ldap-authentication 2.2.8 → 2.3.1

package/LICENSE

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2021, shaozi
+Copyright (c) 2022, shaozi
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

package/README.md

@@ -9,7 +9,7 @@ Make authentication with an LDAP server easy.
 
 ## Description
 
-This library use `ldapjs` as the underneath library. It has two modes of authentications:
+This library use `ldapjs` as the underneath library. It has three modes of authentications:
 
 1. **Admin authenticate mode**. If an admin user is provided, the library will login (ldap bind) with the admin user,
    then search for the user to be authenticated, get its DN (distinguish name), then use
@@ -23,6 +23,9 @@ This library use `ldapjs` as the underneath library. It has two modes of authent
    Otherwise, the lib does a login with the `userDn` and `userPassword` (ldap bind),
    then does a search on the user and return the user's details.
 
+3. **Verify user exists**. If an `verifyUserExists : true` is provided, the library will login (ldap bind) with the admin user,
+   then search for the user to be verified. If the user exists, user details will be returned (without verifying the user's password).
+
 ## Features
 
 - Can use an admin to search and authenticate a user
@@ -64,6 +67,20 @@ let authenticated = await authenticate({
   userSearchBase: 'dc=example,dc=com',
   usernameAttribute: 'uid',
   username: 'gauss',
+  attributes: ['dn', 'sn', 'cn'],
+})
+```
+
+#### User exists verification and return user details (without user's password)
+
+```javascript
+let authenticated = await authenticate({
+  ldapOpts: { url: 'ldap://ldap.forumsys.com' },
+  userDn: 'uid=gauss,dc=example,dc=com',
+  verifyUserExists: true,
+  userSearchBase: 'dc=example,dc=com',
+  usernameAttribute: 'uid',
+  username: 'gauss',
 })
 ```
 
@@ -139,7 +156,8 @@ auth()
 - `adminPassword`: The password of the admin.
 - `userDn`: The DN of the user to be authenticated. This is only needed if `adminDn` and `adminPassword` are not provided.
   Example: `uid=gauss,dc=example,dc=com`
-- `userPassword`: The password of the user,
+- `userPassword`: The password of the user
+- `verifyUserExists` : if `true` user existence will be verified without password
 - `userSearchBase`: The ldap base DN to search the user. Example: `dc=example,dc=com`
 - `usernameAttribute`: The ldap search equality attribute name corresponding to the user's username.
   It will be used with the value in `username` to construct an ldap filter as `({attribute}={username})`
@@ -151,6 +169,8 @@ auth()
 - `username`: The username to authenticate with. It is used together with the name in `usernameAttribute`
   to construct an ldap filter as `({attribute}={username})`
   to find the user and get user details in LDAP. Example: `some user input`
+- `attributes`: A list of attributes of a user details to be returned from the LDAP server.
+  If is set to `[]` or ommited, all details will be returned. Example: `['sn', 'cn']`
 - `starttls`: Boolean. Use `STARTTLS` or not
 - `groupsSearchBase`: if specified with groupClass, will serve as search base for authenticated user groups
 - `groupClass`: if specified with groupsSearchBase, will be used as objectClass in search filter for authenticated user groups

package/index.d.ts

@@ -0,0 +1,33 @@
+declare module 'ldap-authentication' {
+  type LDAPOpts = {
+    url: string
+    tlsOptions?: {
+      rejectUnauthorized: boolean
+    }
+    connectTimeout?: number
+  }
+  export type AuthenticationOptions = {
+    ldapOpts: LDAPOpts
+    userDn?: string
+    adminDn?: string
+    adminPassword?: string
+    userSearchBase?: string
+    usernameAttribute?: string
+    username?: string
+    verifyUserExists?: boolean
+    starttls?: Boolean
+    groupsSearchBase?: string
+    groupClass?: string
+    groupMemberAttribute?: string
+    groupMemberUserAttribute?: string
+    userPassword?: string
+    attributes?: string[]
+  }
+
