ldap-authentication 2.3.2 → 3.0.1

package/.devcontainer/Dockerfile

@@ -0,0 +1,5 @@
+FROM mcr.microsoft.com/devcontainers/typescript-node:18
+
+RUN ln -s /usr/bin/gpg /usr/local/bin/gpg
+RUN apt update && apt install ldap-utils -y
+

package/.devcontainer/devcontainer.json

@@ -0,0 +1,24 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/postgres
+{
+  "name": "ldap-authentication",
+  "dockerComposeFile": ["./docker-compose.yml"],
+  "service": "ldap-authentication",
+  "workspaceFolder": "/workspace",
+  // Features to add to the dev container. More info: https://containers.dev/features.
+  // "features": {},
+  // Use 'forwardPorts' to make a list of ports inside the container available locally.
+  // This can be used to network with other containers or the host.
+  // "forwardPorts": [5000, 5432],
+  // Use 'postCreateCommand' to run commands after the container is created.
+  "postCreateCommand": "npm install",
+  // Configure tool-specific properties.
+  // "customizations": {},
+  "customizations": {
+    "vscode": {
+      "extensions": ["esbenp.prettier-vscode", "ms-azuretools.vscode-docker"]
+    }
+  }
+  // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+  // "remoteUser": "root"
+}

package/.devcontainer/docker-compose.yml

@@ -0,0 +1,22 @@
+version: "3"
+
+services:
+  ldap-authentication:
+    build:
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
+    volumes:
+      - ..:/workspace:cached
+    command: sleep infinity
+    
+  ldap:
+    image: bitnami/openldap
+    ports:
+      - '1389:1389'
+      - '1636:1636'
+    environment:
+      - LDAP_ROOT=dc=example,dc=com
+      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_ADMIN_PASSWORD=password
+      - LDAP_USERS=gauss,einstein
+      - LDAP_PASSWORDS=password,password

package/.github/workflows/integration-test.yml

@@ -0,0 +1,54 @@
+name: 'Integration Tests'
+
+env:
+  INGITHUB: true
+
+on:
+  push:
+    paths-ignore:
+      - 'README.md'
+      - 'LICENSE'
+      - 'SECURITY.md'
+  pull_request:
+
+jobs:
+  integration:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [15.x, 16.x, 17.x, 18.x]
+
+    name: 'Integration Node v${{ matrix.node-version }}'
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install LDAP tools
+        run: sudo apt-get install -y ldap-utils
+
+      - name: Start containers
+        run: docker-compose -f "docker-compose.yml" up -d
+
+      - name: Wait for LDAP server to become available
+        uses: nick-fields/retry@v2
+        with:
+          timeout_minutes: 5
+          max_attempts: 10
+          polling_interval_seconds: 3
+          command: |
+            ldapsearch -LLL -o 'ldif-wrap=no' \
+              -H ldap://localhost:1389 \
+              -D 'cn=read-only-admin,dc=example,dc=com' \
+              -w password \
+              -b 'cn=einstein,ou=users,dc=example,dc=com' DN
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: npm install
+      - run: npm run test
+
+      - name: Stop containers
+        if: always()
+        run: docker-compose -f "docker-compose.yml" down

package/.vscode/launch.json

@@ -0,0 +1,15 @@
+{
+  // Use IntelliSense to learn about possible attributes.
+  // Hover to view descriptions of existing attributes.
+  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Debug Example",
+      "skipFiles": ["<node_internals>/**"],
+      "program": "${workspaceFolder}/example/index.js"
+    }
+  ]
+}

package/README.md

@@ -1,6 +1,6 @@
 # A Simple node Library that Authenticates a User Against an LDAP/AD Server
 
-[![Build Status](https://travis-ci.org/shaozi/ldap-authentication.svg?branch=master)](https://travis-ci.org/shaozi/ldap-authentication)
+[![Integration Tests](https://github.com/shaozi/ldap-authentication/actions/workflows/integration-test.yml/badge.svg)](https://github.com/shaozi/ldap-authentication/actions/workflows/integration-test.yml)
 [![Known Vulnerabilities](https://snyk.io/test/github/shaozi/ldap-authentication/badge.svg?targetFile=package.json)](https://snyk.io/test/github/shaozi/ldap-authentication?targetFile=package.json)
 
