ldap-authentication 2.3.1 → 2.3.3

package/.devcontainer/Dockerfile

@@ -0,0 +1,5 @@
+FROM mcr.microsoft.com/devcontainers/typescript-node:18
+
+RUN ln -s /usr/bin/gpg /usr/local/bin/gpg
+RUN apt update && apt install ldap-utils -y
+

package/.devcontainer/devcontainer.json

@@ -0,0 +1,24 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/postgres
+{
+  "name": "ldap-authentication",
+  "dockerComposeFile": ["./docker-compose.yml"],
+  "service": "ldap-authentication",
+  "workspaceFolder": "/workspace",
+  // Features to add to the dev container. More info: https://containers.dev/features.
+  // "features": {},
+  // Use 'forwardPorts' to make a list of ports inside the container available locally.
+  // This can be used to network with other containers or the host.
+  // "forwardPorts": [5000, 5432],
+  // Use 'postCreateCommand' to run commands after the container is created.
+  "postCreateCommand": "npm install",
+  // Configure tool-specific properties.
+  // "customizations": {},
+  "customizations": {
+    "vscode": {
+      "extensions": ["esbenp.prettier-vscode", "ms-azuretools.vscode-docker"]
+    }
+  }
+  // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+  // "remoteUser": "root"
+}

package/.devcontainer/docker-compose.yml

@@ -0,0 +1,22 @@
+version: "3"
+
+services:
+  ldap-authentication:
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
+    volumes:
+      - ..:/workspace:cached
+    command: sleep infinity
+    
+  ldap:
+    image: bitnami/openldap
+    ports:
+      - '1389:1389'
+      - '1636:1636'
+    environment:
+      - LDAP_ROOT=dc=example,dc=com
+      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_ADMIN_PASSWORD=password
+      - LDAP_USERS=gauss,einstein
+      - LDAP_PASSWORDS=password,password

package/.github/workflows/integration-test.yml

@@ -0,0 +1,54 @@
+name: 'Integration Tests'
+
+env:
+  INGITHUB: true
+
+on:
+  push:
+    paths-ignore:
+      - 'README.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
+  pull_request:
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 15.x, 16.x, 17.x, 18.x]
+
+    name: 'Integration Node v${{ matrix.node-version }}'
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install LDAP tools
+        run: sudo apt-get install -y ldap-utils
+
+      - name: Start containers
+        run: docker-compose -f "docker-compose.yml" up -d
+
+      - name: Wait for LDAP server to become available
+        uses: nick-fields/retry@v2
+        with:
+          timeout_minutes: 5
+          max_attempts: 10
+          polling_interval_seconds: 3
+          command: |
+            ldapsearch -LLL -o 'ldif-wrap=no' \
+              -H ldap://localhost:1389 \
+              -D 'cn=read-only-admin,dc=example,dc=com' \
+              -w password \
+              -b 'cn=einstein,ou=users,dc=example,dc=com' DN
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm install
+      - run: npm run test
+
+      - name: Stop containers
+        if: always()
+        run: docker-compose -f "docker-compose.yml" down

package/README.md

@@ -1,6 +1,6 @@
 # A Simple node Library that Authenticates a User Against an LDAP/AD Server
 
-[![Build Status](https://travis-ci.org/shaozi/ldap-authentication.svg?branch=master)](https://travis-ci.org/shaozi/ldap-authentication)
+[![Integration Tests](https://github.com/shaozi/ldap-authentication/actions/workflows/integration-test.yml/badge.svg)](https://github.com/shaozi/ldap-authentication/actions/workflows/integration-test.yml)
 [![Known Vulnerabilities](https://snyk.io/test/github/shaozi/ldap-authentication/badge.svg?targetFile=package.json)](https://snyk.io/test/github/shaozi/ldap-authentication?targetFile=package.json)
 
 ## Goal
@@ -176,3 +176,24 @@ auth()
 - `groupClass`: if specified with groupsSearchBase, will be used as objectClass in search filter for authenticated user groups
 - `groupMemberAttribute`: if specified with groupClass and groupsSearchBase, will be used as member name (if not specified this defaults to `member`) in search filter for authenticated user groups
 - `groupMemberUserAttribute`: if specified with groupClass and groupsSearchBase, will be used as the attribute on the user object (if not specified this defaults to `dn`) in search filter for authenticated user groups
+
+## Returns
+
+The user object if `authenticate()` is success.
+
+The user object has a `raw` field that has the raw data from the LDAP/AD server. It can be used to access buffer objects (profile pics for example).
+Buffer data can now be accessed by `user.raw.profilePhoto`, etc, instead of `user.profilePhoto`.
+
+
+
+
+
+
+
+
+
+
+
+
+
+

package/docker-compose.yml

@@ -0,0 +1,13 @@
+version: "3"
+services:
+  ldap:
+    image: bitnami/openldap:2.6.3
+    ports:
+      - '1389:1389'
+      - '1636:1636'
+    environment:
+      - LDAP_ROOT=dc=example,dc=com
+      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_ADMIN_PASSWORD=password
+      - LDAP_USERS=gauss,einstein
+      - LDAP_PASSWORDS=password,password

package/index.d.ts

@@ -1,13 +1,8 @@
+import { ClientOptions } from 'ldapjs'
+
 declare module 'ldap-authentication' {
-  type LDAPOpts = {
-    url: string
-    tlsOptions?: {
-      rejectUnauthorized: boolean
-    }
-    connectTimeout?: number
-  }
-  export type AuthenticationOptions = {
-    ldapOpts: LDAPOpts
+  export interface AuthenticationOptions {
+    ldapOpts: ClientOptions
     userDn?: string
     adminDn?: string
     adminPassword?: string
@@ -15,7 +10,7 @@ declare module 'ldap-authentication' {
     usernameAttribute?: string
     username?: string
     verifyUserExists?: boolean
-    starttls?: Boolean
+    starttls?: boolean
     groupsSearchBase?: string
     groupClass?: string
     groupMemberAttribute?: string

package/index.js

@@ -87,6 +87,7 @@ async function _searchUser(
       }
       res.on('searchEntry', function (entry) {
         user = entry.object
+        user.raw = entry.raw
       })
       res.on('searchReference', function (referral) {
         // TODO: we don't support reference yet

