ldap-authentication 4.0.3 → 4.0.5

package/.devcontainer/docker-compose.yml

@@ -8,14 +8,13 @@ services:
     command: sleep infinity
 
   ldap:
-    image: symas/openldap:2.6
+    build:
+      context: ..
+      dockerfile: docker/ldap/Dockerfile
     ports:
-      - '1389:1389'
-      - '1636:1636'
+      - '1389:389'
+      - '1636:636'
     environment:
-      - LDAP_ROOT=dc=example,dc=com
-      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_DOMAIN=example.com
       - LDAP_ADMIN_PASSWORD=password
-      - LDAP_USERS=gauss,einstein
-      - LDAP_PASSWORDS=password,password
-      - LDAP_GROUP=科学A部
+      - LDAP_TLS=true

package/.github/workflows/publish.yml

@@ -0,0 +1,53 @@
+name: 'Publish to npm'
+
+env:
+  INGITHUB: true
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    name: 'Publish ${{ github.ref_name }}'
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install LDAP tools
+        run: sudo apt-get install -y ldap-utils
+
+      - name: Start containers
+        run: docker compose -f "docker-compose.yml" up -d
+
+      - name: Wait for LDAP server to become available
+        uses: nick-fields/retry@v2
+        with:
+          timeout_minutes: 5
+          max_attempts: 10
+          polling_interval_seconds: 3
+          command: |
+            ldapsearch -LLL -o 'ldif-wrap=no' \
+              -H ldap://localhost:1389 \
+              -D 'cn=read-only-admin,dc=example,dc=com' \
+              -w password \
+              -b 'cn=einstein,ou=users,dc=example,dc=com' DN
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v3
+        with:
+          node-version: 22.x
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+      - run: npm run test
+
+      - name: Stop containers
+        if: always()
+        run: docker compose -f "docker-compose.yml" down
+
+      - name: Publish to npm
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/README.md

