ldap-authentication 3.2.6 → 3.3.2

package/README.md

@@ -10,7 +10,7 @@ Make authentication with an LDAP server easy.
 
 ## Description
 
-This library use `ldapjs` as the underneath library. It has three modes of authentications:
+This library use `ldapts` as the underneath library. It has three modes of authentications:
 
 1. **Admin authenticate mode**. If an admin user is provided, the library will login (ldap bind) with the admin user,
    then search for the user to be authenticated, get its DN (distinguish name), then use
@@ -149,7 +149,7 @@ auth()
 
 ## Parameters
 
-- `ldapOpts`: This is passed to `ldapjs` client directly
+- `ldapOpts`: This is passed to `ldapts` client directly
   - `url`: url of the ldap server. Example: `ldap://ldap.forumsys.com`
   - `tlsOptions`: options to pass to node tls. Example: `{ rejectUnauthorized: false }`
   - `connectTimeout`: Int. Default: `5000`. Connect timeout in ms
@@ -210,7 +210,7 @@ export async function verifyLogin(email: string, password: string) {
     const profilePhoto = ldapUser['thumbnailPhoto;binary'];
 
     /* using the image
-	<img src={`data:image/*;base64,${profilePhoto}`} />
+ <img src={`data:image/*;base64,${profilePhoto}`} />
     */
     return { user: ldapUser };
   }

package/example/index.js

@@ -4,7 +4,7 @@ async function auth() {
   // auth with admin
   let options = {
     ldapOpts: {
-      url: 'ldap://ldap.forumsys.com',
+      url: 'ldap://localhost:1389',
       // tlsOptions: { rejectUnauthorized: false }
     },
     adminDn: 'cn=read-only-admin,dc=example,dc=com',
@@ -55,4 +55,4 @@ async function auth() {
   console.log(`user = ${JSON.stringify(user, null, 2)}`)
 }
 
-auth()
+auth().then()

package/index.d.ts

@@ -1,4 +1,4 @@
-import { ClientOptions } from 'ldapjs'
+import { ClientOptions } from 'ldapts'
 
 declare module 'ldap-authentication' {
   export interface AuthenticationOptions {

package/index.js

@@ -1,148 +1,57 @@
 const assert = require('assert')
-const ldap = require('ldapjs')
+const ldapts = require('ldapts')
 // escape the , in CN in DN
 function _ldapEscapeDN(s) {
-  let ret = "";
-  let comaPositions = [];
-  let done = false;
-  let countEq = 0;
+  let ret = ''
+  let comaPositions = []
+  let done = false
+  let countEq = 0
   for (let i = 0; !done && i < s.length; i++) {
     switch (s[i]) {
-      case "\\":
+      case '\\':
         // user already escapped, continue
-        i++;
-        break;
-      case ",":
+        i++
+        break
+      case ',':
         if (countEq == 1) {
-          comaPositions.push(i);
+          comaPositions.push(i)
         }
-        break;
-      case "=":
-        countEq++;
+        break
+      case '=':
+        countEq++
         if (countEq == 2) {
-          done = true;
+          done = true
         }
-        break;
+        break
     }
   }
   if (done) {
-    comaPositions.pop();
+    comaPositions.pop()
   }
-  let lastIndex = 0;
+  let lastIndex = 0
   for (let i of comaPositions) {
-    ret += s.substring(lastIndex, i);
-    ret += "\\,";
-    lastIndex = i + 1;
+    ret += s.substring(lastIndex, i)
+    ret += '\\,'
+    lastIndex = i + 1
   }
-  ret += s.substring(lastIndex);
-  return ret;
+  ret += s.substring(lastIndex)
+  return ret
 }
 
