auth/ldap/LdapProvider.js

  1. /**
  2.  * @module flitter-auth/ldap/LdapProvider
  3.  */
  5. const Provider = require('../Provider')
  6. const AsyncLdapConnection = require('./AsyncLdapConnection')
  7. const ldap = require('ldap')
  9. /**
  10.  * LDAP authentication provider for flitter-auth.
  11.  * @extends {module:flitter-auth/Provider~Provider}
  12.  * @type {module:flitter-auth/Provider~Provider}
  13.  */
  14. class LdapProvider extends Provider {
  16.     constructor(app, config) {
  17.         super(app, config)
  19.         // Create the LDAP connection
  20.         /**
  21.          * The LDAP connection string in the format 'ldap://...'.
  22.          * @type {string}
  23.          */
  24.         this.connect_string = `ldap${config.secure ? 's' : ''}://${config.host}${config.port ? ':'+config.port : ''}`
  26.         const client = ldap.createClient({url: this.connect_string})
  28.         /**
  29.          * The async LDAP connection.
  30.          * @type {module:flitter-auth/ldap/AsyncLdapConnection~AsyncLdapConnection}
  31.          */
  32.         this.connection = new AsyncLdapConnection(client)
  33.     }
  35.     /**
  36.      * Get an LDAP connection bound to the configured DN.
  37.      * @returns {Promise<ldap/Client>}
  38.      */
  39.     async ldap(){
  40.         return this.connection.bind(this.config.bind_dn, this.config.bind_secret, [])
  41.     }
  43.     /**
  44.      * Build the user search filter string. Replaces all instances of '%u' with uid.
  45.      * @param {string} uid - uid to be interpolated
  46.      * @returns {string}
  47.      */
  48.     user_filter(uid){
  49.         let user_filter = this.config.user_filter
  50.         if ( !user_filter.startsWith('(') ) user_filter = `(${userfilter}`
  51.         if ( !user_filter.endsWith(')') ) user_filter = `${userfilter})`
  53.         return user_filter.replace(/%u/g, uid)
  54.     }
  56.     /**
  57.      * Get an array of user data records matched by the configured filter from the LDAP server.
  58.      * @returns {Promise<Array<Object>>}
  59.      */
  60.     async get_users(){
  61.         const ldap = await this.ldap()
  62.         return ldap.search(this.config.user_search_base, this.user_filter('*'), Object.values(this.config.attributes));
  63.     }
  65.     /**
  66.      * Get the user data record for the specified user uid matched by the configured filter from the LDAP server.
  67.      * @param {string} uid - the user's username
  68.      * @returns {Promise<Object|undefined>} - undefined if no user is found with uid
  69.      */
  70.     async get_user(uid){
  71.         const ldap = await this.ldap()
  72.         const matches = await ldap.search(this.config.user_search_base, this.user_filter(uid), Object.values(this.config.attributes))
  73.         if ( matches.length > 0 ) return matches[0]
  74.     }
  76.     /**
  77.      * Given the user data record from the LDAP server, either look up or create an instance of this.User.
  78.      * Store the raw LDAP data in User.data.ldap (as JSON), and update roles where necessary.
  79.      * @param {object} data - the data from the LDAP server
  80.      * @returns {Promise<module:flitter-auth/model/User~User>}
  81.      */
  82.     async get_user_object(data){
  83.         const User = this.User
  84.         const uid = data[this.config.attributes.uid]
  86.         const match = await User.findOne({ uid, provider: this.config.name })
  87.         if ( match ){
  88.             const json = JSON.parse(match.data)
  89.             json.ldap = data
  90.             match.data = JSON.stringify(json)
  91.             await this.set_user_roles(data, match)
  92.             await this.set_user_data(data, match)
  93.             return match
  94.         }
  96.         const user = new User({
  97.             uid,
  98.             provider: this.config.name,
  99.             data: JSON.stringify({
  100.                 ldap: data,
  101.             }),
  102.         })
  104.         await this.set_user_roles(data, user)
  105.         await this.set_user_data(data, user)
  106.         return user
  107.     }
  109.     /**
  110.      * Update user data from the LDAP record based on model-attribute to ldap-attribute
  111.      * mappings in the config (config key: attributes).
  112.      * @param {object} data - the user's LDAP data
  113.      * @param {module:flitter-auth/model/User~User} user - the user to be updated
  114.      * @returns {Promise<void>}
  115.      */
  116.     async set_user_data(data, user) {
  117.         const exclude_attributes = ['group_membership']
  119.         for ( const attr in this.config.attributes ) {
  120.             if ( Object.keys(data).includes(this.config.attributes[attr]) && !(exclude_attributes.includes(attr)) ) {
  121.                 user[attr] = data[this.config.attributes[attr]]
  122.             }
  123.         }
  125.         await user.save()
  126.     }
  128.     /**
  129.      * Update the user's auth roles based on the role/group mappings from config. Uses the configured group_membership attribute.
