ldap-authentication 3.2.4 → 3.3.1

package/index.js

@@ -1,5 +1,42 @@
 const assert = require('assert')
-const ldap = require('ldapjs')
+const ldapts = require('ldapts')
+// escape the , in CN in DN
+function _ldapEscapeDN(s) {
+  let ret = "";
+  let comaPositions = [];
+  let done = false;
+  let countEq = 0;
+  for (let i = 0; !done && i < s.length; i++) {
+    switch (s[i]) {
+      case "\\":
+        // user already escapped, continue
+        i++;
+        break;
+      case ",":
+        if (countEq == 1) {
+          comaPositions.push(i);
+        }
+        break;
+      case "=":
+        countEq++;
+        if (countEq == 2) {
+          done = true;
+        }
+        break;
+    }
+  }
+  if (done) {
+    comaPositions.pop();
+  }
+  let lastIndex = 0;
+  for (let i of comaPositions) {
+    ret += s.substring(lastIndex, i);
+    ret += "\\,";
+    lastIndex = i + 1;
+  }
+  ret += s.substring(lastIndex);
+  return ret;
+}
 
 // convert an escaped utf8 string returned from ldapjs
 function _isHex(c) {
@@ -41,6 +78,8 @@ function _recursiveParseHexString(obj) {
   }
   return obj
 }
+/*
+// UPDATE: This function is not used in this version, because ldapts library already does the conversion
 // convert a SearchResultEntry object in ldapjs 3.0
 // to a user object to maintain backward compatibility
 
@@ -53,58 +92,21 @@ function _searchResultToUser(pojo) {
   })
   return _recursiveParseHexString(user)
 }
+*/
 // bind and return the ldap client
-function _ldapBind(dn, password, starttls, ldapOpts) {
-  return new Promise(function (resolve, reject) {
-    ldapOpts.connectTimeout = ldapOpts.connectTimeout || 5000
-    let client = ldap.createClient(ldapOpts)
+async function _ldapBind(dn, password, starttls, ldapOpts) {
+  // TODO: check if ldapts expects escaped dn or not (possible double escaping problems?)
+  dn = _ldapEscapeDN(dn)
+  ldapOpts.connectTimeout = ldapOpts.connectTimeout || 5000
+  let client = new ldapts.Client(ldapOpts)
 
-    client.on('connect', function () {
-      if (starttls) {
-        client.starttls(ldapOpts.tlsOptions, null, function (error) {
-          if (error) {
-            reject(error)
-            return
-          }
-          client.bind(dn, password, function (err) {
-            if (err) {
-              reject(err)
-              return
-            }
-            ldapOpts.log && ldapOpts.log.trace('bind success!')
-            resolve(client)
-          })
-        })
-      } else {
-        client.bind(dn, password, function (err) {
-          if (err) {
-            reject(err)
-            return
-          }
-          ldapOpts.log && ldapOpts.log.trace('bind success!')
-          resolve(client)
-        })
-      }
-    })
-
-    //Fix for issue https://github.com/shaozi/ldap-authentication/issues/13
-    client.on('timeout', (err) => {
-      reject(err)
-    })
-    client.on('connectTimeout', (err) => {
-      reject(err)
-    })
-    client.on('error', (err) => {
-      reject(err)
-    })
+  if(starttls) {
+    await client.startTLS(ldapOpts.tlsOptions)
+  }
 
-    client.on('connectError', function (error) {
-      if (error) {
-        reject(error)
-        return
-      }
-    })
-  })
+  await client.bind(dn, password)
+  ldapOpts.log && ldapOpts.log.trace('bind success!')
+  return client
 }
 
 // search a user and return the object
@@ -115,48 +117,36 @@ async function _searchUser(
   username,
   attributes = null
 ) {
-  return new Promise(function (resolve, reject) {
-    let filter = new ldap.filters.EqualityFilter({
-      attribute: usernameAttribute,
-      value: username,
-    })
-    let searchOptions = {
-      filter: filter,
-      scope: 'sub',
-      attributes: attributes,
-    }
-    if (attributes) {
-      searchOptions.attributes = attributes
-    }
-    ldapClient.search(searchBase, searchOptions, function (err, res) {
-      let user = null
-      if (err) {
-        reject(err)
-        return
-      }
-      res.on('searchEntry', function (entry) {
-        user = _searchResultToUser(entry.pojo)
-      })
-      res.on('searchReference', function (referral) {
-        // TODO: we don't support reference yet
-        // If the server was able to locate the entry referred to by the baseObject
-        // but could not search one or more non-local entries,
-        // the server may return one or more SearchResultReference messages,
-        // each containing a reference to another set of servers for continuing the operation.
-        // referral.uris
-      })
-      res.on('error', function (err) {
-        reject(err)
-      })
-      res.on('end', function (result) {
-        if (result.status != 0) {
-          reject(new Error('ldap search status is not 0, search failed'))
-        } else {
-          resolve(user)
-        }
-      })
-    })
-  })
+
+  let filter = new ldapts.EqualityFilter({
+    attribute: usernameAttribute,
+    value: username,
+  });
+  let searchOptions = {
+    filter: filter,
+    scope: 'sub',
+    attributes: attributes,
+  };
+  if (attributes) {
+    searchOptions.attributes = attributes;
+  }
+
+  // TODO: we don't support reference yet
+  // If the server was able to locate the entry referred to by the baseObject
+  // but could not search one or more non-local entries,
+  // the server may return one or more SearchResultReference messages,
+  // each containing a reference to another set of servers for continuing the operation.
+  // referral.uris
+  const { searchEntries, searchReferences } = await ldapClient.search(searchBase, searchOptions);
+
+  let user;
+  if(!searchEntries || searchEntries.length < 1 || !searchEntries[0] || !searchEntries[0].dn) {
+    user = null;
+  } else {
+    user = searchEntries[0];
+  }
+
+  return user;
 }
 
