ldap-authentication 2.2.7 → 2.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2021, shaozi
+Copyright (c) 2022, shaozi
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

package/README.md

@@ -9,7 +9,7 @@ Make authentication with an LDAP server easy.
 
 ## Description
 
-This library use `ldapjs` as the underneath library. It has two modes of authentications:
+This library use `ldapjs` as the underneath library. It has three modes of authentications:
 
 1. **Admin authenticate mode**. If an admin user is provided, the library will login (ldap bind) with the admin user,
    then search for the user to be authenticated, get its DN (distinguish name), then use
@@ -23,6 +23,9 @@ This library use `ldapjs` as the underneath library. It has two modes of authent
    Otherwise, the lib does a login with the `userDn` and `userPassword` (ldap bind),
    then does a search on the user and return the user's details.
 
+3. **Verify user exists**. If an `verifyUserExists : true` is provided, the library will login (ldap bind) with the admin user,
+   then search for the user to be verified. If the user exists, user details will be returned (without verifying the user's password).
+
 ## Features
 
 - Can use an admin to search and authenticate a user
@@ -64,6 +67,20 @@ let authenticated = await authenticate({
   userSearchBase: 'dc=example,dc=com',
   usernameAttribute: 'uid',
   username: 'gauss',
+  attributes: ['dn', 'sn', 'cn'],
+})
+```
+
+#### User exists verification and return user details (without user's password)
+
+```javascript
+let authenticated = await authenticate({
+  ldapOpts: { url: 'ldap://ldap.forumsys.com' },
+  userDn: 'uid=gauss,dc=example,dc=com',
+  verifyUserExists: true,
+  userSearchBase: 'dc=example,dc=com',
+  usernameAttribute: 'uid',
+  username: 'gauss',
 })
 ```
 
@@ -80,6 +97,7 @@ let authenticated = await authenticate({
   groupsSearchBase: 'dc=example,dc=com',
   groupClass: 'groupOfUniqueNames',
   groupMemberAttribute: 'uniqueMember',
+  // groupMemberUserAttribute: 'dn'
 })
 ```
 
@@ -138,7 +156,8 @@ auth()
 - `adminPassword`: The password of the admin.
 - `userDn`: The DN of the user to be authenticated. This is only needed if `adminDn` and `adminPassword` are not provided.
   Example: `uid=gauss,dc=example,dc=com`
-- `userPassword`: The password of the user,
+- `userPassword`: The password of the user
+- `verifyUserExists` : if `true` user existence will be verified without password
 - `userSearchBase`: The ldap base DN to search the user. Example: `dc=example,dc=com`
 - `usernameAttribute`: The ldap search equality attribute name corresponding to the user's username.
   It will be used with the value in `username` to construct an ldap filter as `({attribute}={username})`
@@ -150,7 +169,10 @@ auth()
 - `username`: The username to authenticate with. It is used together with the name in `usernameAttribute`
   to construct an ldap filter as `({attribute}={username})`
   to find the user and get user details in LDAP. Example: `some user input`
+- `attributes`: A list of attributes of a user details to be returned from the LDAP server.
+  If is set to `[]` or ommited, all details will be returned. Example: `['sn', 'cn']`
 - `starttls`: Boolean. Use `STARTTLS` or not
 - `groupsSearchBase`: if specified with groupClass, will serve as search base for authenticated user groups
 - `groupClass`: if specified with groupsSearchBase, will be used as objectClass in search filter for authenticated user groups
 - `groupMemberAttribute`: if specified with groupClass and groupsSearchBase, will be used as member name (if not specified this defaults to `member`) in search filter for authenticated user groups
+- `groupMemberUserAttribute`: if specified with groupClass and groupsSearchBase, will be used as the attribute on the user object (if not specified this defaults to `dn`) in search filter for authenticated user groups

package/index.d.ts

@@ -0,0 +1,33 @@
+declare module 'ldap-authentication' {
+  type LDAPOpts = {
+    url: string
+    tlsOptions?: {
+      rejectUnauthorized: boolean
+    }
+    connectTimeout?: number
+  }
+  export type AuthenticationOptions = {
+    ldapOpts: LDAPOpts
+    userDn?: string
+    adminDn?: string
+    adminPassword?: string
+    userSearchBase?: string
+    usernameAttribute?: string
+    username?: string
+    verifyUserExists?: boolean
+    starttls?: Boolean
+    groupsSearchBase?: string
+    groupClass?: string
+    groupMemberAttribute?: string
+    groupMemberUserAttribute?: string
+    userPassword?: string
+    attributes?: string[]
+  }
+
+  export function authenticate(options: AuthenticationOptions): Promise<any>
+
+  export class LdapAuthenticationError extends Error {
+    constructor(message: any)
+    name: string
+  }
+}

package/index.js

@@ -35,27 +35,26 @@ function _ldapBind(dn, password, starttls, ldapOpts) {
           resolve(client)
         })
       }
-    });
+    })
 