+  export function authenticate(options: AuthenticationOptions): Promise<any>
+
+  export class LdapAuthenticationError extends Error {
+    constructor(message: any)
+    name: string
+  }
+}

package/index.js

@@ -35,27 +35,26 @@ function _ldapBind(dn, password, starttls, ldapOpts) {
           resolve(client)
         })
       }
-    });
+    })
 
     //Fix for issue https://github.com/shaozi/ldap-authentication/issues/13
     client.on('timeout', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
     client.on('connectTimeout', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
     client.on('error', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
 
-    client.on('connectError', function(error){
+    client.on('connectError', function (error) {
       if (error) {
         reject(error)
         return
       }
-    });
-
-  });
+    })
+  })
 }
 
 // search a user and return the object
@@ -63,46 +62,53 @@ async function _searchUser(
   ldapClient,
   searchBase,
   usernameAttribute,
-  username
+  username,
+  attributes = null
 ) {
   return new Promise(function (resolve, reject) {
     var filter = new ldap.filters.EqualityFilter({
       attribute: usernameAttribute,
       value: username,
     })
-    ldapClient.search(
-      searchBase,
-      {
-        filter: filter,
-        scope: 'sub',
-      },
-      function (err, res) {
-        var user = null
-        if (err) {
-          reject(err)
-          ldapClient.unbind()
-          return
-        }
-        res.on('searchEntry', function (entry) {
-          user = entry.object
-        })
-        res.on('searchReference', function (referral) {
-          console.log('referral: ' + referral.uris.join())
-        })
-        res.on('error', function (err) {
-          reject(err)
-          ldapClient.unbind()
-        })
-        res.on('end', function (result) {
-          if (result.status != 0) {
-            reject(new Error('ldap search status is not 0, search failed'))
-          } else {
-            resolve(user)
-          }
-          ldapClient.unbind()
-        })
+    let searchOptions = {
+      filter: filter,
+      scope: 'sub',
+      attributes: attributes,
+    }
+    if (attributes) {
+      searchOptions.attributes = attributes
+    }
+    ldapClient.search(searchBase, searchOptions, function (err, res) {
+      var user = null
+      if (err) {
+        reject(err)
+        ldapClient.unbind()
+        return
       }
-    )
+      res.on('searchEntry', function (entry) {
+        user = entry.object
+      })
+      res.on('searchReference', function (referral) {
+        // TODO: we don't support reference yet
+        // If the server was able to locate the entry referred to by the baseObject
+        // but could not search one or more non-local entries,
+        // the server may return one or more SearchResultReference messages,
+        // each containing a reference to another set of servers for continuing the operation.
+        // referral.uris
+      })
+      res.on('error', function (err) {
+        reject(err)
+        ldapClient.unbind()
+      })
+      res.on('end', function (result) {
+        if (result.status != 0) {
+          reject(new Error('ldap search status is not 0, search failed'))
+        } else {
+          resolve(user)
+        }
+        ldapClient.unbind()
+      })
+    })
   })
 }
 
@@ -132,9 +138,7 @@ async function _searchUserGroups(
         res.on('searchEntry', function (entry) {
           groups.push(entry.object)
         })
-        res.on('searchReference', function (referral) {
-          console.log('referral: ' + referral.uris.join())
-        })
+        res.on('searchReference', function (referral) {})
         res.on('error', function (err) {
           reject(err)
           ldapClient.unbind()
@@ -164,7 +168,8 @@ async function authenticateWithAdmin(
   groupsSearchBase,
   groupClass,
   groupMemberAttribute = 'member',
-  groupMemberUserAttribute
