ldap-authentication 2.2.9 → 2.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2021, shaozi
+Copyright (c) 2022, shaozi
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

package/README.md

@@ -9,7 +9,7 @@ Make authentication with an LDAP server easy.
 
 ## Description
 
-This library use `ldapjs` as the underneath library. It has two modes of authentications:
+This library use `ldapjs` as the underneath library. It has three modes of authentications:
 
 1. **Admin authenticate mode**. If an admin user is provided, the library will login (ldap bind) with the admin user,
    then search for the user to be authenticated, get its DN (distinguish name), then use
@@ -24,7 +24,7 @@ This library use `ldapjs` as the underneath library. It has two modes of authent
    then does a search on the user and return the user's details.
 
 3. **Verify user exists**. If an `verifyUserExists : true` is provided, the library will login (ldap bind) with the admin user,
-      then search for the user to be verified. If the user exists, user details will be returned (without verifying the user's password).
+   then search for the user to be verified. If the user exists, user details will be returned (without verifying the user's password).
 
 ## Features
 
@@ -67,6 +67,7 @@ let authenticated = await authenticate({
   userSearchBase: 'dc=example,dc=com',
   usernameAttribute: 'uid',
   username: 'gauss',
+  attributes: ['dn', 'sn', 'cn'],
 })
 ```
 
@@ -76,7 +77,7 @@ let authenticated = await authenticate({
 let authenticated = await authenticate({
   ldapOpts: { url: 'ldap://ldap.forumsys.com' },
   userDn: 'uid=gauss,dc=example,dc=com',
-  verifyUserExists : true,
+  verifyUserExists: true,
   userSearchBase: 'dc=example,dc=com',
   usernameAttribute: 'uid',
   username: 'gauss',
@@ -156,7 +157,7 @@ auth()
 - `userDn`: The DN of the user to be authenticated. This is only needed if `adminDn` and `adminPassword` are not provided.
   Example: `uid=gauss,dc=example,dc=com`
 - `userPassword`: The password of the user
--  `verifyUserExists` : if `true` user existence will be verified without password
+- `verifyUserExists` : if `true` user existence will be verified without password
 - `userSearchBase`: The ldap base DN to search the user. Example: `dc=example,dc=com`
 - `usernameAttribute`: The ldap search equality attribute name corresponding to the user's username.
   It will be used with the value in `username` to construct an ldap filter as `({attribute}={username})`
@@ -168,6 +169,8 @@ auth()
 - `username`: The username to authenticate with. It is used together with the name in `usernameAttribute`
   to construct an ldap filter as `({attribute}={username})`
   to find the user and get user details in LDAP. Example: `some user input`
+- `attributes`: A list of attributes of a user details to be returned from the LDAP server.
+  If is set to `[]` or ommited, all details will be returned. Example: `['sn', 'cn']`
 - `starttls`: Boolean. Use `STARTTLS` or not
 - `groupsSearchBase`: if specified with groupClass, will serve as search base for authenticated user groups
 - `groupClass`: if specified with groupsSearchBase, will be used as objectClass in search filter for authenticated user groups

package/index.d.ts

@@ -0,0 +1,33 @@
+declare module 'ldap-authentication' {
+  type LDAPOpts = {
+    url: string
+    tlsOptions?: {
+      rejectUnauthorized: boolean
+    }
+    connectTimeout?: number
+  }
+  export type AuthenticationOptions = {
+    ldapOpts: LDAPOpts
+    userDn?: string
+    adminDn?: string
+    adminPassword?: string
+    userSearchBase?: string
+    usernameAttribute?: string
+    username?: string
+    verifyUserExists?: boolean
+    starttls?: Boolean
+    groupsSearchBase?: string
+    groupClass?: string
+    groupMemberAttribute?: string
+    groupMemberUserAttribute?: string
+    userPassword?: string
+    attributes?: string[]
+  }
+
+  export function authenticate(options: AuthenticationOptions): Promise<any>
+
+  export class LdapAuthenticationError extends Error {
+    constructor(message: any)
+    name: string
+  }
+}

package/index.js

@@ -35,27 +35,26 @@ function _ldapBind(dn, password, starttls, ldapOpts) {
           resolve(client)
         })
       }
-    });
+    })
 
     //Fix for issue https://github.com/shaozi/ldap-authentication/issues/13
     client.on('timeout', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
     client.on('connectTimeout', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
     client.on('error', (err) => {
-      reject(err);
-    });
+      reject(err)
+    })
 
-    client.on('connectError', function(error){
+    client.on('connectError', function (error) {
       if (error) {
         reject(error)
         return
       }
-    });
-
-  });
+    })
+  })
 }
 
 // search a user and return the object
@@ -63,46 +62,48 @@ async function _searchUser(
   ldapClient,
   searchBase,
   usernameAttribute,
-  username
+  username,
+  attributes = null
 ) {
   return new Promise(function (resolve, reject) {
     var filter = new ldap.filters.EqualityFilter({
       attribute: usernameAttribute,
       value: username,
     })
-    ldapClient.search(
-      searchBase,
-      {
-        filter: filter,