-// convert an escaped utf8 string returned from ldapjs
-function _isHex(c) {
-  return (
-    (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')
-  )
-}
-function _parseEscapedHexToUtf8(s) {
-  // convert 'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8,ou=users,dc=example,dc=com'
-  // to 'cn=研发A部,ou=users,dc=example,dc=com'
-  let ret = Buffer.alloc(0)
-  let len = s.length
-  for (let i = 0; i < len; i++) {
-    let c = s[i]
-    let item
-    if (c == '\\' && i < len - 2 && _isHex(s[i + 1]) && _isHex(s[i + 2])) {
-      item = Buffer.from(s.substring(i + 1, i + 3), 'hex')
-      i += 2
-    } else {
-      item = Buffer.from(c)
-    }
-    ret = Buffer.concat([ret, item])
-  }
-  return ret.toString()
-}
-
-function _recursiveParseHexString(obj) {
-  if (Array.isArray(obj)) {
-    return obj.map((ele) => _recursiveParseHexString(ele))
-  }
-  if (typeof obj == 'string') {
-    return _parseEscapedHexToUtf8(obj)
-  }
-  if (typeof obj == 'object') {
-    for (let key in obj) {
-      obj[key] = _recursiveParseHexString(obj[key])
-    }
-    return obj
-  }
-  return obj
-}
-// convert a SearchResultEntry object in ldapjs 3.0
-// to a user object to maintain backward compatibility
-
-function _searchResultToUser(pojo) {
-  assert(pojo.type == 'SearchResultEntry')
-  let user = { dn: pojo.objectName }
-  pojo.attributes.forEach((attribute) => {
-    user[attribute.type] =
-      attribute.values.length == 1 ? attribute.values[0] : attribute.values
-  })
-  return _recursiveParseHexString(user)
-}
 // bind and return the ldap client
-function _ldapBind(dn, password, starttls, ldapOpts) {
+async function _ldapBind(dn, password, starttls, ldapOpts) {
+  // TODO: check if ldapts expects escaped dn or not (possible double escaping problems?)
   dn = _ldapEscapeDN(dn)
-  return new Promise(function (resolve, reject) {
-    ldapOpts.connectTimeout = ldapOpts.connectTimeout || 5000
-    let client = ldap.createClient(ldapOpts)
-
-    client.on('connect', function () {
-      if (starttls) {
-        client.starttls(ldapOpts.tlsOptions, null, function (error) {
-          if (error) {
-            reject(error)
-            return
-          }
-          client.bind(dn, password, function (err) {
-            if (err) {
-              reject(err)
-              return
-            }
-            ldapOpts.log && ldapOpts.log.trace('bind success!')
-            resolve(client)
-          })
-        })
-      } else {
-        client.bind(dn, password, function (err) {
-          if (err) {
-            reject(err)
-            return
-          }
-          ldapOpts.log && ldapOpts.log.trace('bind success!')
-          resolve(client)
-        })
-      }
-    })
+  ldapOpts.connectTimeout = ldapOpts.connectTimeout || 5000
+  let client = new ldapts.Client(ldapOpts)
 
-    //Fix for issue https://github.com/shaozi/ldap-authentication/issues/13
-    client.on('timeout', (err) => {
-      reject(err)
-    })
-    client.on('connectTimeout', (err) => {
-      reject(err)
-    })
-    client.on('error', (err) => {
-      reject(err)
-    })
+  if (starttls) {
+    await client.startTLS(ldapOpts.tlsOptions)
+  }
 
-    client.on('connectError', function (error) {
-      if (error) {
-        reject(error)
-        return
-      }
-    })
-  })
+  await client.bind(dn, password)
+  ldapOpts.log && ldapOpts.log.trace('bind success!')
+  return client
 }
 
