|
@@ -112,6 +112,49 @@ class PassportService {
|
|
|
|
|
|
|
|
debug('LdapStrategy: setting up..');
|
|
debug('LdapStrategy: setting up..');
|
|
|
|
|
|
|
|
|
|
+ passport.use(new LdapStrategy(this.getLdapConfigurationFunc(config, {passReqToCallback: true}),
|
|
|
|
|
+ (req, ldapAccountInfo, done) => {
|
|
|
|
|
+ debug("LDAP authentication has succeeded", ldapAccountInfo);
|
|
|
|
|
+
|
|
|
|
|
+ // it is guaranteed that username can be acquired
|
|
|
|
|
+ // because this processes after authentication
|
|
|
|
|
+ const ldapAccountId = this.getLdapAccountIdFromReq(req);
|
|
|
|
|
+
|
|
|
|
|
+ this.findOrRegisterUserByLdapInfo(ldapAccountId, ldapAccountInfo)
|
|
|
|
|
+ .then((user) => {
|
|
|
|
|
+ done(null, user);
|
|
|
|
|
+ })
|
|
|
|
|
+ .catch((err) => {
|
|
|
|
|
+ done(null, false, { message: err });
|
|
|
|
|
+ });
|
|
|
|
|
+ }
|
|
|
|
|
+ ));
|
|
|
|
|
+
|
|
|
|
|
+ this.isLdapStrategySetup = true;
|
|
|
|
|
+ debug('LdapStrategy: setup is done');
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
|
|
+ /**
|
|
|
|
|
+ * CAUTION: this method is capable to use only when `req.body.loginForm` is not null
|
|
|
|
|
+ *
|
|
|
|
|
+ * @param {any} req
|
|
|
|
|
+ * @returns
|
|
|
|
|
+ * @memberof PassportService
|
|
|
|
|
+ */
|
|
|
|
|
+ getLdapAccountIdFromReq(req) {
|
|
|
|
|
+ return req.body.loginForm.username;
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
|
|
+ /**
|
|
|
|
|
+ * Asynchronous configuration retrieval
|
|
|
|
|
+ * @see https://github.com/vesse/passport-ldapauth#asynchronous-configuration-retrieval
|
|
|
|
|
+ *
|
|
|
|
|
+ * @param {object} config
|
|
|
|
|
+ * @param {object} opts
|
|
|
|
|
+ * @returns
|
|
|
|
|
+ * @memberof PassportService
|
|
|
|
|
+ */
|
|
|
|
|
+ getLdapConfigurationFunc(config, opts) {
|
|
|
// get configurations
|
|
// get configurations
|
|
|
const isUserBind = config.crowi['security:passport-ldap:isUserBind'];
|
|
const isUserBind = config.crowi['security:passport-ldap:isUserBind'];
|
|
|
const serverUrl = config.crowi['security:passport-ldap:serverUrl'];
|
|
const serverUrl = config.crowi['security:passport-ldap:serverUrl'];
|
|
@@ -138,52 +181,29 @@ class PassportService {
|
|
|
}
|
|
}
|
|
|
debug(`LdapStrategy: searchFilter=${searchFilter}`);
|
|
debug(`LdapStrategy: searchFilter=${searchFilter}`);
|
|
|
|
|
|
|
|
- // Asynchronous configuration retrieval
|
|
|
|
|
- const getLDAPConfiguration = (req, callback) => {
|
|
|
|
|
|
|
+ return (req, callback) => {
|
|
|
// get credentials from form data
|
|
// get credentials from form data
|
|
|
const loginForm = req.body.loginForm;
|
|
const loginForm = req.body.loginForm;
|
|
|
if (!req.form.isValid) {
|
|
if (!req.form.isValid) {
|
|
|
return callback({ message: 'Incorrect credentials.' });
|
|
return callback({ message: 'Incorrect credentials.' });
|
|
|
}
|
|
}
|
|
|
- const ldapAccountId = loginForm.username;
|
|
|
|
|
- const password = loginForm.password;
|
|
|
|
|
|
|
|
|
|
// user bind
|
|
// user bind
|
|
|
if (isUserBind) {
|
|
if (isUserBind) {
|
|
|
- bindDN = bindDN.replace(/{{username}}/, ldapAccountId);
|
|
|
|
|
- bindCredentials = password;
|
|
|
|
|
|
|
+ bindDN = bindDN.replace(/{{username}}/, loginForm.username);
|
|
|
|
|
+ bindCredentials = loginForm.password;
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
process.nextTick(() => {
|
|
process.nextTick(() => {
|
|
|
- const opts = {
|
|
|
|
|
|
|
+ const mergedOpts = Object.assign({
|
|
|
usernameField: PassportService.USERNAME_FIELD,
|
|
usernameField: PassportService.USERNAME_FIELD,
|
|
|
passwordField: PassportService.PASSWORD_FIELD,
|
|
passwordField: PassportService.PASSWORD_FIELD,
|
|
|
server: { url, bindDN, bindCredentials, searchBase, searchFilter },
|
|
server: { url, bindDN, bindCredentials, searchBase, searchFilter },
|
|
|
- passReqToCallback: true,
|
|
|
|
|
- };
|
|
|
|
|
- debug('ldap configuration: ', opts);
|
|
|
|
|
- callback(null, opts);
|
|
|
|
|
|
|
+ }, opts);
|
|
|
|
|
+ debug('ldap configuration: ', mergedOpts);
|
|
|
|
|
+ callback(null, mergedOpts);
|
|
|
});
|
|
});
|
|
|
};
|
|
};
|
|
|
-
|
|
|
|
|
- passport.use(new LdapStrategy(getLDAPConfiguration,
|
|
|
|
|
- (req, ldapAccountInfo, done) => {
|
|
|
|
|
- debug("LDAP authentication has successed", ldapAccountInfo);
|
|
|
|
|
-
|
|
|
|
|
- const ldapAccountId = req.body.loginForm.username;
|
|
|
|
|
-
|
|
|
|
|
- this.findOrRegisterUserByLdapInfo(ldapAccountId, ldapAccountInfo)
|
|
|
|
|
- .then((user) => {
|
|
|
|
|
- done(null, user);
|
|
|
|
|
- })
|
|
|
|
|
- .catch((err) => {
|
|
|
|
|
- done(null, false, { message: err });
|
|
|
|
|
- });
|
|
|
|
|
- }
|
|
|
|
|
- ));
|
|
|
|
|
-
|
|
|
|
|
- this.isLdapStrategySetup = true;
|
|
|
|
|
- debug('LdapStrategy: setup is done');
|
|
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
/**
|