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   var ldapAdminClient
   try {
@@ -181,7 +186,8 @@ async function authenticateWithAdmin(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   ldapAdminClient.unbind()
   if (!user || !user.dn) {
@@ -237,7 +243,8 @@ async function authenticateWithUser(
   groupsSearchBase,
   groupClass,
   groupMemberAttribute = 'member',
-  groupMemberUserAttribute
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   let ldapUserClient
   try {
@@ -254,7 +261,8 @@ async function authenticateWithUser(
     ldapUserClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   if (!user || !user.dn) {
     ldapOpts.log &&
@@ -286,6 +294,73 @@ async function authenticateWithUser(
   return user
 }
 
+async function verifyUserExists(
+  adminDn,
+  adminPassword,
+  userSearchBase,
+  usernameAttribute,
+  username,
+  starttls,
+  ldapOpts,
+  groupsSearchBase,
+  groupClass,
+  groupMemberAttribute = 'member',
+  groupMemberUserAttribute = 'dn',
+  attributes = null
+) {
+  var ldapAdminClient
+  try {
+    ldapAdminClient = await _ldapBind(
+      adminDn,
+      adminPassword,
+      starttls,
+      ldapOpts
+    )
+  } catch (error) {
+    throw { admin: error }
+  }
+  var user = await _searchUser(
+    ldapAdminClient,
+    userSearchBase,
+    usernameAttribute,
+    username,
+    attributes
+  )
+  ldapAdminClient.unbind()
+  if (!user || !user.dn) {
+    ldapOpts.log &&
+      ldapOpts.log.trace(
+        `admin did not find user! (${usernameAttribute}=${username})`
+      )
+    throw new LdapAuthenticationError(
+      'user not found or usernameAttribute is wrong'
+    )
+  }
+  if (groupsSearchBase && groupClass && groupMemberAttribute) {
+    try {
+      ldapAdminClient = await _ldapBind(
+        adminDn,
+        adminPassword,
+        starttls,
+        ldapOpts
+      )
+    } catch (error) {
+      throw error
+    }
+    var groups = await _searchUserGroups(
+      ldapAdminClient,
+      groupsSearchBase,
+      user,
+      groupClass,
+      groupMemberAttribute,
+      groupMemberUserAttribute
+    )
+    user.groups = groups
+    ldapAdminClient.unbind()
+  }
+  return user
+}
+
 async function authenticate(options) {
   if (!options.userDn) {
     assert(options.adminDn, 'Admin mode adminDn must be provided')
@@ -299,11 +374,31 @@ async function authenticate(options) {
   } else {
     assert(options.userDn, 'User mode userDn must be provided')
   }
-  assert(options.userPassword, 'userPassword must be provided')
   assert(
     options.ldapOpts && options.ldapOpts.url,
     'ldapOpts.url must be provided'
   )
+  if (options.verifyUserExists) {
+    assert(options.adminDn, 'Admin mode adminDn must be provided')
+    assert(
+      options.adminPassword,
+      'adminDn and adminPassword must be both provided.'
+    )
+    return await verifyUserExists(
+      options.adminDn,
+      options.adminPassword,
+      options.userSearchBase,
+      options.usernameAttribute,
+      options.username,
+      options.starttls,
+      options.ldapOpts,
+      options.groupsSearchBase,
+      options.groupClass,
+      options.groupMemberAttribute,
+      options.groupMemberUserAttribute
+    )
+  }
+  assert(options.userPassword, 'userPassword must be provided')
   if (options.adminDn) {
     assert(
       options.adminPassword,
@@ -321,7 +416,8 @@ async function authenticate(options) {
       options.groupsSearchBase,
       options.groupClass,
       options.groupMemberAttribute,
-      options.groupMemberUserAttribute
+      options.groupMemberUserAttribute,
+      options.attributes
     )
   }
   assert(options.userDn, 'adminDn/adminPassword OR userDn must be provided')
@@ -336,7 +432,8 @@ async function authenticate(options) {
     options.groupsSearchBase,
     options.groupClass,
     options.groupMemberAttribute,
-    options.groupMemberUserAttribute
+    options.groupMemberUserAttribute,
+    options.attributes
   )
 }
 

