}
 			running := true
 			for running {
 				select {
 				case <-ctx.Done():
 					running = false
 					continue
-		case <-time.After(m.syncInterval):
+				case <-time.After(syncInterval * time.Second):
 					// select blocks until one of the cases evaluate to true
 				}
 
-		for _, ldapCfg := range m.cfg.Auth.Ldap { // LDAP Auth providers
+				err := m.synchronizeLdapUsers(ctx, &cfg)
-			if !ldapCfg.Synchronize {
-				continue // sync disabled
-			}
-			//logrus.Tracef(&ldapCfg)
-			err := m.synchronizeLdapUsers(ctx, &ldapCfg)
 				if err != nil {
-				logrus.Errorf("failed to synchronize LDAP users for %s: %v", ldapCfg.ProviderName, err)
+					logrus.Errorf("failed to synchronize LDAP users for %s: %v", cfg.ProviderName, err)
 				}
 			}
+		}(ldapCfg)
 	}
 }
 

internal/config/auth.go

@@ -1,6 +1,8 @@
 package config
 
 import (
+	"time"
+
 	"github.com/go-ldap/ldap/v3"
 )
 
@@ -50,10 +52,10 @@ type LdapProvider struct {
 	AdminGroupDN       string   `yaml:"admin_group"`  // Members of this group receive admin rights in WG-Portal
 	ParsedAdminGroupDN *ldap.DN `yaml:"-"`
 
-	Synchronize bool `yaml:"synchronize"`
 	// If DisableMissing is true, missing users will be deactivated
 	DisableMissing bool          `yaml:"disable_missing"`
 	SyncFilter     string        `yaml:"sync_filter"`
+	SyncInterval   time.Duration `yaml:"sync_interval"`
 
 	// If RegistrationEnabled is set to true, wg-portal will create new users that do not exist in the database.
 	RegistrationEnabled bool `yaml:"registration_enabled"`

internal/config/config.go

@@ -27,7 +27,6 @@ type Config struct {
 		LogLevel            string        `yaml:"log_level"`
 		LogPretty           bool          `yaml:"log_pretty"`
 		LogJson             bool          `yaml:"log_json"`
-		LdapSyncInterval    time.Duration `yaml:"ldap_sync_interval"`
 		StartListenPort     int           `yaml:"start_listen_port"`
 		StartCidrV4         string        `yaml:"start_cidr_v4"`
 		StartCidrV6         string        `yaml:"start_cidr_v6"`