 // search a user and return the object
@@ -153,48 +62,43 @@ async function _searchUser(
   username,
   attributes = null
 ) {
-  return new Promise(function (resolve, reject) {
-    let filter = new ldap.filters.EqualityFilter({
-      attribute: usernameAttribute,
-      value: username,
-    })
-    let searchOptions = {
-      filter: filter,
-      scope: 'sub',
-      attributes: attributes,
-    }
-    if (attributes) {
-      searchOptions.attributes = attributes
-    }
-    ldapClient.search(searchBase, searchOptions, function (err, res) {
-      let user = null
-      if (err) {
-        reject(err)
-        return
-      }
-      res.on('searchEntry', function (entry) {
-        user = _searchResultToUser(entry.pojo)
-      })
-      res.on('searchReference', function (referral) {
-        // TODO: we don't support reference yet
-        // If the server was able to locate the entry referred to by the baseObject
-        // but could not search one or more non-local entries,
-        // the server may return one or more SearchResultReference messages,
-        // each containing a reference to another set of servers for continuing the operation.
-        // referral.uris
-      })
-      res.on('error', function (err) {
-        reject(err)
-      })
-      res.on('end', function (result) {
-        if (result.status != 0) {
-          reject(new Error('ldap search status is not 0, search failed'))
-        } else {
-          resolve(user)
-        }
-      })
-    })
+  let filter = new ldapts.EqualityFilter({
+    attribute: usernameAttribute,
+    value: username,
   })
+  let searchOptions = {
+    filter: filter,
+    scope: 'sub',
+    attributes: attributes,
+  }
+  if (attributes) {
+    searchOptions.attributes = attributes
+  }
+
+  // TODO: we don't support reference yet
+  // If the server was able to locate the entry referred to by the baseObject
+  // but could not search one or more non-local entries,
+  // the server may return one or more SearchResultReference messages,
+  // each containing a reference to another set of servers for continuing the operation.
+  // referral.uris
+  const { searchEntries, searchReferences } = await ldapClient.search(
+    searchBase,
+    searchOptions
+  )
+
+  let user
+  if (
+    !searchEntries ||
+    searchEntries.length < 1 ||
+    !searchEntries[0] ||
+    !searchEntries[0].dn
+  ) {
+    user = null
+  } else {
+    user = searchEntries[0]
+  }
+
+  return user
 }
 
 // search a groups which user is member
@@ -206,36 +110,43 @@ async function _searchUserGroups(
   groupMemberAttribute = 'member',
   groupMemberUserAttribute = 'dn'
 ) {
-  return new Promise(function (resolve, reject) {
-    ldapClient.search(
-      searchBase,
-      {
-        filter: `(&(objectclass=${groupClass})(${groupMemberAttribute}=${user[groupMemberUserAttribute]}))`,
-        scope: 'sub',
-      },
-      function (err, res) {
-        let groups = []
-        if (err) {
-          reject(err)
-          return
-        }
-        res.on('searchEntry', function (entry) {
-          groups.push(_recursiveParseHexString(entry.pojo))
-        })
-        res.on('searchReference', function (referral) {})
-        res.on('error', function (err) {
-          reject(err)
-        })
-        res.on('end', function (result) {
-          if (result.status != 0) {
-            reject(new Error('ldap search status is not 0, search failed'))
-          } else {
-            resolve(groups)
-          }
-        })
-      }
-    )
+  // Below works, but prefer using ldapts Filter subclasses to build this search, so that correct escaping is done
+  // const filter = `(&(objectclass=${groupClass})(${groupMemberAttribute}=${user[groupMemberUserAttribute]}))`
+  const filter = new ldapts.AndFilter({
+    filters: [
+      new ldapts.EqualityFilter({
+        attribute: 'objectclass',
+        value: groupClass,
+      }),
+      new ldapts.EqualityFilter({
+        attribute: groupMemberAttribute,
+        value: user[groupMemberUserAttribute],
+      }),
+    ],
   })
+
+  const { searchEntries, searchReferences } = await ldapClient.search(
+    searchBase,
+    {
+      filter: filter,
+      scope: 'sub',
+    }
+  )
+
+  let groups
+  if (!searchEntries || searchEntries.length < 1) {
+    groups = []
+  } else {
+    groups = searchEntries
+  }
+  // ldapjs has group.objectName, ldapts does not have it. instead, use dn
+  // add objectName back for backward compatibility
+  for (let group of groups) {
+    if (typeof group.objectName === 'undefined') {
+      group.objectName = group.dn
+    }
+  }
+  return groups
 }
 