 ## Goal
@@ -176,3 +176,48 @@ auth()
 - `groupClass`: if specified with groupsSearchBase, will be used as objectClass in search filter for authenticated user groups
 - `groupMemberAttribute`: if specified with groupClass and groupsSearchBase, will be used as member name (if not specified this defaults to `member`) in search filter for authenticated user groups
 - `groupMemberUserAttribute`: if specified with groupClass and groupsSearchBase, will be used as the attribute on the user object (if not specified this defaults to `dn`) in search filter for authenticated user groups
+
+## Returns
+
+The user object if `authenticate()` is success.
+
+In version 2, The user object has a `raw` field that has the raw data from the LDAP/AD server. It can be used to access buffer objects (profile pics for example).
+
+Buffer data can now be accessed by `user.raw.profilePhoto`, etc, instead of `user.profilePhoto`.
+
+In version 3, the `raw` field is no longer used. Instead, append `;binary` to the attributes you
+want to get back as buffer. Check the following example on how to get a user's profile photo:
+
+```javascript
+export async function verifyLogin(email: string, password: string) {
+
+  const options = {
+   //...other config options
+    userPassword: password,
+    username: email,
+    attributes: ['thumbnailPhoto;binary', 'givenName', 'sn', 'sAMAccountName', 'userPrincipalName', 'memberOf' ]
+  };
+
+  try {
+    const ldapUser = await authenticate(options);
+
+    if (!ldapUser) {
+      return { error: "user not found" };
+    }
+
+    // accessing the image
+    const profilePhoto = ldapUser['thumbnailPhoto;binary'];
+
+    /* using the image
+	<img src={`data:image/*;base64,${user.profilePhoto}`} />
+    */
+    return { user: ldapUser };
+  }
+}
+```
+
+## Supported Node Versions
+
+Version 2 supports Node version 12, 14, 15, 16, 17 and 18.
+
+Version 3 supports Node version 15, 16, 17 and 18

package/docker-compose.yml

@@ -0,0 +1,13 @@
+version: "3"
+services:
+  ldap:
+    image: bitnami/openldap:2.6.3
+    ports:
+      - '1389:1389'
+      - '1636:1636'
+    environment:
+      - LDAP_ROOT=dc=example,dc=com
+      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_ADMIN_PASSWORD=password
+      - LDAP_USERS=gauss,einstein
+      - LDAP_PASSWORDS=password,password

package/index.js

@@ -1,6 +1,18 @@
 const assert = require('assert')
 const ldap = require('ldapjs')
 
+// convert a SearchResultEntry object in ldapjs 3.0
+// to a user object to maintain backward compatibility
+
+function _searchResultToUser(pojo) {
+  assert(pojo.type == 'SearchResultEntry')
+  let user = { dn: pojo.objectName }
+  pojo.attributes.forEach((attribute) => {
+    user[attribute.type] =
+      attribute.values.length == 1 ? attribute.values[0] : attribute.values
+  })
+  return user
+}
 // bind and return the ldap client
 function _ldapBind(dn, password, starttls, ldapOpts) {
   return new Promise(function (resolve, reject) {
@@ -86,7 +98,7 @@ async function _searchUser(
         return
       }
       res.on('searchEntry', function (entry) {
-        user = entry.object
+        user = _searchResultToUser(entry.pojo)
       })
       res.on('searchReference', function (referral) {
         // TODO: we don't support reference yet

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "2.3.2",
+  "version": "3.0.1",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
@@ -36,9 +36,9 @@
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapjs": "^2.3.3"
+    "ldapjs": "^3.0.1"
   },
   "devDependencies": {
-    "jasmine": "^4.4.0"
+    "jasmine": "^4.6.0"
   }
 }

package/test/test.js

@@ -1,10 +1,12 @@
 const { authenticate, LdapAuthenticationError } = require('../index.js')
 
