ldap-authentication 3.1.0 → 3.2.2

package/.devcontainer/docker-compose.yml

@@ -18,3 +18,4 @@ services:
       - LDAP_ADMIN_PASSWORD=password
       - LDAP_USERS=gauss,einstein
       - LDAP_PASSWORDS=password,password
+      - LDAP_GROUP=科学A部

package/.github/workflows/integration-test.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [16.x, 17.x, 18.x, 20.x]
+        node-version: [16.x, 17.x, 18.x, 20.x, 22.x]
 
     name: 'Integration Node v${{ matrix.node-version }}'
 

package/.vscode/launch.json

@@ -10,6 +10,13 @@
       "name": "Debug Example",
       "skipFiles": ["<node_internals>/**"],
       "program": "${workspaceFolder}/example/index.js"
+    },
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Debug Test",
+      "skipFiles": ["<node_internals>/**"],
+      "program": "${workspaceFolder}/test/jasmine.js"
     }
   ]
 }

package/README.md

@@ -221,4 +221,4 @@ export async function verifyLogin(email: string, password: string) {
 
 Version 2 supports Node version 12, 14, 15, 16, 17 and 18.
 
-Version 3 supports Node version 15, 16, 17 and 18
+Version 3 supports Node version 16, 17, 18, 20 and 22,

package/docker-compose.yml

@@ -10,3 +10,4 @@ services:
       - LDAP_ADMIN_PASSWORD=password
       - LDAP_USERS=gauss,einstein
       - LDAP_PASSWORDS=password,password
+      - LDAP_GROUP=科学A部

package/index.js

@@ -1,6 +1,46 @@
 const assert = require('assert')
 const ldap = require('ldapjs')
 
+// convert an escaped utf8 string returned from ldapjs
+function _isHex(c) {
+  return (
+    (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')
+  )
+}
+function _parseEscapedHexToUtf8(s) {
+  // convert 'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8,ou=users,dc=example,dc=com'
+  // to 'cn=研发A部,ou=users,dc=example,dc=com'
+  let ret = Buffer.alloc(0)
+  let len = s.length
+  for (let i = 0; i < len; i++) {
+    let c = s[i]
+    let item
+    if (c == '\\' && i < len - 2 && _isHex(s[i + 1]) && _isHex(s[i + 2])) {
+      item = Buffer.from(s.substring(i + 1, i + 3), 'hex')
+      i += 2
+    } else {
+      item = Buffer.from(c)
+    }
+    ret = Buffer.concat([ret, item])
+  }
+  return ret.toString()
+}
+
+function _recursiveParseHexString(obj) {
+  if (Array.isArray(obj)) {
+    return obj.map((ele) => _recursiveParseHexString(ele))
+  }
+  if (typeof obj == 'string') {
+    return _parseEscapedHexToUtf8(obj)
+  }
+  if (typeof obj == 'object') {
+    for (let key in obj) {
+      obj[key] = _recursiveParseHexString(obj[key])
+    }
+    return obj
+  }
+  return obj
+}
 // convert a SearchResultEntry object in ldapjs 3.0
 // to a user object to maintain backward compatibility
 
@@ -11,13 +51,13 @@ function _searchResultToUser(pojo) {
     user[attribute.type] =
       attribute.values.length == 1 ? attribute.values[0] : attribute.values
   })
-  return user
+  return _recursiveParseHexString(user)
 }
 // bind and return the ldap client
 function _ldapBind(dn, password, starttls, ldapOpts) {
   return new Promise(function (resolve, reject) {
     ldapOpts.connectTimeout = ldapOpts.connectTimeout || 5000
-    var client = ldap.createClient(ldapOpts)
+    let client = ldap.createClient(ldapOpts)
 
