# ldap_server_sim.py - Simulated LDAP authentication server
from flask import Flask, request, jsonify

app = Flask(__name__)

# Fake user database
USERS = {
    'admin': {'password': 'secret', 'role': 'admin'},
    'user': {'password': 'pass', 'role': 'user'}
}

def ldap_search(username, password):
    # Simulate an LDAP filter injection: user-controlled username goes directly into filter
    # Real LDAP query: (&(uid={username})(userPassword={password}))
    # Here we just simulate: if the username contains wildcard, it may bypass.
    if '*' in username:
        # Vulnerability: filter becomes (uid=*) which matches any user
        # We'll return the first matching user (admin)
        return USERS.get('admin')
    return USERS.get(username)

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    user = ldap_search(username, password)
    if user and user['password'] == password:
        return jsonify({"message": "Authenticated", "role": user['role']})
    return jsonify({"message": "Invalid"}), 401

if __name__ == '__main__':
    app.run(port=5000)