@@ -104,6 +104,14 @@ let authenticated = await authenticate({
 
 #### Complete example
 
+The library works with both CommonJS and ES modules:
+
+```javascript
+import { authenticate } from 'ldap-authentication'
+// or
+const { authenticate } = require('ldap-authentication')
+```
+
 ```javascript
 const { authenticate } = require('ldap-authentication')
 
@@ -204,6 +212,9 @@ auth()
   if this value is not set, then authenticate will return true right after user bind succeed. No user details
   from LDAP search will be performed and returned.
   Example: `uid`
+- `usernameFilter`: Prioritized alternative to usernameAttribute, allows you to provide a filter where `{{username}}` will 
+  be replaced with the username provided
+  Example: `(|(uid={{username}})(mail={{username}}))`
 - `username`: The username to authenticate with. It is used together with the name in `usernameAttribute`
   to construct an ldap filter as `({attribute}={username})`
   to find the user and get user details in LDAP. Example: `some user input`

package/docker/ldap/10-ldap-test-data.ldif

@@ -0,0 +1,47 @@
+# Test directory seed data for ldap-authentication integration tests.
+# Loaded by osixia/openldap at first start via
+# /container/service/slapd/assets/config/bootstrap/ldif/custom
+# (directory bind-mounted in docker-compose.yml).
+# See https://github.com/osixia/container-openldap (v1, tag 1.5.0)
+
+dn: ou=users,dc=example,dc=com
+objectClass: organizationalUnit
+ou: users
+
+dn: ou=groups,dc=example,dc=com
+objectClass: organizationalUnit
+ou: groups
+
+dn: cn=read-only-admin,dc=example,dc=com
+objectClass: simpleSecurityObject
+objectClass: organizationalRole
+cn: read-only-admin
+description: LDAP admin user for tests (password: password)
+userPassword: {SSHA}u/l8yXCyiWhP3iXpt0UWMyM9ch5sZGFwLXRlc3QtMjAyNg==
+
+dn: cn=gauss,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+objectClass: posixAccount
+cn: gauss
+sn: Bar1
+uid: gauss
+uidNumber: 1000
+gidNumber: 1000
+homeDirectory: /home/gauss
+userPassword: {SSHA}u/l8yXCyiWhP3iXpt0UWMyM9ch5sZGFwLXRlc3QtMjAyNg==
+
+dn: cn=einstein,ou=users,dc=example,dc=com
+objectClass: inetOrgPerson
+objectClass: posixAccount
+cn: einstein
+sn: Bar2
+uid: einstein
+uidNumber: 1001
+gidNumber: 1001
+homeDirectory: /home/einstein
+userPassword: {SSHA}u/l8yXCyiWhP3iXpt0UWMyM9ch5sZGFwLXRlc3QtMjAyNg==
+
+dn: cn=科学A部,ou=groups,dc=example,dc=com
+objectClass: groupOfNames
+cn: 科学A部
+member: cn=gauss,ou=users,dc=example,dc=com

package/docker/ldap/20-ldap-test-acl.ldif

@@ -0,0 +1,21 @@
+# ACLs for the test LDAP directory, applied on top of the osixia/openldap
+# defaults (replaces the data database access rules at first start).
+#
+# The userPassword rule must come before the generic "to *" rule: OpenLDAP
+# evaluates the first matching "to" clause for an attribute.
+#
+#  - EXTERNAL (slapd local socket): full manage (used by the image bootstrap)
+#  - cn=admin,dc=example,dc=com: full manage
+#  - cn=read-only-admin,dc=example,dc=com: full manage (tests use it as the
+#    admin, including the entry modify in binary.spec.js)
+#  - normal users: read own entry and read group entries (group lookup tests)
+#  - anonymous: no access (simple bind does not consult other ACLs)
+
+dn: olcDatabase={1}mdb,cn=config
+changetype: modify
+delete: olcAccess
+-
+add: olcAccess
+olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,dc=example,dc=com" manage by dn.exact="cn=read-only-admin,dc=example,dc=com" manage by anonymous auth by * none
+olcAccess: to dn.subtree="ou=groups,dc=example,dc=com" by users read by dn.exact="cn=read-only-admin,dc=example,dc=com" read by dn="cn=admin,dc=example,dc=com" manage
+olcAccess: to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn="cn=admin,dc=example,dc=com" manage by dn.exact="cn=read-only-admin,dc=example,dc=com" manage by users read by self read by * none

package/docker/ldap/Dockerfile

@@ -0,0 +1,7 @@
+FROM osixia/openldap:1.5.0
+
+# Seed the test directory (dc=example,dc=com) with the users, groups and
+# admin account used by the integration tests, and grant the test admin
+# (cn=read-only-admin) the rights it needs. Files are applied by the
+# osixia/openldap bootstrap at the container's first start.
+COPY docker/ldap/10-ldap-test-data.ldif docker/ldap/20-ldap-test-acl.ldif /container/service/slapd/assets/config/bootstrap/ldif/custom/

package/docker-compose.yml

@@ -1,13 +1,15 @@
 services:
   ldap:
-    image: symas/openldap:2.6
+    # LDAP server used by the integration tests, based on osixia/openldap.
+    # The Dockerfile in docker/ldap/ seeds the directory with the users,
+    # groups and admin account the tests rely on.
+    build:
+      context: .
+      dockerfile: docker/ldap/Dockerfile
     ports:
-      - '1389:1389'
-      - '1636:1636'
+      - '1389:389'
+      - '1636:636'
     environment:
-      - LDAP_ROOT=dc=example,dc=com
-      - LDAP_ADMIN_USERNAME=read-only-admin
+      - LDAP_DOMAIN=example.com
       - LDAP_ADMIN_PASSWORD=password
-      - LDAP_USERS=gauss,einstein
-      - LDAP_PASSWORDS=password,password
-      - LDAP_GROUP=科学A部
+      - LDAP_TLS=true

package/index.d.ts

@@ -8,6 +8,7 @@ declare module 'ldap-authentication' {
     adminPassword?: string
     userSearchBase?: string
     usernameAttribute?: string
