From c22b99f8646c090e9db4e9ed814a7de9c8f422e8 Mon Sep 17 00:00:00 2001 From: dm Date: Mon, 15 Feb 2021 17:54:14 +0100 Subject: [PATCH] add passport-ldap --- package.json | 1 + routes/api/passport-ldap.js | 88 ++++++++++++++++++++++++++++++++++++ spacedeck.js | 2 +- yarn.lock | 90 +++++++++++++++++++++++++++++++++++-- 4 files changed, 176 insertions(+), 5 deletions(-) create mode 100644 routes/api/passport-ldap.js diff --git a/package.json b/package.json index 24581c59..0d1ee826 100644 --- a/package.json +++ b/package.json @@ -36,6 +36,7 @@ "node-server-screenshot": "^0.2.1", "nodemailer": "^4.6.7", "passport": "^0.4.1", + "passport-ldapauth": "^3.0.1", "passport-local": "^1.0.0", "phantomjs-prebuilt": "^2.1.16", "read-chunk": "^2.1.0", diff --git a/routes/api/passport-ldap.js b/routes/api/passport-ldap.js new file mode 100644 index 00000000..30f3c013 --- /dev/null +++ b/routes/api/passport-ldap.js @@ -0,0 +1,88 @@ +"use strict"; + +var express = require('express'); +var router = express.Router(); + +var config = require('config'); +var crypto = require('crypto'); +const db = require('../../models/db'); + + +var passport = require('passport') + , LdapStrategy = require('passport-ldapauth'); + +var opts = { + server: { + url: 'ldaps://ad.corporate.com:636', + bindDN: 'cn=non-person,ou=system,dc=corp,dc=corporate,dc=com', + bindCredentials: 'secret', + searchBase: 'dc=corp,dc=corporate,dc=com', + searchFilter: '(&(objectcategory=person)(objectclass=user)(|(samaccountname={{username}})(mail={{username}})))', + searchAttributes: ['displayName', 'mail'], + tlsOptions: { + ca: [ + tfs.readFileSync('/path/to/root_ca_cert.crt') + ] + } + } +}; + +passport.use(new LdapStrategy(opts)); + +passport.serializeUser(function(user, done) { + done(null, user._id); +}); + +passport.deserializeUser(function(id, done) { + db.User.findById(id).then(function(user) { + done(null, user); + }).error(err => { + done(err); + }); +}); +router.post('/', (req, res, next) => { + passport.authenticate('ldapauth', + (err, user, info) => { + console.log('LDAPSTRATEGY'); + if (err) { + return next(err); + } + + if (!user) { + return res.redirect('/login?info=' + info); + } + + req.logIn(user, function(err) { + if (err) { + return next(err); + } + crypto.randomBytes(48, function(ex, buf) { + var token = buf.toString('hex'); + + var session = { + user_id: user._id, + token: token, + ip: req.ip, + device: "web", + created_at: new Date() + }; + + db.Session.create(session) + .error(err => { + console.error("Error creating Session:",err); + res.sendStatus(500); + }) + .then(() => { + var domain = (process.env.NODE_ENV == "production") ? new URL(config.get('endpoint')).hostname : req.headers.hostname; + res.cookie('sdsession', token, { domain: domain, httpOnly: true }); + res.status(201).json(session); + }); + }); + // res.status(201).json(user); + // return res.redirect('/'); + }); + + })(req, res, next); +}); + +module.exports = router; \ No newline at end of file diff --git a/spacedeck.js b/spacedeck.js index 4c236352..7873b5b3 100644 --- a/spacedeck.js +++ b/spacedeck.js @@ -101,7 +101,7 @@ spaceRouter.use('/:id/messages', require('./routes/api/space_messages')); spaceRouter.use('/:id/digest', require('./routes/api/space_digest')); spaceRouter.use('/:id', require('./routes/api/space_exports')); -app.use('/api/sessions', require('./routes/api/passport')); +app.use('/api/sessions', require('./routes/api/passport-ldap')); // app.use('/api/sessions', require('./routes/api/sessions')); //app.use('/api/webgrabber', require('./routes/api/webgrabber')); app.use('/', require('./routes/root')); diff --git a/yarn.lock b/yarn.lock index c6c5c509..a2abcec7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -24,6 +24,13 @@ resolved "https://registry.yarnpkg.com/@types/geojson/-/geojson-7946.0.7.tgz#c8fa532b60a0042219cdf173ca21a975ef0666ad" integrity sha512-wE2v81i4C4Ol09RtsWFAqg3BUitWbHSpSlIo+bNdsCJijO9sjme+zm+73ZMCa/qMC8UEERxzGbvmr1cffo2SiQ== +"@types/ldapjs@^1.0.9": + version "1.0.9" + resolved "https://registry.yarnpkg.com/@types/ldapjs/-/ldapjs-1.0.9.tgz#1224192d14cc5ab5218fcea72ebb04489c52cb95" + integrity sha512-3PvY7Drp1zoLbcGlothCAkoc5o6Jp9KvUPwHadlHyKp3yPvyeIh7w2zQc9UXMzgDRkoeGXUEODtbEs5XCh9ZyA== + dependencies: + "@types/node" "*" + "@types/node@*": version "14.14.27" resolved "https://registry.yarnpkg.com/@types/node/-/node-14.14.27.tgz#c7127f8da0498993e13b1a42faf1303d3110d2f2" @@ -39,6 +46,11 @@ abbrev@1: resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-1.1.1.tgz#f8f2c887ad10bf67f634f005b6987fed3179aac8" integrity sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q== +abstract-logging@^2.0.0: + version "2.0.1" + resolved "https://registry.yarnpkg.com/abstract-logging/-/abstract-logging-2.0.1.tgz#6b0c371df212db7129b57d2e7fcf282b8bf1c839" + integrity sha512-2BjRTZxTPvheOvGbBslFSYOUkr+SjPtOnrLP33f+VIWLzezQpZcqVg7ja3L4dBXmzzgwT+a029jRx5PCi3JuiA== + accepts@~1.3.7: version "1.3.7" resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.7.tgz#531bc726517a3b2b41f850021c6cc15eaab507cd" @@ -283,7 +295,7 @@ array-unique@^0.3.2: resolved "https://registry.yarnpkg.com/array-unique/-/array-unique-0.3.2.tgz#a894b75d4bc4f6cd679ef3244a9fd8f46ae2d428" integrity sha1-qJS3XUvE9s1nnvMkSp/Y9Gri1Cg= -asn1@~0.2.3: +asn1@^0.2.4, asn1@~0.2.3: version "0.2.4" resolved "https://registry.yarnpkg.com/asn1/-/asn1-0.2.4.tgz#8d2475dfab553bb33e77b54e59e880bb8ce23136" integrity sha512-jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg== @@ -386,6 +398,13 @@ bach@^1.0.0: async-settle "^1.0.0" now-and-later "^2.0.0" +backoff@^2.5.0: + version "2.5.0" + resolved "https://registry.yarnpkg.com/backoff/-/backoff-2.5.0.tgz#f616eda9d3e4b66b8ca7fca79f695722c5f8e26f" + integrity sha1-9hbtqdPktmuMp/ynn2lXIsX44m8= + dependencies: + precond "0.2" + balanced-match@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.0.tgz#89b4d199ab2bee49de164ea02b89ce462d71b767" @@ -423,7 +442,7 @@ bcrypt-pbkdf@^1.0.0: dependencies: tweetnacl "^0.14.3" -bcryptjs@2.4.3: +bcryptjs@2.4.3, bcryptjs@^2.4.0: version "2.4.3" resolved "https://registry.yarnpkg.com/bcryptjs/-/bcryptjs-2.4.3.tgz#9ab5627b93e60621ff7cdac5da9733027df1d0cb" integrity sha1-mrVie5PmBiH/fNrF2pczAn3x0Ms= @@ -2964,6 +2983,37 @@ lcid@^1.0.0: dependencies: invert-kv "^1.0.0" +ldap-filter@^0.3.3: + version "0.3.3" + resolved "https://registry.yarnpkg.com/ldap-filter/-/ldap-filter-0.3.3.tgz#2b14c68a2a9d4104dbdbc910a1ca85fd189e9797" + integrity sha1-KxTGiiqdQQTb28kQocqF/Riel5c= + dependencies: + assert-plus "^1.0.0" + +ldapauth-fork@^5.0.1: + version "5.0.1" + resolved "https://registry.yarnpkg.com/ldapauth-fork/-/ldapauth-fork-5.0.1.tgz#18779a9c30371c5bbea02e3b6aaadb60819ad29c" + integrity sha512-EdELQz8zgPruqV2y88PAuAiZCgTaMjex/kEA2PIcOlPYFt75C9QFt5HGZKVQo8Sf/3Mwnr1AtiThHKcq+pRtEg== + dependencies: + "@types/ldapjs" "^1.0.9" + bcryptjs "^2.4.0" + ldapjs "^2.2.1" + lru-cache "^6.0.0" + +ldapjs@^2.2.1: + version "2.2.3" + resolved "https://registry.yarnpkg.com/ldapjs/-/ldapjs-2.2.3.tgz#7ae42c601911c2809f126355a2595ee1d1e21edf" + integrity