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
@@ -39,6 +39,6 @@
     "ldapjs": "^2.3.3"
   },
   "devDependencies": {
-    "jasmine": "^4.3.0"
+    "jasmine": "^4.5.0"
   }
 }

package/test/test.js

@@ -1,10 +1,12 @@
 const { authenticate, LdapAuthenticationError } = require('../index.js')
 
+const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+
 describe('ldap-authentication test', () => {
   it('Use an admin user to check if user exists', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -13,6 +15,7 @@ describe('ldap-authentication test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
@@ -20,7 +23,7 @@ describe('ldap-authentication test', () => {
   it('Use an admin user to authenticate a regular user', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -29,6 +32,7 @@ describe('ldap-authentication test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
@@ -36,7 +40,7 @@ describe('ldap-authentication test', () => {
   it('Use an admin user to authenticate a regular user and return attrubutes', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -46,60 +50,65 @@ describe('ldap-authentication test', () => {
       username: 'gauss',
       attributes: ['uid', 'sn'],
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
-    expect(user.sn).toEqual('Gauss')
+    expect(user.sn).toEqual('Bar1')
     expect(user.cn).toBeUndefined()
   })
   it('Use an regular user to authenticate iteself', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'einstein',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
+    expect(user.raw).toBeTruthy()
   })
   it('Use an regular user to authenticate iteself and return attributes', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'einstein',
       attributes: ['uid', 'sn'],
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
-    expect(user.sn).toEqual('Einstein')
+    expect(user.sn).toEqual('Bar2')
     expect(user.cn).toBeUndefined()
   })
   it('Use an regular user to authenticate iteself without search', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
   })
   it('Use an admin user to authenticate a regular user and fetch user group information', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -108,10 +117,11 @@ describe('ldap-authentication test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
       groupsSearchBase: 'dc=example,dc=com',
-      groupClass: 'groupOfUniqueNames',
-      groupMemberAttribute: 'uniqueMember',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dn',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
@@ -119,18 +129,19 @@ describe('ldap-authentication test', () => {
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=gauss,dc=example,dc=com',
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'gauss',
       groupsSearchBase: 'dc=example,dc=com',
-      groupClass: 'groupOfUniqueNames',
-      groupMemberAttribute: 'uniqueMember',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dn',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
@@ -138,9 +149,9 @@ describe('ldap-authentication test', () => {
   it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=gauss,dc=example,dc=com',
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
@@ -148,6 +159,7 @@ describe('ldap-authentication test', () => {
       groupsSearchBase: 'dc=example,dc=com',
       groupClass: 'groupOfUniqueNames',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeLessThan(1)
@@ -158,7 +170,7 @@ describe('ldap-authentication negative test', () => {
   it('wrong admin user should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=not-exist,dc=example,dc=com',
       adminPassword: 'password',
@@ -167,18 +179,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('wrong admin password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: '',
@@ -187,18 +201,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('admin auth wrong username should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -207,18 +223,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'wrong',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('admin auth wrong user password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -227,18 +245,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('user auth wrong username should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       userDn: 'cn=not-exist,dc=example,dc=com',
       userPassword: 'password',
@@ -246,18 +266,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('user auth wrong user password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       userDn: 'cn=gauss,dc=example,dc=com',
       userPassword: 'wrongpassword',
@@ -265,45 +287,51 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Use an regular user to authenticate iteself without search with wrong password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       userDn: 'uid=einstein,dc=example,dc=com',
       userPassword: '',
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Wrong options give LdapAuthenticationError', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      usernameAttribute: 'cn',
+      usernameAttribute: 'wrongattribute',
       userSearchBase: 'dc=example,dc=com',
       username: 'einstein',
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
     expect(e).toBeInstanceOf(LdapAuthenticationError)
   })
@@ -319,11 +347,13 @@ describe('ldap-authentication negative test', () => {
       userSearchBase: 'dc=example,dc=com',
       username: 'einstein',
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Unreachable ldap server should throw error (with starttls=true)', async () => {
@@ -339,28 +369,31 @@ describe('ldap-authentication negative test', () => {
       username: 'einstein',
       starttls: true,
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Unmatched supplied groupMemberUserAttribute should return empty group list', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=gauss,dc=example,dc=com',
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'gauss',
       groupsSearchBase: 'dc=example,dc=com',
-      groupClass: 'groupOfUniqueNames',
-      groupMemberAttribute: 'uniqueMember',
-      groupMemberUserAttribute: 'notARealGroupMemberUserAttribute',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
+      groupMemberUserAttribute: 'dnWRONG',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeLessThan(1)

package/.travis.yml

@@ -1,3 +0,0 @@
-language: node_js
-node_js:
-  - "12"