 async function authenticateWithAdmin(
@@ -262,6 +173,9 @@ async function authenticateWithAdmin(
       ldapOpts
     )
   } catch (error) {
+    if (ldapAdminClient.isConnected) {
+      await ldapAdminClient.unbind()
+    }
     throw { admin: error }
   }
   let user = await _searchUser(
@@ -276,6 +190,7 @@ async function authenticateWithAdmin(
       ldapOpts.log.trace(
         `admin did not find user! (${usernameAttribute}=${username})`
       )
+    await ldapAdminClient.unbind()
     throw new LdapAuthenticationError(
       'user not found or usernameAttribute is wrong'
     )
@@ -285,6 +200,9 @@ async function authenticateWithAdmin(
   try {
     ldapUserClient = await _ldapBind(userDn, userPassword, starttls, ldapOpts)
   } catch (error) {
+    if (ldapUserClient.isConnected) {
+      await ldapUserClient.unbind()
+    }
     throw error
   }
   if (groupsSearchBase && groupClass && groupMemberAttribute) {
@@ -298,6 +216,8 @@ async function authenticateWithAdmin(
     )
     user.groups = groups
   }
+  await ldapAdminClient.unbind()
+  await ldapUserClient.unbind()
   return user
 }
 
@@ -319,10 +239,14 @@ async function authenticateWithUser(
   try {
     ldapUserClient = await _ldapBind(userDn, userPassword, starttls, ldapOpts)
   } catch (error) {
+    if (ldapUserClient.isConnected) {
+      await ldapUserClient.unbind()
+    }
     throw error
   }
   if (!usernameAttribute || !userSearchBase) {
     // if usernameAttribute is not provided, no user detail is needed.
+    await ldapUserClient.unbind()
     return true
   }
   let user = await _searchUser(
@@ -337,6 +261,7 @@ async function authenticateWithUser(
       ldapOpts.log.trace(
         `user logged in, but user details could not be found. (${usernameAttribute}=${username}). Probabaly wrong attribute or searchBase?`
       )
+    await ldapUserClient.unbind()
     throw new LdapAuthenticationError(
       'user logged in, but user details could not be found. Probabaly usernameAttribute or userSearchBase is wrong?'
     )
@@ -352,6 +277,7 @@ async function authenticateWithUser(
     )
     user.groups = groups
   }
+  await ldapUserClient.unbind()
   return user
 }
 
@@ -378,6 +304,9 @@ async function verifyUserExists(
       ldapOpts
     )
   } catch (error) {
+    if (ldapAdminClient.isConnected) {
+      await ldapAdminClient.unbind()
+    }
     throw { admin: error }
   }
   let user = await _searchUser(
@@ -392,6 +321,7 @@ async function verifyUserExists(
       ldapOpts.log.trace(
         `admin did not find user! (${usernameAttribute}=${username})`
       )
+    await ldapAdminClient.unbind()
     throw new LdapAuthenticationError(
       'user not found or usernameAttribute is wrong'
     )
@@ -407,6 +337,7 @@ async function verifyUserExists(
     )
     user.groups = groups
   }
+  await ldapAdminClient.unbind()
   return user
 }
 
@@ -503,8 +434,5 @@ module.exports.authenticate = authenticate
 module.exports.LdapAuthenticationError = LdapAuthenticationError
 
 module.exports.exportForTesting = {
-  _isHex,
-  _parseEscapedHexToUtf8,
-  _recursiveParseHexString,
-  _ldapEscapeDN
+  _ldapEscapeDN,
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "3.2.6",
+  "version": "3.3.2",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
@@ -16,6 +16,7 @@
     "authenticate",
     "authentication",
     "ldapjs",
+    "ldapts",
     "security",
     "simple",
     "lightweight",
@@ -36,9 +37,9 @@
   },
   "homepage": "https://github.com/shaozi/ldap-authentication#readme",
   "dependencies": {
-    "ldapjs": "^3.0.7"
+    "ldapts": "^7.3.1"
   },
   "devDependencies": {
-    "jasmine": "^5.3.0"
+    "jasmine": "^5.6.0"
   }
 }

