outposts/ldap: cached bind (#2824)

* initial cached ldap bind support

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add web

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* add docs

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* clean up api generation

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

* use gh action for golangci-lint

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

internal/outpost/ldap/bind/memory/memory.go

@@ -0,0 +1,62 @@
+package memory
+
+import (
+	"time"
+
+	ttlcache "github.com/jellydator/ttlcache/v3"
+	"github.com/nmcclain/ldap"
+	log "github.com/sirupsen/logrus"
+	"goauthentik.io/internal/outpost/ldap/bind"
+	"goauthentik.io/internal/outpost/ldap/bind/direct"
+	"goauthentik.io/internal/outpost/ldap/server"
+)
+
+type Credentials struct {
+	DN       string
+	Password string
+}
+
+type SessionBinder struct {
+	direct.DirectBinder
+	si       server.LDAPServerInstance
+	log      *log.Entry
+	sessions *ttlcache.Cache[Credentials, ldap.LDAPResultCode]
+}
+
+func NewSessionBinder(si server.LDAPServerInstance) *SessionBinder {
+	sb := &SessionBinder{
+		DirectBinder: *direct.NewDirectBinder(si),
+		si:           si,
+		log:          log.WithField("logger", "authentik.outpost.ldap.binder.session"),
+		sessions:     ttlcache.New(ttlcache.WithDisableTouchOnHit[Credentials, ldap.LDAPResultCode]()),
+	}
+	go sb.sessions.Start()
+	sb.log.Info("initialised session binder")
+	return sb
+}
+
+func (sb *SessionBinder) Bind(username string, req *bind.Request) (ldap.LDAPResultCode, error) {
+	item := sb.sessions.Get(Credentials{
+		DN:       req.BindDN,
+		Password: req.BindPW,
+	})
+	if item != nil {
+		sb.log.WithField("bindDN", req.BindDN).Info("authenticated from session")
+		return item.Value(), nil
+	}
+	sb.log.Debug("No session found for user, executing flow")
+	result, err := sb.DirectBinder.Bind(username, req)
+	// Only cache the result if there's been an error
+	if err == nil {
+		flags, ok := sb.si.GetFlags(req.BindDN)
+		if !ok {
+			sb.log.Error("user flags not set after bind")
+			return result, err
+		}
+		sb.sessions.Set(Credentials{
+			DN:       req.BindDN,
+			Password: req.BindPW,
+		}, result, time.Duration(flags.Session.MaxAge))
+	}
+	return result, err
+}