     //Fix for issue https://github.com/shaozi/ldap-authentication/issues/13
     client.on('timeout', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
     client.on('connectTimeout', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
     client.on('error', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
 
-    client.on('connectError', function(error){
+    client.on('connectError', function (error) {
       if (error) {
         reject(error)
         return
       }
-    });
-
-  });
+    })
+  })
 }
 
 // search a user and return the object
@@ -63,46 +62,48 @@ async function _searchUser(
   ldapClient,
   searchBase,
   usernameAttribute,
-  username
+  username,
+  attributes = null
 ) {
   return new Promise(function (resolve, reject) {
     var filter = new ldap.filters.EqualityFilter({
       attribute: usernameAttribute,
       value: username,
     })
-    ldapClient.search(
-      searchBase,
-      {
-        filter: filter,
-        scope: 'sub',
-      },
-      function (err, res) {
-        var user = null
-        if (err) {
-          reject(err)
-          ldapClient.unbind()
-          return
-        }
-        res.on('searchEntry', function (entry) {
-          user = entry.object
-        })
-        res.on('searchReference', function (referral) {
-          console.log('referral: ' + referral.uris.join())
-        })
-        res.on('error', function (err) {
-          reject(err)
-          ldapClient.unbind()
-        })
-        res.on('end', function (result) {
-          if (result.status != 0) {
-            reject(new Error('ldap search status is not 0, search failed'))
-          } else {
-            resolve(user)
-          }
-          ldapClient.unbind()
-        })
+    let searchOptions = {
+      filter: filter,
+      scope: 'sub',
+      attributes: attributes,
+    }
+    if (attributes) {
+      searchOptions.attributes = attributes
+    }
+    ldapClient.search(searchBase, searchOptions, function (err, res) {
+      var user = null
+      if (err) {
+        reject(err)
+        ldapClient.unbind()
+        return
       }
-    )
+      res.on('searchEntry', function (entry) {
+        user = entry.object
+      })
+      res.on('searchReference', function (referral) {
+        console.log('referral: ' + referral.uris.join())
+      })
+      res.on('error', function (err) {
+        reject(err)
+        ldapClient.unbind()
+      })
+      res.on('end', function (result) {
+        if (result.status != 0) {
+          reject(new Error('ldap search status is not 0, search failed'))
+        } else {
+          resolve(user)
+        }
+        ldapClient.unbind()
+      })
+    })
   })
 }
 
@@ -112,13 +113,14 @@ async function _searchUserGroups(
   searchBase,
   user,
   groupClass,
-  groupMemberAttribute = 'member'
+  groupMemberAttribute = 'member',
+  groupMemberUserAttribute = 'dn'
 ) {
   return new Promise(function (resolve, reject) {
     ldapClient.search(
       searchBase,
       {
-        filter: `(&(objectclass=${groupClass})(${groupMemberAttribute}=${user.dn}))`,
+        filter: `(&(objectclass=${groupClass})(${groupMemberAttribute}=${user[groupMemberUserAttribute]}))`,
         scope: 'sub',
       },
       function (err, res) {
@@ -162,7 +164,9 @@ async function authenticateWithAdmin(
   ldapOpts,
   groupsSearchBase,
   groupClass,
-  groupMemberAttribute = 'member'
+  groupMemberAttribute = 'member',
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   var ldapAdminClient
   try {
@@ -179,7 +183,8 @@ async function authenticateWithAdmin(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   ldapAdminClient.unbind()
   if (!user || !user.dn) {
@@ -215,7 +220,8 @@ async function authenticateWithAdmin(
       groupsSearchBase,
       user,
       groupClass,
-      groupMemberAttribute
+      groupMemberAttribute,
+      groupMemberUserAttribute
     )
     user.groups = groups
     ldapAdminClient.unbind()
@@ -233,7 +239,9 @@ async function authenticateWithUser(
   ldapOpts,
   groupsSearchBase,
   groupClass,
-  groupMemberAttribute = 'member'
+  groupMemberAttribute = 'member',
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   let ldapUserClient
   try {
@@ -250,7 +258,8 @@ async function authenticateWithUser(
     ldapUserClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   if (!user || !user.dn) {
     ldapOpts.log &&
@@ -273,7 +282,8 @@ async function authenticateWithUser(
       groupsSearchBase,
       user,
       groupClass,
-      groupMemberAttribute
+      groupMemberAttribute,
+      groupMemberUserAttribute
     )
     user.groups = groups
     ldapUserClient.unbind()
@@ -281,6 +291,73 @@ async function authenticateWithUser(
   return user
 }
 
