Starship/CoreID
1
0
Fork 0
Code Issues 8 Pull Requests Releases 34 Wiki Activity

Add IAM support to LDAP filters (iamTarget)

Browse Source
This commit is contained in:
garrettmills
2020-05-20 22:28:30 -05:00
parent b526b8f24d
commit ca11e3afae
4 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
app/ldap/controllers/Users.controller.js
View File

@@ -185,6 +185,20 @@ class UsersController extends LDAPController {
return this.ldap_server.auth_dn()
}
parse_iam_targets(filter, target_ids = []) {
if ( Array.isArray(filter?.filters) ) {
for ( const sub_filter of filter.filters ) {
target_ids = [...target_ids, ...this.parse_iam_targets(sub_filter)]
}
} else if ( filter?.attribute ) {
if ( filter.attribute === 'iamtarget' ) {
target_ids.push(filter.value)
}
}
return target_ids
}
// TODO flitter-orm chunk query
// TODO generalize scoped search logic
async search_people(req, res, next) {
@@ -192,6 +206,7 @@ class UsersController extends LDAPController {
return next(new LDAP.InsufficientAccessRightsError())
}
const iam_targets = this.parse_iam_targets(req.filter)
if ( req.scope === 'base' ) {
// If scope is base, check if the base DN matches the filter.
// If so, return it. Else, return empty.
@@ -200,17 +215,17 @@ class UsersController extends LDAPController {
const user = await this.get_resource_from_dn(req.dn)
// Make sure the user is ldap visible && match the filter
if ( user && user.ldap_visible && req.filter.matches(await user.to_ldap()) ) {
if ( user && user.ldap_visible && req.filter.matches(await user.to_ldap(iam_targets)) ) {
// If so, send the object
res.send({
dn: user.dn,//.format(this.configs.get('ldap:server.format')),
attributes: await user.to_ldap(),
attributes: await user.to_ldap(iam_targets),
})
this.output.debug({
dn: user.dn.format(this.configs.get('ldap:server.format')),
attributes: await user.to_ldap(),
attributes: await user.to_ldap(iam_targets),
})
} else {
this.output.debug(`User base search failed: either user not found, not visible, or filter mismatch`)
@@ -229,12 +244,12 @@ class UsersController extends LDAPController {
if ( req.dn.equals(user.dn) || user.dn.parent().equals(req.dn) ) {
// Check if the filter matches
if ( req.filter.matches(await user.to_ldap()) ) {
if ( req.filter.matches(await user.to_ldap(iam_targets)) ) {
// If so, send the object
res.send({
dn: user.dn,//.format(this.configs.get('ldap:server.format')),
attributes: await user.to_ldap(),
attributes: await user.to_ldap(iam_targets),
})
}
}
@@ -253,12 +268,12 @@ class UsersController extends LDAPController {
if ( req.dn.equals(user.dn) || req.dn.parentOf(user.dn) ) {
// Check if filter matches
if ( req.filter.matches(await user.to_ldap()) ) {
if ( req.filter.matches(await user.to_ldap(iam_targets)) ) {
// If so, send the object
res.send({
dn: user.dn,//.format(this.configs.get('ldap:server.format')),
attributes: await user.to_ldap(),
attributes: await user.to_ldap(iam_targets),
})
}
}