-        scope: 'sub',
-      },
-      function (err, res) {
-        var user = null
-        if (err) {
-          reject(err)
-          ldapClient.unbind()
-          return
-        }
-        res.on('searchEntry', function (entry) {
-          user = entry.object
-        })
-        res.on('searchReference', function (referral) {
-          console.log('referral: ' + referral.uris.join())
-        })
-        res.on('error', function (err) {
-          reject(err)
-          ldapClient.unbind()
-        })
-        res.on('end', function (result) {
-          if (result.status != 0) {
-            reject(new Error('ldap search status is not 0, search failed'))
-          } else {
-            resolve(user)
-          }
-          ldapClient.unbind()
-        })
+    let searchOptions = {
+      filter: filter,
+      scope: 'sub',
+      attributes: attributes,
+    }
+    if (attributes) {
+      searchOptions.attributes = attributes
+    }
+    ldapClient.search(searchBase, searchOptions, function (err, res) {
+      var user = null
+      if (err) {
+        reject(err)
+        ldapClient.unbind()
+        return
       }
-    )
+      res.on('searchEntry', function (entry) {
+        user = entry.object
+      })
+      res.on('searchReference', function (referral) {
+        console.log('referral: ' + referral.uris.join())
+      })
+      res.on('error', function (err) {
+        reject(err)
+        ldapClient.unbind()
+      })
+      res.on('end', function (result) {
+        if (result.status != 0) {
+          reject(new Error('ldap search status is not 0, search failed'))
+        } else {
+          resolve(user)
+        }
+        ldapClient.unbind()
+      })
+    })
   })
 }
 
@@ -164,7 +165,8 @@ async function authenticateWithAdmin(
   groupsSearchBase,
   groupClass,
   groupMemberAttribute = 'member',
-  groupMemberUserAttribute
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   var ldapAdminClient
   try {
@@ -181,7 +183,8 @@ async function authenticateWithAdmin(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   ldapAdminClient.unbind()
   if (!user || !user.dn) {
@@ -237,7 +240,8 @@ async function authenticateWithUser(
   groupsSearchBase,
   groupClass,
   groupMemberAttribute = 'member',
-  groupMemberUserAttribute
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   let ldapUserClient
   try {
@@ -254,7 +258,8 @@ async function authenticateWithUser(
     ldapUserClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   if (!user || !user.dn) {
     ldapOpts.log &&
@@ -297,7 +302,8 @@ async function verifyUserExists(
   groupsSearchBase,
   groupClass,
   groupMemberAttribute = 'member',
-  groupMemberUserAttribute
+  groupMemberUserAttribute = 'dn',
+  attributes = null
 ) {
   var ldapAdminClient
   try {
@@ -314,7 +320,8 @@ async function verifyUserExists(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
-    username
+    username,
+    attributes
   )
   ldapAdminClient.unbind()
   if (!user || !user.dn) {
@@ -406,7 +413,8 @@ async function authenticate(options) {
       options.groupsSearchBase,
       options.groupClass,
       options.groupMemberAttribute,
-      options.groupMemberUserAttribute
+      options.groupMemberUserAttribute,
+      options.attributes
     )
   }
   assert(options.userDn, 'adminDn/adminPassword OR userDn must be provided')
@@ -421,7 +429,8 @@ async function authenticate(options) {
     options.groupsSearchBase,
     options.groupClass,
     options.groupMemberAttribute,
-    options.groupMemberUserAttribute
+    options.groupMemberUserAttribute,
+    options.attributes
   )
 }
 

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "ldap-authentication",
-  "version": "2.2.9",
+  "version": "2.3.0",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
+  "types": "./index.d.ts",
   "scripts": {
     "test": "node test/jasmine.js"
   },
@@ -35,9 +36,9 @@
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapjs": "^2.3.1"
+    "ldapjs": "^2.3.3"
   },
   "devDependencies": {
-    "jasmine": "^3.9.0"
+    "jasmine": "^4.3.0"
   }
 }

package/test/test.js

@@ -33,6 +33,25 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
   })
+  it('Use an admin user to authenticate a regular user and return attrubutes', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      attributes: ['uid', 'sn'],
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Gauss')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an regular user to authenticate iteself', async () => {
     let options = {
       ldapOpts: {
@@ -48,6 +67,24 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
   })
+  it('Use an regular user to authenticate iteself and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: 'ldap://ldap.forumsys.com',
+      },
+      userDn: 'uid=einstein,dc=example,dc=com',
+      userPassword: 'password',
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'einstein',
+      attributes: ['uid', 'sn'],
+    }
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('einstein')
+    expect(user.sn).toEqual('Einstein')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an regular user to authenticate iteself without search', async () => {
     let options = {
       ldapOpts: {