  130.      * @param {object} data - user's data record from the LDAP server
  131.      * @param {module:flitter-auth/model/User~User} user - the user to be updated
  132.      * @returns {Promise<void>}
  133.      */
  134.     async set_user_roles(data, user) {
  135.         let user_roles
  136.         if ( !data[this.config.attributes.group_membership] ) user_roles = []
  137.         else if ( Array.isArray(data[this.config.attributes.group_membership]) ) user_roles = data[this.config.attributes.group_membership]
  138.         else user_roles = [data[this.config.attributes.group_membership]]
  140.         for ( let role in this.config.role_groups ){
  141.             if ( user_roles.includes(this.config.role_groups[role]) ) user.promote(role)
  142.             else user.demote(role)
  143.         }
  145.         await user.save()
  146.     }
  148.     /**
  149.      * Convert a uid string to a fully qualified DN based on the configured user search base.
  150.      * @param {string} uid
  151.      * @returns {string} - fully qualified DN of the user
  152.      */
  153.     uid_to_dn(uid){
  154.         return `uid=${uid},${this.config.user_search_base}`
  155.     }
  157.     /**
  158.      * Register a new user with the specified username and attributes.
  159.      * Attributes object should contain a 'password' key, which will be removed and used to set the user's LDAP password.
  160.      * @param {string} username - uid of the new user
  161.      * @param {object} attrs - additional attributes of the user
  162.      * @param {object} [data] - additional data to be stored in the user's JSON
  163.      * @returns {Promise<module:flitter-auth/model/User~User>}
  164.      */
  165.     async register(username, attrs, data) {
  166.         const entry = {
  167.             uid: username,
  168.         }
  170.         if ( this.config.registration_merge_attributes ){
  171.             Object.keys(this.config.registration_merge_attributes).forEach((attr) => {
  172.                 if ( typeof this.config.registration_merge_attributes[attr] === 'string' ){
  173.                     entry[attr] = this.config.registration_merge_attributes[attr].replace(/%u/g, username)
  174.                 }
  175.                 else entry[attr] = this.config.registration_merge_attributes[attr]
  176.             })
  177.         }
  179.         await this.connection.add(this.uid_to_dn(username), entry)
  180.         await this.connection.password_reset(this.uid_to_dn(username), attrs.password)
  182.         const user_data = await this.get_user(username)
  183.         const user = await this.get_user_object(user_data)
  184.         if ( data ) user.data = JSON.stringify({...JSON.parse(user.data), ...data})
  186.         Object.keys(attrs).filter(i => i !== 'password').forEach(key => user[key] = attrs[key])
  187.         await user.save()
  188.         return user
  189.     }
  191.     /**
  192.      * Ensure that registration form_data is valid. Checks for password and unique username.
  193.      * @param {object} form_data
  194.      * @returns {Promise<Array<string>>} - array of string errors. If empty array, no errors.
  195.      */
  196.     async validate_registration(form_data){
  197.         const errors = await super.validate_registration(form_data)
  198.         const min_pw_length = this.config.min_password_length
  200.         if ( !Object.keys(form_data).includes('password') || !form_data.password ){
  201.             errors.push('Password field is required.')
  202.         }
  203.         else if ( form_data.password.length < min_pw_length ){
  204.             errors.push(`Password must be at least ${min_pw_length} characters long.`)
  205.         }
  207.         if ( form_data.username ) {
  208.             const user = await this.get_user(form_data.username)
  209.             if ( user ) errors.push('User already exists with that username.')
  210.         }
  212.         return errors
  213.     }
  215.     /**
  216.      * From the form data, get the formatted arguments to be passed into the registration function.
  217.      * Should create the username and {password} objects.
  218.      * @param {object} form_data
  219.      * @returns {Promise<Array<*>>}
  220.      */
  221.     async get_registration_args(form_data){
  222.         return [
  223.             form_data.username,
  224.             {
  225.                 password: form_data.password,
  226.             }
  227.         ]
  228.     }
  230.     /**
  231.      * Attempt to authenticate a user with the provided credentials. If it succeeds, return their User object.
  232.      * @param {string} username
  233.      * @param {string} password
  234.      * @param [args] - not required
  235.      * @returns {Promise<boolean|module:flitter-auth/model/User~User>} - false if the auth is unsuccessful, a User instance if it is
  236.      */
  237.     async login(username, password, args = {}){
  238.         const data = await this.get_user(username)
  239.         if ( !data ) return false
  241.         const success = await this.connection.password_check(data.dn, password)
  242.         if ( !success ) return false
  244.         let user = await this.get_user_object(data)
  245.         if ( user.block_login ) return false
  247.         user.last_auth = new Date()
  248.         await user.save()
  249.         return user
  250.     }
  252.     /**
  253.      * Check the validity of the provided credentials.
  254.      * @param {string} user
  255.      * @param {string} password
  256.      * @returns {Promise<boolean>} - true if the credentials succeed, false otherwise
  257.      */
  258.     async check_user_auth(user, password){
  259.         const data = await this.get_user(user)
  260.         const ldap = await this.ldap()
  261.         return await ldap.password_check(data.dn, password)
  262.     }
  264.     /**
  265.      * Clean up resources used by this provider. Unbinds all open LDAP connections.
  266.      * @param {module:libflitter/app/FlitterApp~FlitterApp} app - the current app
  267.      * @returns {Promise<void>}
  268.      */
  269.     async cleanup(app){
  270.         this.connection.connection.unbind()
  271.     }
  273. }
  275. module.exports = exports = LdapProvider
JAVASCRIPT
Copied!