sha512-143MayI+cSo1PEngge0HMVj3Fb0TneX4Qp9yl9bKs45qND3G64B75GMSxtZCfNuVsvg833aOp1UWG8peFu1LrQ== + dependencies: + abstract-logging "^2.0.0" + asn1 "^0.2.4" + assert-plus "^1.0.0" + backoff "^2.5.0" + ldap-filter "^0.3.3" + once "^1.4.0" + vasync "^2.2.0" + verror "^1.8.1" + lead@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/lead/-/lead-1.0.0.tgz#6f14f99a37be3a9dd784f5495690e5903466ee42" @@ -3107,6 +3157,13 @@ lru-cache@^4.0.1: pseudomap "^1.0.2" yallist "^2.1.2" +lru-cache@^6.0.0: + version "6.0.0" + resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-6.0.0.tgz#6d6fe6570ebd96aaf90fcad1dafa3b2566db3a94" + integrity sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA== + dependencies: + yallist "^4.0.0" + make-dir@^3.0.0: version "3.1.0" resolved "https://registry.yarnpkg.com/make-dir/-/make-dir-3.1.0.tgz#415e967046b3a7f1d185277d84aa58203726a13f" @@ -3812,6 +3869,14 @@ pascalcase@^0.1.1: resolved "https://registry.yarnpkg.com/pascalcase/-/pascalcase-0.1.1.tgz#b363e55e8006ca6fe21784d2db22bd15d7917f14" integrity sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ= +passport-ldapauth@^3.0.1: + version "3.0.1" + resolved "https://registry.yarnpkg.com/passport-ldapauth/-/passport-ldapauth-3.0.1.tgz#1432e8469de18bd46b5b39a46a866b416c1ddded" + integrity sha512-TRRx3BHi8GC8MfCT9wmghjde/EGeKjll7zqHRRfGRxXbLcaDce2OftbQrFG7/AWaeFhR6zpZHtBQ/IkINdLVjQ== + dependencies: + ldapauth-fork "^5.0.1" + passport-strategy "^1.0.0" + passport-local@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/passport-local/-/passport-local-1.0.0.tgz#1fe63268c92e75606626437e3b906662c15ba6ee" @@ -3819,7 +3884,7 @@ passport-local@^1.0.0: dependencies: passport-strategy "1.x.x" -passport-strategy@1.x.x: +passport-strategy@1.x.x, passport-strategy@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/passport-strategy/-/passport-strategy-1.0.0.tgz#b5539aa8fc225a3d1ad179476ddf236b440f52e4" integrity sha1-tVOaqPwiWj0a0XlHbd8ja0QPUuQ= @@ -3966,6 +4031,11 @@ postcss@^7.0.27: source-map "^0.6.1" supports-color "^6.1.0" +precond@0.2: + version "0.2.3" + resolved "https://registry.yarnpkg.com/precond/-/precond-0.2.3.tgz#aa9591bcaa24923f1e0f4849d240f47efc1075ac" + integrity sha1-qpWRvKokkj8eD0hJ0kD0fvwQdaw= + prepend-http@^2.0.0: version "2.0.0" resolved "https://registry.yarnpkg.com/prepend-http/-/prepend-http-2.0.0.tgz#e92434bfa5ea8c19f41cdfd401d741a3c819d897" @@ -5362,7 +5432,14 @@ vary@~1.1.2: resolved "https://registry.yarnpkg.com/vary/-/vary-1.1.2.tgz#2299f02c6ded30d4a5961b0b9f74524a18f634fc" integrity sha1-IpnwLG3tMNSllhsLn3RSShj2NPw= -verror@1.10.0: +vasync@^2.2.0: + version "2.2.0" + resolved "https://registry.yarnpkg.com/vasync/-/vasync-2.2.0.tgz#cfde751860a15822db3b132bc59b116a4adaf01b" + integrity sha1-z951GGChWCLbOxMrxZsRakra8Bs= + dependencies: + verror "1.10.0" + +verror@1.10.0, verror@^1.8.1: version "1.10.0" resolved "https://registry.yarnpkg.com/verror/-/verror-1.10.0.tgz#3a105ca17053af55d6e270c1f8288682e18da400" integrity sha1-OhBcoXBTr1XW4nDB+CiGguGNpAA= @@ -5552,6 +5629,11 @@ yallist@^3.0.0, yallist@^3.0.3: resolved "https://registry.yarnpkg.com/yallist/-/yallist-3.1.1.tgz#dbb7daf9bfd8bac9ab45ebf602b8cbad0d5d08fd" integrity sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g== +yallist@^4.0.0: + version "4.0.0" + resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72" + integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A== + yargs-parser@5.0.0-security.0: version "5.0.0-security.0" resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-5.0.0-security.0.tgz#4ff7271d25f90ac15643b86076a2ab499ec9ee24"