From 02e99277146d8bd912f2f19af1d3e94a6181d90d Mon Sep 17 00:00:00 2001 From: alecdwm Date: Tue, 13 Dec 2016 22:31:35 +0100 Subject: [PATCH] Initial support for LDAP server authentication Limitations as of this commit: - tlsOptions can only be specified in config.json, not as env vars - authentication failures are not yet gracefully handled by the UI - instead the error message is shown on a blank page (/auth/ldap) - no email address is associated with the LDAP user's account - no picture/profile URL is associated with the LDAP user's account - we might have to generate our own access + refresh tokens, because we aren't using oauth. The currently generated tokens are just a placeholder. - 'LDAP Sign in' needs to be translated to each locale --- README.md | 9 +++++++- app.js | 6 +++++ config.json.example | 12 ++++++++++ lib/auth.js | 33 +++++++++++++++++++++++++++- lib/config.js | 26 ++++++++++++++++++++++ lib/response.js | 2 ++ locales/en.json | 3 ++- package.json | 1 + public/views/index.ejs | 5 +++-- public/views/signin-ldap-modal.ejs | 35 ++++++++++++++++++++++++++++++ public/views/signin-modal.ejs | 10 +++++++-- 11 files changed, 135 insertions(+), 7 deletions(-) create mode 100644 public/views/signin-ldap-modal.ejs diff --git a/README.md b/README.md index bdf97ee28..442cbd5cc 100644 --- a/README.md +++ b/README.md @@ -131,6 +131,13 @@ Environment variables (will overwrite other server configs) | HMD_DROPBOX_CLIENTSECRET | no example | Dropbox API client secret | | HMD_GOOGLE_CLIENTID | no example | Google API client id | | HMD_GOOGLE_CLIENTSECRET | no example | Google API client secret | +| HMD_LDAP_URL | ldap://example.com | url of LDAP server | +| HMD_LDAP_BINDDN | no example | bindDn for LDAP access | +| HMD_LDAP_BINDCREDENTIALS | no example | bindCredentials for LDAP access | +| HMD_LDAP_TOKENSECRET | supersecretkey | secret used for generating access/refresh tokens | +| HMD_LDAP_SEARCHBASE | o=users,dc=example,dc=com | LDAP directory to begin search from | +| HMD_LDAP_SEARCHFILTER | (uid={{username}}) | LDAP filter to search with | +| HMD_LDAP_SEARCHATTRIBUTES | no example | LDAP attributes to search with | | HMD_IMGUR_CLIENTID | no example | Imgur API client id | | HMD_EMAIL | `true` or `false` | set to allow email register and signin | | HMD_IMAGE_UPLOAD_TYPE | `imgur`, `s3` or `filesystem` | Where to upload image. For S3, see our [S3 Image Upload Guide](docs/guides/s3-image-upload.md) | @@ -182,7 +189,7 @@ Third-party integration api key settings | service | settings location | description | | ------- | --------- | ----------- | -| facebook, twitter, github, gitlab, dropbox, google | environment variables or `config.json` | for signin | +| facebook, twitter, github, gitlab, dropbox, google, ldap | environment variables or `config.json` | for signin | | imgur | environment variables or `config.json` | for image upload | | google drive, dropbox | `public/js/config.js` | for export and import | diff --git a/app.js b/app.js index 0d78a153e..440549617 100644 --- a/app.js +++ b/app.js @@ -380,6 +380,12 @@ if (config.google) { failureRedirect: config.serverurl + '/' })); } +// ldap auth +if (config.ldap) { + app.post('/auth/ldap', urlencodedParser, + passport.authenticate('ldapauth', { successRedirect: '/' }) + ); +} // email auth if (config.email) { app.post('/register', urlencodedParser, function (req, res, next) { diff --git a/config.json.example