+async function verifyUserExists(
+  adminDn,
+  adminPassword,
+  userSearchBase,
+  usernameAttribute,
+  username,
+  starttls,
+  ldapOpts,
+  groupsSearchBase,
+  groupClass,
+  groupMemberAttribute = 'member',
+  groupMemberUserAttribute = 'dn',
+  attributes = null
+) {
+  var ldapAdminClient
+  try {
+    ldapAdminClient = await _ldapBind(
+      adminDn,
+      adminPassword,
+      starttls,
+      ldapOpts
+    )
+  } catch (error) {
+    throw { admin: error }
+  }
+  var user = await _searchUser(
+    ldapAdminClient,
+    userSearchBase,
+    usernameAttribute,
+    username,
+    attributes
+  )
+  ldapAdminClient.unbind()
+  if (!user || !user.dn) {
+    ldapOpts.log &&
+      ldapOpts.log.trace(
+        `admin did not find user! (${usernameAttribute}=${username})`
+      )
+    throw new LdapAuthenticationError(
+      'user not found or usernameAttribute is wrong'
+    )
+  }
+  if (groupsSearchBase && groupClass && groupMemberAttribute) {
+    try {
+      ldapAdminClient = await _ldapBind(
+        adminDn,
+        adminPassword,
+        starttls,
+        ldapOpts
+      )
+    } catch (error) {
+      throw error
+    }
+    var groups = await _searchUserGroups(
+      ldapAdminClient,
+      groupsSearchBase,
+      user,
+      groupClass,
+      groupMemberAttribute,
+      groupMemberUserAttribute
+    )
+    user.groups = groups
+    ldapAdminClient.unbind()
+  }
+  return user
+}
+
 async function authenticate(options) {
   if (!options.userDn) {
     assert(options.adminDn, 'Admin mode adminDn must be provided')
@@ -294,11 +371,31 @@ async function authenticate(options) {
   } else {
     assert(options.userDn, 'User mode userDn must be provided')
   }
-  assert(options.userPassword, 'userPassword must be provided')
   assert(
     options.ldapOpts && options.ldapOpts.url,
     'ldapOpts.url must be provided'
   )
+  if (options.verifyUserExists) {
+    assert(options.adminDn, 'Admin mode adminDn must be provided')
+    assert(
+      options.adminPassword,
+      'adminDn and adminPassword must be both provided.'
+    )
+    return await verifyUserExists(
+      options.adminDn,
+      options.adminPassword,
+      options.userSearchBase,
+      options.usernameAttribute,
+      options.username,
+      options.starttls,
+      options.ldapOpts,
+      options.groupsSearchBase,
+      options.groupClass,
+      options.groupMemberAttribute,
+      options.groupMemberUserAttribute
+    )
+  }
+  assert(options.userPassword, 'userPassword must be provided')
   if (options.adminDn) {
     assert(
       options.adminPassword,
@@ -315,7 +412,9 @@ async function authenticate(options) {
       options.ldapOpts,
       options.groupsSearchBase,
       options.groupClass,
-      options.groupMemberAttribute
+      options.groupMemberAttribute,
+      options.groupMemberUserAttribute,
+      options.attributes
     )
   }
   assert(options.userDn, 'adminDn/adminPassword OR userDn must be provided')
@@ -329,7 +428,9 @@ async function authenticate(options) {
     options.ldapOpts,
     options.groupsSearchBase,
     options.groupClass,
-    options.groupMemberAttribute
+    options.groupMemberAttribute,
+    options.groupMemberUserAttribute,
+    options.attributes
   )
 }
 

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "ldap-authentication",
-  "version": "2.2.7",
+  "version": "2.3.0",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
+  "types": "./index.d.ts",
   "scripts": {
     "test": "node test/jasmine.js"
   },
@@ -29,16 +30,15 @@
     "ldap-authenticate"
   ],
   "author": "Jingshao Chen",
-  "license": "MIT",
+  "license": "BSD-2-Clause",
   "bugs": {
     "url": "https://github.com/shaozi/ldap-authentication/issues"
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapjs": "^2.2.4"
+    "ldapjs": "^2.3.3"
   },
   "devDependencies": {
-    "jasmine": "^3.7.0",
-    "jasmine-console-reporter": "^3.1.0"
+    "jasmine": "^4.3.0"
   }
 }

package/test/jasmine.js

@@ -9,7 +9,55 @@ jasmine.loadConfig({
   stopSpecOnExpectationFailure: false,
 })
 