 // search a groups which user is member
@@ -168,36 +158,37 @@ async function _searchUserGroups(
   groupMemberAttribute = 'member',
   groupMemberUserAttribute = 'dn'
 ) {
-  return new Promise(function (resolve, reject) {
-    ldapClient.search(
-      searchBase,
-      {
-        filter: `(&(objectclass=${groupClass})(${groupMemberAttribute}=${user[groupMemberUserAttribute]}))`,
-        scope: 'sub',
-      },
-      function (err, res) {
-        let groups = []
-        if (err) {
-          reject(err)
-          return
-        }
-        res.on('searchEntry', function (entry) {
-          groups.push(_recursiveParseHexString(entry.pojo))
-        })
-        res.on('searchReference', function (referral) {})
-        res.on('error', function (err) {
-          reject(err)
-        })
-        res.on('end', function (result) {
-          if (result.status != 0) {
-            reject(new Error('ldap search status is not 0, search failed'))
-          } else {
-            resolve(groups)
-          }
-        })
-      }
-    )
-  })
+  // Below works, but prefer using ldapts Filter subclasses to build this search, so that correct escaping is done
+  // const filter = `(&(objectclass=${groupClass})(${groupMemberAttribute}=${user[groupMemberUserAttribute]}))`
+  const filter = new ldapts.AndFilter({
+    filters: [
+      new ldapts.EqualityFilter({ attribute: 'objectclass', value: groupClass }),
+      new ldapts.EqualityFilter({ attribute: groupMemberAttribute, value: user[groupMemberUserAttribute] }),
+    ],
+  });
+
+  const { searchEntries, searchReferences } = await ldapClient.search(
+    searchBase,
+    {
+      filter: filter,
+      scope: 'sub',
+    }
+  );
+
+  let groups;
+  if(!searchEntries || searchEntries.length < 1) {
+    groups = [];
+  } else {
+    groups = searchEntries;
+  }
+  // ldapjs has group.objectName, ldapts does not have it. instead, use dn
+  // add objectName back for backward compatibility
+  for (let group of groups) {
+    if (typeof group.objectName === 'undefined') {
+      group.objectName = group.dn
+    }
+  }
+  return groups;
 }
 
 async function authenticateWithAdmin(
@@ -468,4 +459,5 @@ module.exports.exportForTesting = {
   _isHex,
   _parseEscapedHexToUtf8,
   _recursiveParseHexString,
+  _ldapEscapeDN
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "3.2.4",
+  "version": "3.3.1",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
@@ -36,9 +36,9 @@
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapjs": "^3.0.7"
+    "ldapts": "^7.3.1"
   },
   "devDependencies": {
-    "jasmine": "^5.3.0"
+    "jasmine": "^5.6.0"
   }
 }

package/test/string.spec.js

@@ -1,5 +1,5 @@
 const { exportForTesting } = require('../index.js')
-const { _isHex, _parseEscapedHexToUtf8, _recursiveParseHexString } =
+const { _isHex, _parseEscapedHexToUtf8, _recursiveParseHexString, _ldapEscapeDN } =
   exportForTesting
 
 describe('string conversion test', () => {
@@ -41,3 +41,22 @@ describe('string conversion test', () => {
     expect(converted).toEqual(target)
   })
 })
+
+describe('escape , in the DN test', ()=>{
+  let cases = [
+    { s: "a", want: "a" },
+    { s: "", want: "" },
+    { s: "CN=a,DN=b", want: "CN=a,DN=b" },
+    { s: "CN=a, c,DN=b", want: "CN=a\\, c,DN=b" },
+    { s: "CN=a\\, c,DN=b", want: "CN=a\\, c,DN=b" },
+    { s: "CN=a, b, c,DN=b", want: "CN=a\\, b\\, c,DN=b" },
+    { s: "CN=a, c", want: "CN=a\\, c" },
+  ]
+  for (let c of cases) {
+    it("escape "+c.s, ()=>{
+      let got = _ldapEscapeDN(c.s)
+      expect(got).toEqual(c.want)
+    })
+    
+  }
+})

package/test/test.spec.js

@@ -144,9 +144,7 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
-    expect(user.groups[0].objectName).toEqual(
-      'cn=科学A部,ou=users,dc=example,dc=com'
-    )
+    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=users,dc=example,dc=com')
   })
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
@@ -167,6 +165,8 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
+    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=users,dc=example,dc=com')
+    // backward compatible with 3.2
     expect(user.groups[0].objectName).toEqual(
       'cn=科学A部,ou=users,dc=example,dc=com'
     )