diff --git a/README.md b/README.md index a2980ee48..7040aeb34 100644 --- a/README.md +++ b/README.md @@ -140,6 +140,14 @@ Environment variables (will overwrite other server configs) | HMD_DROPBOX_CLIENTSECRET | no example | Dropbox API client secret | | HMD_GOOGLE_CLIENTID | no example | Google API client id | | HMD_GOOGLE_CLIENTSECRET | no example | Google API client secret | +| HMD_LDAP_URL | ldap://example.com | url of LDAP server | +| HMD_LDAP_BINDDN | no example | bindDn for LDAP access | +| HMD_LDAP_BINDCREDENTIALS | no example | bindCredentials for LDAP access | +| HMD_LDAP_TOKENSECRET | supersecretkey | secret used for generating access/refresh tokens | +| HMD_LDAP_SEARCHBASE | o=users,dc=example,dc=com | LDAP directory to begin search from | +| HMD_LDAP_SEARCHFILTER | (uid={{username}}) | LDAP filter to search with | +| HMD_LDAP_SEARCHATTRIBUTES | no example | LDAP attributes to search with | +| HMD_LDAP_TLS_CA | no example | Root CA for LDAP TLS in PEM format | | HMD_IMGUR_CLIENTID | no example | Imgur API client id | | HMD_EMAIL | `true` or `false` | set to allow email register and signin | | HMD_IMAGE_UPLOAD_TYPE | `imgur`, `s3` or `filesystem` | Where to upload image. For S3, see our [S3 Image Upload Guide](docs/guides/s3-image-upload.md) | @@ -194,7 +202,7 @@ Third-party integration api key settings | service | settings location | description | | ------- | --------- | ----------- | -| facebook, twitter, github, gitlab, dropbox, google | environment variables or `config.json` | for signin | +| facebook, twitter, github, gitlab, dropbox, google, ldap | environment variables or `config.json` | for signin | | imgur | environment variables or `config.json` | for image upload | | google drive, dropbox | `public/js/config.js` | for export and import | diff --git a/app.js b/app.js index f096ab64e..a17d3a614 100644 --- a/app.js +++ b/app.js @@ -381,6 +381,18 @@ if (config.google) { failureRedirect: config.serverurl + '/' })); } +// ldap auth +if (config.ldap) { + app.post('/auth/ldap', urlencodedParser, function (req, res, next) { + if (!req.body.username || !req.body.password) return response.errorBadRequest(res); + setReturnToFromReferer(req); + passport.authenticate('ldapauth', { + successReturnToOrRedirect: config.serverurl + '/', + failureRedirect: config.serverurl + '/', + failureFlash: true + })(req, res, next); + }); +} // email auth if (config.email) { app.post('/register', urlencodedParser, function (req, res, next) { diff --git a/config.json.example b/config.json.example index e5e3fc56c..57669cf94 100644 --- a/config.json.example +++ b/config.json.example @@ -51,6 +51,18 @@ "clientID": "change this", "clientSecret": "change this" }, + "ldap": { + "url": "ldap://change_this", + "bindDn": null, + "bindCredentials": null, + "tokenSecret": "change this", + "searchBase": "change this", + "searchFilter": "change this", + "searchAttributes": "change this", + "tlsOptions": { + "changeme": "See https://nodejs.org/api/tls.html#tls_tls_connect_options_callback" + } + }, "imgur": { "clientID": "change this" } diff --git a/lib/auth.js b/lib/auth.js index f167cedea..4b14e42ca 100644 --- a/lib/auth.js +++ b/lib/auth.js @@ -7,6 +7,7 @@ var GithubStrategy = require('passport-github').Strategy; var GitlabStrategy = require('passport-gitlab2').Strategy; var DropboxStrategy = require('passport-dropbox-oauth2').Strategy; var GoogleStrategy = require('passport-google-oauth20').Strategy; +var LdapStrategy = require('passport-ldapauth'); var LocalStrategy = require('passport-local').Strategy; var validator = require('validator'); @@ -110,6 +111,62 @@ if (config.google) { callbackURL: config.serverurl + '/auth/google/callback' }, callback)); } +// ldap +if (config.ldap) { + passport.use(new LdapStrategy({ + server: { + url: config.ldap.url || null, + bindDn: config.ldap.bindDn || null, + bindCredentials: config.ldap.bindCredentials || null, + searchBase: config.ldap.searchBase || null, + searchFilter: config.ldap.searchFilter || null, + searchAttributes: config.ldap.searchAttributes || null, + tlsOptions: config.ldap.tlsOptions || null + }, + }, + function(user, done) { + var profile = { + id: 'LDAP-' + user.uidNumber, + username: user.uid, + displayName: user.displayName, + emails: user.mail ? [user.mail] : [], + avatarUrl: null, + profileUrl: null, + provider: 'ldap', + } + var stringifiedProfile = JSON.stringify(profile); + models.User.findOrCreate({ + where: { + profileid: profile.id.toString() + }, + defaults: { + profile: stringifiedProfile, + } + }).spread(function (user, created) { + if (user) { + var needSave = false; + if (user.profile != stringifiedProfile) { + user.profile = stringifiedProfile; + needSave = true; + } + if (needSave) { + user.save().then(function () { + if (config.debug) + logger.info('user