package/test/string.spec.js

@@ -1,62 +1,21 @@
 const { exportForTesting } = require('../index.js')
-const { _isHex, _parseEscapedHexToUtf8, _recursiveParseHexString, _ldapEscapeDN } =
-  exportForTesting
+const { _ldapEscapeDN } = exportForTesting
 
-describe('string conversion test', () => {
-  it('unescape string test', () => {
-    let s =
-      'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8,ou=users,dc=example,dc=com'
-    let us = _parseEscapedHexToUtf8(s)
-    expect(us).toEqual('cn=研发A部,ou=users,dc=example,dc=com')
-  })
-  it('unescape string test2', () => {
-    let s =
-      'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9,ou=users,dc=example,dc=com'
-    let us = _parseEscapedHexToUtf8(s)
-    expect(us).toEqual('cn=研发A部©,ou=users,dc=example,dc=com')
-  })
-  it('unescape string test3', () => {
-    let s = 'cn=ABC,ou=users,dc=example,dc=com'
-    let us = _parseEscapedHexToUtf8(s)
-    expect(us).toEqual('cn=ABC,ou=users,dc=example,dc=com')
-  })
-  it('convert obj', () => {
-    let target = {
-      a: ['研发A部©', 'abc'],
-      b: 'xyz',
-      c: true,
-      d: null,
-      e: '研发A部©',
-      f: 1000,
-    }
-    let obj = {
-      a: ['\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9', 'abc'],
-      b: 'xyz',
-      c: true,
-      d: null,
-      e: '\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9',
-      f: 1000,
-    }
-    let converted = _recursiveParseHexString(obj)
-    expect(converted).toEqual(target)
-  })
-})
-
-describe('escape , in the DN test', ()=>{
+describe('escape , in the DN test', () => {
   let cases = [
-    { s: "a", want: "a" },
-    { s: "", want: "" },
-    { s: "CN=a,DN=b", want: "CN=a,DN=b" },
-    { s: "CN=a, c,DN=b", want: "CN=a\\, c,DN=b" },
-    { s: "CN=a\\, c,DN=b", want: "CN=a\\, c,DN=b" },
-    { s: "CN=a, b, c,DN=b", want: "CN=a\\, b\\, c,DN=b" },
-    { s: "CN=a, c", want: "CN=a\\, c" },
+    { s: 'a', want: 'a' },
+    { s: '', want: '' },
+    { s: 'CN=a,DN=b', want: 'CN=a,DN=b' },
+    { s: 'CN=a, c,DN=b', want: 'CN=a\\, c,DN=b' },
+    { s: 'CN=a\\, c,DN=b', want: 'CN=a\\, c,DN=b' },
+    { s: 'CN=a, b, c,DN=b', want: 'CN=a\\, b\\, c,DN=b' },
+    { s: 'CN=a, c', want: 'CN=a\\, c' },
   ]
   for (let c of cases) {
-    it("escape "+c.s, ()=>{
+    it('escape ' + c.s, () => {
       let got = _ldapEscapeDN(c.s)
       expect(got).toEqual(c.want)
     })
-    
   }
-})
+})
+

package/test/test.spec.js

@@ -144,9 +144,7 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
-    expect(user.groups[0].objectName).toEqual(
-      'cn=科学A部,ou=users,dc=example,dc=com'
-    )
+    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=users,dc=example,dc=com')
   })
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
@@ -167,6 +165,8 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
+    expect(user.groups[0].dn).toEqual('cn=科学A部,ou=users,dc=example,dc=com')
+    // backward compatible with 3.2
     expect(user.groups[0].objectName).toEqual(
       'cn=科学A部,ou=users,dc=example,dc=com'
     )