     client.on('connect', function () {
       if (starttls) {
@@ -29,7 +69,6 @@ function _ldapBind(dn, password, starttls, ldapOpts) {
           client.bind(dn, password, function (err) {
             if (err) {
               reject(err)
-              client.unbind()
               return
             }
             ldapOpts.log && ldapOpts.log.trace('bind success!')
@@ -40,7 +79,6 @@ function _ldapBind(dn, password, starttls, ldapOpts) {
         client.bind(dn, password, function (err) {
           if (err) {
             reject(err)
-            client.unbind()
             return
           }
           ldapOpts.log && ldapOpts.log.trace('bind success!')
@@ -78,7 +116,7 @@ async function _searchUser(
   attributes = null
 ) {
   return new Promise(function (resolve, reject) {
-    var filter = new ldap.filters.EqualityFilter({
+    let filter = new ldap.filters.EqualityFilter({
       attribute: usernameAttribute,
       value: username,
     })
@@ -91,10 +129,9 @@ async function _searchUser(
       searchOptions.attributes = attributes
     }
     ldapClient.search(searchBase, searchOptions, function (err, res) {
-      var user = null
+      let user = null
       if (err) {
         reject(err)
-        ldapClient.unbind()
         return
       }
       res.on('searchEntry', function (entry) {
@@ -110,7 +147,6 @@ async function _searchUser(
       })
       res.on('error', function (err) {
         reject(err)
-        ldapClient.unbind()
       })
       res.on('end', function (result) {
         if (result.status != 0) {
@@ -118,7 +154,6 @@ async function _searchUser(
         } else {
           resolve(user)
         }
-        ldapClient.unbind()
       })
     })
   })
@@ -141,19 +176,17 @@ async function _searchUserGroups(
         scope: 'sub',
       },
       function (err, res) {
-        var groups = []
+        let groups = []
         if (err) {
           reject(err)
-          ldapClient.unbind()
           return
         }
         res.on('searchEntry', function (entry) {
-          groups.push(entry.pojo)
+          groups.push(_recursiveParseHexString(entry.pojo))
         })
         res.on('searchReference', function (referral) {})
         res.on('error', function (err) {
           reject(err)
-          ldapClient.unbind()
         })
         res.on('end', function (result) {
           if (result.status != 0) {
@@ -161,7 +194,6 @@ async function _searchUserGroups(
           } else {
             resolve(groups)
           }
-          ldapClient.unbind()
         })
       }
     )
@@ -183,7 +215,7 @@ async function authenticateWithAdmin(
   groupMemberUserAttribute = 'dn',
   attributes = null
 ) {
-  var ldapAdminClient
+  let ldapAdminClient
   try {
     ldapAdminClient = await _ldapBind(
       adminDn,
@@ -194,14 +226,13 @@ async function authenticateWithAdmin(
   } catch (error) {
     throw { admin: error }
   }
-  var user = await _searchUser(
+  let user = await _searchUser(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
     username,
     attributes
   )
-  ldapAdminClient.unbind()
   if (!user || !user.dn) {
     ldapOpts.log &&
       ldapOpts.log.trace(
@@ -211,26 +242,15 @@ async function authenticateWithAdmin(
       'user not found or usernameAttribute is wrong'
     )
   }
-  var userDn = user.dn
+  let userDn = user.dn
   let ldapUserClient
   try {
     ldapUserClient = await _ldapBind(userDn, userPassword, starttls, ldapOpts)
   } catch (error) {
     throw error
   }
-  ldapUserClient.unbind()
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
-    try {
-      ldapAdminClient = await _ldapBind(
-        adminDn,
-        adminPassword,
-        starttls,
-        ldapOpts
-      )
-    } catch (error) {
-      throw error
-    }
-    var groups = await _searchUserGroups(
+    let groups = await _searchUserGroups(
       ldapAdminClient,
       groupsSearchBase,
       user,
@@ -239,7 +259,6 @@ async function authenticateWithAdmin(
       groupMemberUserAttribute
     )
     user.groups = groups
-    ldapAdminClient.unbind()
   }
   return user
 }
@@ -266,10 +285,9 @@ async function authenticateWithUser(
   }
   if (!usernameAttribute || !userSearchBase) {
     // if usernameAttribute is not provided, no user detail is needed.
-    ldapUserClient.unbind()
     return true
   }
-  var user = await _searchUser(
+  let user = await _searchUser(
     ldapUserClient,
     userSearchBase,
     usernameAttribute,
@@ -285,14 +303,8 @@ async function authenticateWithUser(
       'user logged in, but user details could not be found. Probabaly usernameAttribute or userSearchBase is wrong?'
     )
   }
-  ldapUserClient.unbind()
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
-    try {
-      ldapUserClient = await _ldapBind(userDn, userPassword, starttls, ldapOpts)
-    } catch (error) {
-      throw error
-    }
-    var groups = await _searchUserGroups(
+    let groups = await _searchUserGroups(
       ldapUserClient,
       groupsSearchBase,
       user,
@@ -301,7 +313,6 @@ async function authenticateWithUser(
       groupMemberUserAttribute
     )
     user.groups = groups
-    ldapUserClient.unbind()
   }
   return user
 }
@@ -320,7 +331,7 @@ async function verifyUserExists(
   groupMemberUserAttribute = 'dn',
   attributes = null
 ) {
-  var ldapAdminClient
+  let ldapAdminClient
   try {
     ldapAdminClient = await _ldapBind(
       adminDn,
@@ -331,14 +342,13 @@ async function verifyUserExists(
   } catch (error) {
     throw { admin: error }
   }
-  var user = await _searchUser(
+  let user = await _searchUser(
     ldapAdminClient,
     userSearchBase,
     usernameAttribute,
     username,
     attributes
   )
-  ldapAdminClient.unbind()
   if (!user || !user.dn) {
     ldapOpts.log &&
       ldapOpts.log.trace(
@@ -349,17 +359,7 @@ async function verifyUserExists(
     )
   }
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
-    try {
-      ldapAdminClient = await _ldapBind(
-        adminDn,
-        adminPassword,
-        starttls,
-        ldapOpts
-      )
-    } catch (error) {
-      throw error
-    }
-    var groups = await _searchUserGroups(
+    let groups = await _searchUserGroups(
       ldapAdminClient,
       groupsSearchBase,
       user,
@@ -368,7 +368,6 @@ async function verifyUserExists(
       groupMemberUserAttribute
     )
     user.groups = groups
-    ldapAdminClient.unbind()
   }
   return user
 }
@@ -463,3 +462,9 @@ class LdapAuthenticationError extends Error {
 