-const Reporter = require('jasmine-console-reporter')
+class MyConsoleReporter {
+  constructor() {
+    this.suiteSeq = 1
+  }
 
-jasmine.jasmine.getEnv().addReporter(new Reporter())
+  _indentPrint(str) {
+    str
+      .trim()
+      .split('\n')
+      .forEach((line) => {
+        process.stdout.write('       ' + line + '\n')
+      })
+  }
+
+  jasmineStarted(suiteInfo) {
+    console.log(`Running suite with ${suiteInfo.totalSpecsDefined} tests.`)
+  }
+
+  suiteStarted(result) {
+    console.log(`\n${this.suiteSeq}. ${result.fullName}`)
+    this.suiteSeq++
+  }
+
+  specStarted(result) {
+    process.stdout.write(`   - ${result.description} `)
+  }
+
+  specDone(result) {
+    process.stdout.write(
+      ` ${result.status} [${result.passedExpectations.length}] (${result.duration} ms)`
+    )
+
+    for (var i = 0; i < result.failedExpectations.length; i++) {
+      console.log()
+      this._indentPrint(result.failedExpectations[i].message)
+      this._indentPrint(result.failedExpectations[i].stack)
+    }
+
+    process.stdout.write(`\n`)
+  }
+
+  jasmineDone(result) {
+    console.log('Overall result: ' + result.overallStatus)
+    for (var i = 0; i < result.failedExpectations.length; i++) {
+      console.log('Global ' + result.failedExpectations[i].message)
+      console.log(result.failedExpectations[i].stack)
+    }
+  }
+}
+
+jasmine.jasmine.getEnv().addReporter(new MyConsoleReporter())
 jasmine.execute()

package/test/test.js

@@ -1,6 +1,22 @@
 const { authenticate, LdapAuthenticationError } = require('../index.js')
 
 describe('ldap-authentication test', () => {
+  it('Use an admin user to check if user exists', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+  })
   it('Use an admin user to authenticate a regular user', async () => {
     let options = {
       ldapOpts: {
@@ -17,6 +33,25 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
   })
+  it('Use an admin user to authenticate a regular user and return attrubutes', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      attributes: ['uid', 'sn'],
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Gauss')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an regular user to authenticate iteself', async () => {
     let options = {
       ldapOpts: {
@@ -32,6 +67,24 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
   })
+  it('Use an regular user to authenticate iteself and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      userDn: 'uid=einstein,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'einstein',
+      attributes: ['uid', 'sn'],
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('einstein')
+    expect(user.sn).toEqual('Einstein')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an regular user to authenticate iteself without search', async () => {
     let options = {
       ldapOpts: {
@@ -57,6 +110,7 @@ describe('ldap-authentication test', () => {
       groupsSearchBase: 'dc=example,dc=com',
       groupClass: 'groupOfUniqueNames',
       groupMemberAttribute: 'uniqueMember',
+      groupMemberUserAttribute: 'dn',
     }
     let user = await authenticate(options)
     expect(user).toBeTruthy()
@@ -75,12 +129,13 @@ describe('ldap-authentication test', () => {
       groupsSearchBase: 'dc=example,dc=com',
       groupClass: 'groupOfUniqueNames',
       groupMemberAttribute: 'uniqueMember',
+      groupMemberUserAttribute: 'dn',
     }
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
   })
-  it('Not specifying groupMemberAttribute should not cause an error and fallback do default value', async () => {
+  it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {
     let options = {
       ldapOpts: {
         url: 'ldap://ldap.forumsys.com',
@@ -275,14 +330,14 @@ describe('ldap-authentication negative test', () => {
     let options = {
       ldapOpts: {
         url: 'ldap://x.forumsys.com',
-		connectTimeout: 2000
+        connectTimeout: 2000,
       },
       userDn: 'uid=einstein,dc=example,dc=com',
       userPassword: 'password',
       usernameAttribute: 'cn',
       userSearchBase: 'dc=example,dc=com',
-	  username: 'einstein',
-	  starttls: true
+      username: 'einstein',
+      starttls: true,
     }
     try {
       await authenticate(options)
@@ -291,4 +346,23 @@ describe('ldap-authentication negative test', () => {
     }
     expect(e).toBeTruthy()
   })
+  it('Unmatched supplied groupMemberUserAttribute should return empty group list', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      userDn: 'uid=gauss,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      groupsSearchBase: 'dc=example,dc=com',
+      groupClass: 'groupOfUniqueNames',
+      groupMemberAttribute: 'uniqueMember',
+      groupMemberUserAttribute: 'notARealGroupMemberUserAttribute',
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.groups.length).toBeLessThan(1)
+  })
 })