+const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+
 describe('ldap-authentication test', () => {
   it('Use an admin user to check if user exists', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -13,6 +15,7 @@ describe('ldap-authentication test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
@@ -20,7 +23,7 @@ describe('ldap-authentication test', () => {
   it('Use an admin user to authenticate a regular user', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -29,6 +32,7 @@ describe('ldap-authentication test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
@@ -36,7 +40,7 @@ describe('ldap-authentication test', () => {
   it('Use an admin user to authenticate a regular user and return attrubutes', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -46,23 +50,25 @@ describe('ldap-authentication test', () => {
       username: 'gauss',
       attributes: ['uid', 'sn'],
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
-    expect(user.sn).toEqual('Gauss')
+    expect(user.sn).toEqual('Bar1')
     expect(user.cn).toBeUndefined()
   })
   it('Use an regular user to authenticate iteself', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'einstein',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
@@ -70,36 +76,38 @@ describe('ldap-authentication test', () => {
   it('Use an regular user to authenticate iteself and return attributes', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'einstein',
       attributes: ['uid', 'sn'],
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('einstein')
-    expect(user.sn).toEqual('Einstein')
+    expect(user.sn).toEqual('Bar2')
     expect(user.cn).toBeUndefined()
   })
   it('Use an regular user to authenticate iteself without search', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
   })
   it('Use an admin user to authenticate a regular user and fetch user group information', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -108,10 +116,11 @@ describe('ldap-authentication test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
       groupsSearchBase: 'dc=example,dc=com',
-      groupClass: 'groupOfUniqueNames',
-      groupMemberAttribute: 'uniqueMember',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dn',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
@@ -119,18 +128,19 @@ describe('ldap-authentication test', () => {
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=gauss,dc=example,dc=com',
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'gauss',
       groupsSearchBase: 'dc=example,dc=com',
-      groupClass: 'groupOfUniqueNames',
-      groupMemberAttribute: 'uniqueMember',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dn',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
@@ -138,9 +148,9 @@ describe('ldap-authentication test', () => {
   it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=gauss,dc=example,dc=com',
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
@@ -148,6 +158,7 @@ describe('ldap-authentication test', () => {
       groupsSearchBase: 'dc=example,dc=com',
       groupClass: 'groupOfUniqueNames',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeLessThan(1)
@@ -158,7 +169,7 @@ describe('ldap-authentication negative test', () => {
   it('wrong admin user should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=not-exist,dc=example,dc=com',
       adminPassword: 'password',
@@ -167,18 +178,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('wrong admin password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: '',
@@ -187,18 +200,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('admin auth wrong username should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -207,18 +222,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'wrong',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('admin auth wrong user password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       adminDn: 'cn=read-only-admin,dc=example,dc=com',
       adminPassword: 'password',
@@ -227,18 +244,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('user auth wrong username should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       userDn: 'cn=not-exist,dc=example,dc=com',
       userPassword: 'password',
@@ -246,18 +265,20 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('user auth wrong user password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       userDn: 'cn=gauss,dc=example,dc=com',
       userPassword: 'wrongpassword',
@@ -265,45 +286,51 @@ describe('ldap-authentication negative test', () => {
       usernameAttribute: 'uid',
       username: 'gauss',
     }
+
     let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Use an regular user to authenticate iteself without search with wrong password should fail', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
       userDn: 'uid=einstein,dc=example,dc=com',
       userPassword: '',
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Wrong options give LdapAuthenticationError', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=einstein,dc=example,dc=com',
+      userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      usernameAttribute: 'cn',
+      usernameAttribute: 'wrongattribute',
       userSearchBase: 'dc=example,dc=com',
       username: 'einstein',
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
     expect(e).toBeInstanceOf(LdapAuthenticationError)
   })
@@ -319,11 +346,13 @@ describe('ldap-authentication negative test', () => {
       userSearchBase: 'dc=example,dc=com',
       username: 'einstein',
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Unreachable ldap server should throw error (with starttls=true)', async () => {
@@ -339,28 +368,31 @@ describe('ldap-authentication negative test', () => {
       username: 'einstein',
       starttls: true,
     }
+
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
+
     expect(e).toBeTruthy()
   })
   it('Unmatched supplied groupMemberUserAttribute should return empty group list', async () => {
     let options = {
       ldapOpts: {
-        url: 'ldap://ldap.forumsys.com',
+        url: url,
       },
-      userDn: 'uid=gauss,dc=example,dc=com',
+      userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
       userSearchBase: 'dc=example,dc=com',
       usernameAttribute: 'uid',
       username: 'gauss',
       groupsSearchBase: 'dc=example,dc=com',
-      groupClass: 'groupOfUniqueNames',
-      groupMemberAttribute: 'uniqueMember',
-      groupMemberUserAttribute: 'notARealGroupMemberUserAttribute',
+      groupClass: 'groupOfNames',
+      groupMemberAttribute: 'member',
+      groupMemberUserAttribute: 'dnWRONG',
     }
+
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeLessThan(1)

package/.travis.yml

@@ -1,3 +0,0 @@
-language: node_js
-node_js:
-  - "12"