vnclagoon/vnctalk-hybridauth
14
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: multi auth

Browse Source
This commit is contained in:
Stefan-Sanger
2020-01-24 06:44:39 +01:00
parent ff4f3bbc1b
commit 513ecfefab
1 changed files with 30 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/app.js
+30 -22
View File
@@ -75,8 +75,15 @@ app.use(logger('dev'));
function IsValidLDAPUser(username) {
return new Promise( function (resolve, reject) {
console.log("[IsValidLDAPUser start] username: ", username);
var uid = username.split("@")[0];
var domain = username.split("@")[1];
var domain = config.domain;
var email = username;
if (username.indexOf("@") > -1) {
domain = username.split("@")[1];
} else {
email = username + "@" + domain;
}
var dcstring = "ou=people,dc=";
if (domain.indexOf(".") > -1 ){
var dcstrings = domain.split(".");
@@ -84,13 +91,16 @@ function IsValidLDAPUser(username) {
dcstring += dcstrings.join(",dc=");
}
}
console.log("uid: ", uid);
console.log("domain: ", domain);
console.log("dc: ", dcstring);
var search_options = { scope : 'sub' };
var _filter = '(&(objectClass=inetOrgPerson)';
if (config.ldap.ldapType === 'zimbra') {
_filter += '(!(zimbraIsSystemResource=TRUE))(!(zimbraIsSystemAccount=TRUE))';
_filter += '(!(objectClass=zimbraDistributionList))(!(objectClass=zimbraCalendarResource))';
_filter += '(&(zimbraAccountStatus=active))(&(zimbraMailStatus=enabled))';
_filter += '(|(uid=' + uid + ')(mail=' + username + ')))';
_filter += '(|(uid=' + uid + ')(mail=' + email + ')))';
search_options.filter = _filter;
// search_options.attributes = ['uid', 'mail', 'givenName', 'sn', 'displayName', 'zimbraAccountStatus'];
search_options.attributes = ['uid', 'mail', 'zimbraAccountStatus', 'givenName', 'sn', 'displayName', 'title', 'telephoneNumber', 'l', 'street', 'postalCode', 'co'];
@@ -171,6 +181,7 @@ function IsValidLDAPAuth(username, password) {
console.error(moment().format("LTS") + " [profile ldap] unsupported config.ldap.ldapType : '"+config.ldap.ldapType+"'");
resolve(false);
}
console.log("LDAP Auth - UID DN: ", uiddn);
ldap.bind( uiddn, password,
err => {
if (err) {
@@ -215,19 +226,12 @@ function IsValidRedmineUser(username) {
var query = ""
var queryparams = [];
queryparams[0] = uid;
queryparams[1] = "api";
queryparams[2] = username;
// var query = "SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn FROM users WHERE users.status=1 AND users.login=$1";
var query = "SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn, email_addresses.address AS mail, ";
query += "tokens.value AS RedmineAPIKey FROM users, tokens, email_addresses WHERE users.status=1 AND tokens.user_id = users.id ";
query += "AND tokens.action=$2 AND email_addresses.user_id = users.id AND (users.login=$1 or users.login=$3)";
var query = "SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn FROM users WHERE users.status=1 AND users.login=$1";
// var query = "select SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn, users.login||\'@talk.vnc.de\' AS mail FROM users WHERE users.status=1 AND users.login=$1 AND substring(users.hashed_password, 0, length(users.hashed_password)+1) = encode(digest(users.salt||encode(digest(:password, \'sha1\'), \'hex\'), \'sha1\'), \'hex\')";
dbpool.query(query, queryparams, function (derr, dres) {
if (derr == null) {
if (dres.rowCount > 0) {
resolve(dres.rows[0]);
resolve(true);
} else {
resolve(false);
}
@@ -250,11 +254,9 @@ function IsValidRedmineAuth(username, password) {
queryparams[1] = password;
queryparams[2] = "sha1";
queryparams[3] = "hex";
queryparams[4] = username;
var query = "SELECT DISTINCT ON (uid) users.login AS uid, users.firstname AS givenName, users.lastname AS sn FROM users ";
query += "WHERE users.status=1 AND (users.login=$1 or users.login=$5) AND substring(users.hashed_password, 0, length(users.hashed_password)+1) = encode(digest(users.salt||encode(digest($2, $3), $4), $3), $4)";
query += "WHERE users.status=1 AND users.login=$1 AND substring(users.hashed_password, 0, length(users.hashed_password)+1) = encode(digest(users.salt||encode(digest($2, $3), $4), $3), $4)";
dbpool.query(query, queryparams, function (derr, dres) {
if (derr == null) {
if (dres.rowCount > 0) {
@@ -353,11 +355,7 @@ app.get('/', async function (req, res) {
}
}
if (config.useRedmineAuth) {
let redmineProfile = await IsValidRedmineUser(username);
var validRedmineUser = false;
if (redmineProfile) {
validRedmineUser = true;
}
let validRedmineUser = await IsValidRedmineUser(username);
console.log(moment().format("LTS") + ' username ' + username +' - IsValidRedmineUser: ', validRedmineUser);
console.log(moment().format("LTS") + ' username ' + username +' - password: ', password);
console.log(moment().format("LTS") + ' username ' + username +' - indesxforOldToken: ', password.indexOf("-"));
@@ -367,7 +365,7 @@ app.get('/', async function (req, res) {
console.log("IsValidOldSecret: ", IsValidOldSecret(username, password));
console.log("IsValidJWT: ", IsValidJWT(username, password));
if (validRedmineUser && (validRedmineAuth || IsValidOldSecret(username, password) || IsValidJWT(username, password))) {
res.status(200).json(redmineProfile);
res.status(200).json(null);
} else {
res.status(401).json(null);
}
@@ -388,6 +386,8 @@ app.get('/', async function (req, res) {
let userProfile = await IsValidLDAPUser(username);
let projectApiKey = await getProjectApiKey(username);
let validLdapUser = false;
let userLdapName = username;
console.log("got profile: ", userProfile);
if (userProfile) {
validLdapUser = true;
}
@@ -402,6 +402,13 @@ app.get('/', async function (req, res) {
}
if (userProfile.email && (userProfile.email != null)) {
finalProfile["email"] = getFirstElement(userProfile.email);
userLdapName = getFirstElement(userProfile.email);
console.log("using for LDAP: ", userLdapName);
}
if (userProfile.mail && (userProfile.mail != null)) {
finalProfile["email"] = getFirstElement(userProfile.email);
userLdapName = getFirstElement(userProfile.mail);
console.log("using for LDAP: ", userLdapName);
}
if (userProfile.displayName && (userProfile.displayName != null)) {
finalProfile["displayName"] = getFirstElement(userProfile.displayName);
@@ -413,7 +420,8 @@ app.get('/', async function (req, res) {
console.log(moment().format("LTS") + ' username ' + username +' - password: ', password);
console.log(moment().format("LTS") + ' username ' + username +' - indesxforOldToken: ', password.indexOf("-"));
if (validLdapUser === true) {
let validLdapAuth = await IsValidLDAPAuth(username, password);
// let validLdapAuth = await IsValidLDAPAuth(username, password);
let validLdapAuth = await IsValidLDAPAuth(userLdapName, password);
if (validLdapUser && (validLdapAuth || IsValidOldSecret(username, password) || IsValidJWT(username, password))) {
// if (IsValidOldSecret(username, password) || IsValidJWT(username, password)) {