b/config.json.example index 22fd5c920..642df4f62 100644 --- a/config.json.example +++ b/config.json.example @@ -45,6 +45,18 @@ "clientID": "change this", "clientSecret": "change this" }, + "ldap": { + "url": "ldap://change_this", + "bindDn": null, + "bindCredentials": null, + "tokenSecret": "change this", + "searchBase": "change this", + "searchFilter": "change this", + "searchAttributes": "change this", + "tlsOptions": { + "changeme": "See https://nodejs.org/api/tls.html#tls_tls_connect_options_callback" + } + }, "imgur": { "clientID": "change this" } diff --git a/lib/auth.js b/lib/auth.js index f167cedea..1e21eb9fd 100644 --- a/lib/auth.js +++ b/lib/auth.js @@ -7,6 +7,7 @@ var GithubStrategy = require('passport-github').Strategy; var GitlabStrategy = require('passport-gitlab2').Strategy; var DropboxStrategy = require('passport-dropbox-oauth2').Strategy; var GoogleStrategy = require('passport-google-oauth20').Strategy; +var LdapStrategy = require('passport-ldapauth'); var LocalStrategy = require('passport-local').Strategy; var validator = require('validator'); @@ -110,6 +111,36 @@ if (config.google) { callbackURL: config.serverurl + '/auth/google/callback' }, callback)); } +// ldap +if (config.ldap) { + passport.use(new LdapStrategy({ + server: { + url: config.ldap.url || null, + bindDn: config.ldap.bindDn || null, + bindCredentials: config.ldap.bindCredentials || null, + searchBase: config.ldap.searchBase || null, + searchFilter: config.ldap.searchFilter || null, + searchAttributes: config.ldap.searchAttributes || null, + tlsOptions: config.ldap.tlsOptions || null + }, + }, + function(user, done) { + var profile = { + id: 'LDAP-' + user.uidNumber, + username: user.uid, + displayName: user.displayName, + emails: [], + avatarUrl: null, + profileUrl: null, + provider: 'ldap', + } + var stringifiedProfile = JSON.stringify(profile); + // TODO: Generate secure tokens for LDAP users + var accessToken = 'debug-access-token|LDAP-' + user.uidNumber + '|' + config.ldap.tokenSecret + '|' + new Date().getTime(); + var refreshToken = 'debug-refresh-token|LDAP-' + user.uidNumber + '|' + config.ldap.tokenSecret + '|' + new Date().getTime(); + callback(accessToken, refreshToken, profile, done); + })); +} // email if (config.email) { passport.use(new LocalStrategy({ @@ -130,4 +161,4 @@ if (config.email) { return done(err); }); })); -} \ No newline at end of file +} diff --git a/lib/config.js b/lib/config.js index 669fcaa8e..a44c279b7 100644 --- a/lib/config.js +++ b/lib/config.js @@ -93,6 +93,31 @@ var google = (process.env.HMD_GOOGLE_CLIENTID && process.env.HMD_GOOGLE_CLIENTSE clientID: process.env.HMD_GOOGLE_CLIENTID, clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET } : config.google || false; +var ldap = config.ldap || ( + process.env.HMD_LDAP_URL || + process.env.HMD_LDAP_BINDDN || + process.env.HMD_LDAP_BINDCREDENTIALS || + process.env.HMD_LDAP_TOKENSECRET || + process.env.HMD_LDAP_SEARCHBASE || + process.env.HMD_LDAP_SEARCHFILTER || + process.env.HMD_LDAP_SEARCHATTRIBUTES +) || false; +if (ldap == true) + ldap = {}; +if (process.env.HMD_LDAP_URL) + ldap.url = process.env.HMD_LDAP_URL; +if (process.env.HMD_LDAP_BINDDN) + ldap.bindDn = process.env.HMD_LDAP_BINDDN; +if (process.env.HMD_LDAP_BINDCREDENTIALS) + ldap.bindCredentials = process.env.HMD_LDAP_BINDCREDENTIALS; +if (process.env.HMD_LDAP_TOKENSECRET) + ldap.tokenSecret = process.env.HMD_LDAP_TOKENSECRET; +if (process.env.HMD_LDAP_SEARCHBASE) + ldap.searchBase = process.env.HMD_LDAP_SEARCHBASE; +if (process.env.HMD_LDAP_SEARCHFILTER) + ldap.searchFilter = process.env.HMD_LDAP_SEARCHFILTER; +if (process.env.HMD_LDAP_SEARCHATTRIBUTES) + ldap.searchAttributes = process.env.HMD_LDAP_SEARCHATTRIBUTES; var imgur = process.env.HMD_IMGUR_CLIENTID || config.imgur || false; var email = process.env.HMD_EMAIL || config.email || false; @@ -151,6 +176,7 @@ module.exports = { gitlab: gitlab, dropbox: dropbox, google: google, + ldap: ldap, imgur: imgur, email: email, imageUploadType: imageUploadType, diff --git a/lib/response.js b/lib/response.js index aae398511..f0f491810 100755 --- a/lib/response.js +++ b/lib/response.js @@ -66,6 +66,7 @@ function showIndex(req, res, next) { gitlab: config.gitlab, dropbox: config.dropbox, google: config.google, + ldap: config.ldap, email: config.email, signin: req.isAuthenticated(), infoMessage: req.flash('info'), @@ -98,6 +99,7 @@ function responseHackMD(res, note) { gitlab: config.gitlab, dropbox: config.dropbox, google: config.google, + ldap: config.ldap, email: config.email }); } diff --git a/locales/en.json b/locales/en.json index f1f0d1408..dda317f17 100644 --- a/locales/en.json +++ b/locales/en.json @@ -100,5 +100,6 @@ "Select From Available Snippets": "Select From Available Snippets", "OR": "OR", "Export to Snippet": "Export to Snippet", - "Select Visibility Level": "Select Visibility Level" + "Select Visibility Level": "Select Visibility Level", + "LDAP Sign in": "LDAP Sign in" } \ No newline at end of file diff --git a/package.json b/package.json index 5203e54bd..4ef103120 100644 --- a/package.json +++ b/package.json @@ -85,6 +85,7 @@ "passport-github": "^1.1.0", "passport-gitlab2": "^2.2.0", "passport-google-oauth20": "^1.0.0", + "passport-ldapauth": "^0.6.0", "passport-local": "^1.0.0", "passport-twitter": "^1.0.4", "passport.socketio": "^3.6.2", diff --git a/public/views/index.ejs b/public/views/index.ejs index 2bec7de05..baca14172 100644 --- a/public/views/index.ejs +++ b/public/views/index.ejs @@ -57,7 +57,7 @@ <% if (errorMessage && errorMessage.length > 0) { %>
<%= errorMessage %>
<% } %> - <% if(facebook || twitter || github || gitlab || dropbox || google || email) { %> + <% if(facebook || twitter || github || gitlab || dropbox || google || ldap || email) { %>
@@ -93,7 +93,7 @@
style="display:none;"<% } %>> - <% if(facebook || twitter || github || gitlab || dropbox || google || email) { %> + <% if(facebook || twitter || github || gitlab || dropbox || google || ldap || email) { %> @@ -192,6 +192,7 @@
<%- include signin-modal %> + <%- include signin-ldap-modal %> <% if(useCDN) { %> diff --git a/public/views/signin-ldap-modal.ejs b/public/views/signin-ldap-modal.ejs new file mode 100644 index 000000000..6a665f174 --- /dev/null +++ b/public/views/signin-ldap-modal.ejs @@ -0,0 +1,35 @@ + + diff --git a/public/views/signin-modal.ejs b/public/views/signin-modal.ejs index acbad256b..ba6c57ff1 100644 --- a/public/views/signin-modal.ejs +++ b/public/views/signin-modal.ejs @@ -38,7 +38,13 @@ <%= __('Sign in via %s', 'Google') %> <% } %> - <% if((facebook || twitter || github || gitlab || dropbox || google) && email) { %> + <% if(ldap) { %> + + <%= __('Sign in via %s', 'LDAP') %> + + <% } %> + + <% if((facebook || twitter || github || gitlab || dropbox || google || ldap) && email) { %>
<% }%> <% if(email) { %> @@ -67,4 +73,4 @@ - \ No newline at end of file +