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "ldap-authentication",
-  "version": "2.2.8",
+  "version": "2.3.1",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
+  "types": "./index.d.ts",
   "scripts": {
     "test": "node test/jasmine.js"
   },
@@ -35,10 +36,9 @@
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapjs": "^2.3.1"
+    "ldapjs": "^2.3.3"
   },
   "devDependencies": {
-    "jasmine": "^3.8.0",
-    "jasmine-console-reporter": "^3.1.0"
+    "jasmine": "^4.3.0"
   }
 }

package/test/jasmine.js

@@ -9,7 +9,55 @@ jasmine.loadConfig({
   stopSpecOnExpectationFailure: false,
 })
 
-const Reporter = require('jasmine-console-reporter')
+class MyConsoleReporter {
+  constructor() {
+    this.suiteSeq = 1
+  }
 
-jasmine.jasmine.getEnv().addReporter(new Reporter())
+  _indentPrint(str) {
+    str
+      .trim()
+      .split('\n')
+      .forEach((line) => {
+        process.stdout.write('       ' + line + '\n')
+      })
+  }
+
+  jasmineStarted(suiteInfo) {
+    console.log(`Running suite with ${suiteInfo.totalSpecsDefined} tests.`)
+  }
+
+  suiteStarted(result) {
+    console.log(`\n${this.suiteSeq}. ${result.fullName}`)
+    this.suiteSeq++
+  }
+
+  specStarted(result) {
+    process.stdout.write(`   - ${result.description} `)
+  }
+
+  specDone(result) {
+    process.stdout.write(
+      ` ${result.status} [${result.passedExpectations.length}] (${result.duration} ms)`
+    )
+
+    for (var i = 0; i < result.failedExpectations.length; i++) {
+      console.log()
+      this._indentPrint(result.failedExpectations[i].message)
+      this._indentPrint(result.failedExpectations[i].stack)
+    }
+
+    process.stdout.write(`\n`)
+  }
+
+  jasmineDone(result) {
+    console.log('Overall result: ' + result.overallStatus)
+    for (var i = 0; i < result.failedExpectations.length; i++) {
+      console.log('Global ' + result.failedExpectations[i].message)
+      console.log(result.failedExpectations[i].stack)
+    }
+  }
+}
+
+jasmine.jasmine.getEnv().addReporter(new MyConsoleReporter())
 jasmine.execute()

package/test/test.js

@@ -1,6 +1,22 @@
 const { authenticate, LdapAuthenticationError } = require('../index.js')
 
 describe('ldap-authentication test', () => {
+  it('Use an admin user to check if user exists', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+  })
   it('Use an admin user to authenticate a regular user', async () => {
     let options = {
       ldapOpts: {
@@ -17,6 +33,25 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
   })
+  it('Use an admin user to authenticate a regular user and return attrubutes', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      attributes: ['uid', 'sn'],
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Gauss')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an regular user to authenticate iteself', async () => {
     let options = {
       ldapOpts: {
@@ -32,6 +67,24 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
   })
+  it('Use an regular user to authenticate iteself and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      userDn: 'uid=einstein,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'einstein',
+      attributes: ['uid', 'sn'],
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('einstein')
+    expect(user.sn).toEqual('Einstein')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an regular user to authenticate iteself without search', async () => {
     let options = {
       ldapOpts: {
@@ -277,14 +330,14 @@ describe('ldap-authentication negative test', () => {
     let options = {
       ldapOpts: {
         url: 'ldap://x.forumsys.com',
-        connectTimeout: 2000
+        connectTimeout: 2000,
       },
       userDn: 'uid=einstein,dc=example,dc=com',
       userPassword: 'password',
       usernameAttribute: 'cn',
       userSearchBase: 'dc=example,dc=com',
       username: 'einstein',
-      starttls: true
+      starttls: true,
     }
     try {
       await authenticate(options)