login: ' + user.id); + return done(null, user); + }); + } else { + if (config.debug) + logger.info('user login: ' + user.id); + return done(null, user); + } + } + }).catch(function (err) { + logger.error('ldap auth failed: ' + err); + return done(err, null); + }); + })); +} // email if (config.email) { passport.use(new LocalStrategy({ @@ -130,4 +187,4 @@ if (config.email) { return done(err); }); })); -} \ No newline at end of file +} diff --git a/lib/config.js b/lib/config.js index 53497f1f8..2f6792b71 100644 --- a/lib/config.js +++ b/lib/config.js @@ -95,6 +95,37 @@ var google = (process.env.HMD_GOOGLE_CLIENTID && process.env.HMD_GOOGLE_CLIENTSE clientID: process.env.HMD_GOOGLE_CLIENTID, clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET } : config.google || false; +var ldap = config.ldap || ( + process.env.HMD_LDAP_URL || + process.env.HMD_LDAP_BINDDN || + process.env.HMD_LDAP_BINDCREDENTIALS || + process.env.HMD_LDAP_TOKENSECRET || + process.env.HMD_LDAP_SEARCHBASE || + process.env.HMD_LDAP_SEARCHFILTER || + process.env.HMD_LDAP_SEARCHATTRIBUTES +) || false; +if (ldap == true) + ldap = {}; +if (process.env.HMD_LDAP_URL) + ldap.url = process.env.HMD_LDAP_URL; +if (process.env.HMD_LDAP_BINDDN) + ldap.bindDn = process.env.HMD_LDAP_BINDDN; +if (process.env.HMD_LDAP_BINDCREDENTIALS) + ldap.bindCredentials = process.env.HMD_LDAP_BINDCREDENTIALS; +if (process.env.HMD_LDAP_TOKENSECRET) + ldap.tokenSecret = process.env.HMD_LDAP_TOKENSECRET; +if (process.env.HMD_LDAP_SEARCHBASE) + ldap.searchBase = process.env.HMD_LDAP_SEARCHBASE; +if (process.env.HMD_LDAP_SEARCHFILTER) + ldap.searchFilter = process.env.HMD_LDAP_SEARCHFILTER; +if (process.env.HMD_LDAP_SEARCHATTRIBUTES) + ldap.searchAttributes = process.env.HMD_LDAP_SEARCHATTRIBUTES; +if (process.env.HMD_LDAP_TLS_CA) { + var ca = { + ca: process.env.HMD_LDAP_TLS_CA + } + ldap.tlsOptions = ldap.tlsOptions ? Object.assign(ldap.tlsOptions, ca) : ca +} var imgur = process.env.HMD_IMGUR_CLIENTID || config.imgur || false; var email = process.env.HMD_EMAIL ? (process.env.HMD_EMAIL === 'true') : !!config.email; @@ -156,6 +187,7 @@ module.exports = { gitlab: gitlab, dropbox: dropbox, google: google, + ldap: ldap, imgur: imgur, email: email, imageUploadType: imageUploadType, diff --git a/lib/letter-avatars.js b/lib/letter-avatars.js new file mode 100644 index 000000000..3afa03fe1 --- /dev/null +++ b/lib/letter-avatars.js @@ -0,0 +1,25 @@ +"use strict"; + +// external modules +var randomcolor = require('randomcolor'); + +// core +module.exports = function(name) { + var color = randomcolor({ + seed: name, + luminosity: 'dark' + }); + var letter = name.substring(0, 1).toUpperCase(); + + var svg = ''; + svg += ''; + + return 'data:image/svg+xml;base64,' + new Buffer(svg).toString('base64'); +}; diff --git a/lib/models/user.js b/lib/models/user.js index aaf344dec..7d27242cf 100644 --- a/lib/models/user.js +++ b/lib/models/user.js @@ -7,6 +7,7 @@ var scrypt = require('scrypt'); // core var logger = require("../logger.js"); +var letterAvatars = require('../letter-avatars.js'); module.exports = function (sequelize, DataTypes) { var User = sequelize.define("User", { @@ -105,6 +106,16 @@ module.exports = function (sequelize, DataTypes) { case "google": photo = profile.photos[0].value.replace(/(\?sz=)\d*$/i, '$196'); break; + case "ldap": + //no image api provided, + //use gravatar if email exists, + //otherwise generate a letter avatar + if (profile.emails[0]) { + photo = 'https://www.gravatar.com/avatar/' + md5(profile.emails[0]) + '?s=96'; + } else { + photo = letterAvatars(profile.username); + } + break; } return photo; }, diff --git a/lib/response.js b/lib/response.js index a0dc8b1f2..cedee3de6 100755 --- a/lib/response.js +++ b/lib/response.js @@ -66,6 +66,7 @@ function showIndex(req, res, next) { gitlab: config.gitlab, dropbox: config.dropbox, google: config.google, + ldap: config.ldap, email: config.email, signin: req.isAuthenticated(), infoMessage: req.flash('info'), @@ -94,6 +95,7 @@ function responseHackMD(res, note) { gitlab: config.gitlab, dropbox: config.dropbox, google: config.google, + ldap: config.ldap, email: config.email }); } diff --git a/package.json b/package.json index 7fb035abf..a13ac9792 100644 --- a/package.json +++ b/package.json @@ -85,6 +85,7 @@ "passport-github": "^1.1.0", "passport-gitlab2": "^2.2.0", "passport-google-oauth20": "^1.0.0", + "passport-ldapauth": "^0.6.0", "passport-local": "^1.0.0", "passport-twitter": "^1.0.4", "passport.socketio": "^3.7.0", diff --git a/public/views/index.ejs b/public/views/index.ejs index f8eaeaa83..55c13d2d6 100644 --- a/public/views/index.ejs +++ b/public/views/index.ejs @@ -57,7 +57,7 @@ <% if (errorMessage && errorMessage.length > 0) { %>
<%= __('Below is the history from browser') %>