+    usernameFilter?:string
     username?: string
     verifyUserExists?: boolean
     starttls?: boolean
@@ -20,7 +21,24 @@ declare module 'ldap-authentication' {
     explicitBufferAttributes?: string[]
   }
 
+  export const AUTH_RESULT_FAILURE = 0
+  export const AUTH_RESULT_SUCCESS = 1
+  export const AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND = -1
+  export const AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS = -2
+  export const AUTH_RESULT_FAILURE_CREDENTIAL_INVALID = -3
+  export const AUTH_RESULT_FAILURE_UNCATEGORIZED = -4
+
+  export class AuthenticationResult {
+    constructor(authCode: number, identity: string, user: any, messages: string[], client: any)
+    readonly code: number
+    readonly identity: string
+    readonly user: any
+    readonly messages: string[]
+    readonly client: any
+  }
+
   export function authenticate(options: AuthenticationOptions): Promise<any>
+  export function authenticateResult(options: AuthenticationOptions): Promise<AuthenticationResult>
 
   export class LdapAuthenticationError extends Error {
     constructor(message: any)

package/index.js

@@ -124,19 +124,30 @@ async function _ldapBind(dn, password, starttls, ldapOpts) {
   return client
 }
 
+// replace username in filter
+
+
 // search a user and return the object
 async function _searchUser(
   ldapClient,
   searchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   attributes = null,
   explicitBufferAttributes = null
 ) {
-  let filter = new ldapts.EqualityFilter({
-    attribute: usernameAttribute,
-    value: username,
-  })
+  let filter;
+  if(usernameFilter){
+    filter = usernameFilter.replaceAll("{{username}}",username.replaceAll(/[&|!*()]/g,""));
+  }
+  else{
+    filter = new ldapts.EqualityFilter({
+      attribute: usernameAttribute,
+      value: username,
+    })
+  }
+  
   let searchOptions = {
     filter: filter,
     scope: 'sub',
@@ -266,6 +277,7 @@ async function authenticateWithAdmin(
   adminDn,
   adminPassword,
   userSearchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   userPassword,
@@ -303,6 +315,7 @@ async function authenticateWithAdmin(
   let searchResult = await _searchUser(
     ldapAdminClient,
     userSearchBase,
+    usernameFilter,
     usernameAttribute,
     username,
     attributes,
@@ -368,6 +381,7 @@ async function authenticateWithAdmin(
 async function authenticateWithUser(
   userDn,
   userSearchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   userPassword,
@@ -411,6 +425,7 @@ async function authenticateWithUser(
   let searchResult = await _searchUser(
     ldapUserClient,
     userSearchBase,
+    usernameFilter,
     usernameAttribute,
     username,
     attributes,
@@ -463,6 +478,7 @@ async function verifyUserExists(
   adminDn,
   adminPassword,
   userSearchBase,
+  usernameFilter,
   usernameAttribute,
   username,
   starttls,
@@ -498,6 +514,7 @@ async function verifyUserExists(
   let searchResult = await _searchUser(
     ldapAdminClient,
     userSearchBase,
+    usernameFilter,
     usernameAttribute,
     username,
     attributes,
@@ -562,8 +579,8 @@ async function authenticateResult(options) {
     assert(options.adminPassword, 'Admin mode adminPassword must be provided')
     assert(options.userSearchBase, 'Admin mode userSearchBase must be provided')
     assert(
-      options.usernameAttribute,
-      'Admin mode usernameAttribute must be provided'
+      options.usernameAttribute || options.usernameFilter,
+      'Admin mode usernameAttribute or usernameFilter must be provided'
     )
     assert(options.username, 'Admin mode username must be provided')
   } else {
@@ -584,6 +601,7 @@ async function authenticateResult(options) {
       options.adminDn,
       options.adminPassword,
       options.userSearchBase,
+      options.usernameFilter,
       options.usernameAttribute,
       options.username,
       options.starttls,
@@ -607,6 +625,7 @@ async function authenticateResult(options) {
       options.adminDn,
       options.adminPassword,
       options.userSearchBase,
+      options.usernameFilter,
       options.usernameAttribute,
       options.username,
       options.userPassword,
@@ -625,6 +644,7 @@ async function authenticateResult(options) {
   return await authenticateWithUser(
     options.userDn,
     options.userSearchBase,
+    options.usernameFilter,
     options.usernameAttribute,
     options.username,
     options.userPassword,

package/index.mjs

@@ -0,0 +1,16 @@
+import ldapAuthentication from './index.js'
+
+export {
+  AUTH_RESULT_FAILURE,
+  AUTH_RESULT_FAILURE_CREDENTIAL_INVALID,
+  AUTH_RESULT_FAILURE_IDENTITY_AMBIGUOUS,
+  AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+  AUTH_RESULT_FAILURE_UNCATEGORIZED,
+  AUTH_RESULT_SUCCESS,
+  AuthenticationResult,
+  LdapAuthenticationError,
+  authenticate,
+  authenticateResult,
+} from './index.js'
+
+export default ldapAuthentication

package/package.json

@@ -1,9 +1,18 @@
 {
   "name": "ldap-authentication",
-  "version": "4.0.3",
+  "version": "4.0.5",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.mjs",
+      "require": "./index.js",
+      "default": "./index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "engines": {
     "node": ">=20.0.0"
   },