 module.exports.authenticate = authenticate
 module.exports.LdapAuthenticationError = LdapAuthenticationError
+
+module.exports.exportForTesting = {
+  _isHex,
+  _parseEscapedHexToUtf8,
+  _recursiveParseHexString,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "3.1.0",
+  "version": "3.2.2",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",

package/test/jasmine.js

@@ -3,7 +3,7 @@ var jasmine = new Jasmine()
 
 jasmine.loadConfig({
   spec_dir: 'test',
-  spec_files: ['test.js'],
+  spec_files: ['**/*[sS]pec.?(m)js'],
   random: false,
   seed: null,
   stopSpecOnExpectationFailure: false,

package/test/string.spec.js

@@ -0,0 +1,43 @@
+const { exportForTesting } = require('../index.js')
+const { _isHex, _parseEscapedHexToUtf8, _recursiveParseHexString } =
+  exportForTesting
+
+describe('string conversion test', () => {
+  it('unescape string test', () => {
+    let s =
+      'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8,ou=users,dc=example,dc=com'
+    let us = _parseEscapedHexToUtf8(s)
+    expect(us).toEqual('cn=研发A部,ou=users,dc=example,dc=com')
+  })
+  it('unescape string test2', () => {
+    let s =
+      'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9,ou=users,dc=example,dc=com'
+    let us = _parseEscapedHexToUtf8(s)
+    expect(us).toEqual('cn=研发A部©,ou=users,dc=example,dc=com')
+  })
+  it('unescape string test3', () => {
+    let s = 'cn=ABC,ou=users,dc=example,dc=com'
+    let us = _parseEscapedHexToUtf8(s)
+    expect(us).toEqual('cn=ABC,ou=users,dc=example,dc=com')
+  })
+  it('convert obj', () => {
+    let target = {
+      a: ['研发A部©', 'abc'],
+      b: 'xyz',
+      c: true,
+      d: null,
+      e: '研发A部©',
+      f: 1000,
+    }
+    let obj = {
+      a: ['\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9', 'abc'],
+      b: 'xyz',
+      c: true,
+      d: null,
+      e: '\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9',
+      f: 1000,
+    }
+    let converted = _recursiveParseHexString(obj)
+    expect(converted).toEqual(target)
+  })
+})

package/test/{test.js → test.spec.js}

@@ -124,6 +124,9 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
+    expect(user.groups[0].objectName).toEqual(
+      'cn=科学A部,ou=users,dc=example,dc=com'
+    )
   })
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
@@ -144,6 +147,9 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
+    expect(user.groups[0].objectName).toEqual(
+      'cn=科学A部,ou=users,dc=example,dc=com'
+    )
   })
   it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {
     let options = {