ldap-authentication 4.3.0 → 4.4.0

package/test/test.spec.js

@@ -1,6 +1,11 @@
-const { authenticate, LdapAuthenticationError } = require('../index.js')
-
-const url = process.env.INGITHUB ? 'ldap://localhost:1389' : 'ldap://ldap:1389'
+const {
+  authenticate,
+  LdapAuthenticationError,
+  AUTH_RESULT_FAILURE,
+  AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND,
+  AUTH_RESULT_FAILURE_CREDENTIAL_INVALID,
+} = require('../index.js')
+const { url, adminDn, adminPassword, userSearchBase } = require('./config')
 
 describe('ldap-authentication test', () => {
   it('Use an admin user to check if user exists', async () => {
@@ -8,10 +13,10 @@ describe('ldap-authentication test', () => {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       verifyUserExists: true,
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
@@ -25,10 +30,10 @@ describe('ldap-authentication test', () => {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       verifyUserExists: true,
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
       attributes: ['uid', 'sn'],
@@ -45,10 +50,10 @@ describe('ldap-authentication test', () => {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
@@ -62,10 +67,10 @@ describe('ldap-authentication test', () => {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
       attributes: ['uid', 'sn'],
@@ -77,6 +82,28 @@ describe('ldap-authentication test', () => {
     expect(user.sn).toEqual('Bar1')
     expect(user.cn).toBeUndefined()
   })
+  it('Use an admin user to authenticate a user with a comma in the CN (e2e of the DN escaping)', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: adminDn,
+      adminPassword: adminPassword,
+      userPassword: 'password',
+      userSearchBase: userSearchBase,
+      usernameAttribute: 'uid',
+      username: 'doe',
+    }
+
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('doe')
+    // the admin finds `cn=Doe, John,ou=users,...` and must bind with the
+    // comma-escaped DN to succeed
+    expect(user.cn).toEqual('Doe, John')
+    expect(user.dn).toContain('cn=Doe')
+    expect(user.dn).toContain('ou=users,dc=example,dc=com')
+  })
   it('Use an regular user to authenticate iteself', async () => {
     let options = {
       ldapOpts: {
@@ -84,7 +111,7 @@ describe('ldap-authentication test', () => {
       },
       userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'einstein',
     }
@@ -100,7 +127,7 @@ describe('ldap-authentication test', () => {
       },
       userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'einstein',
       attributes: ['uid', 'sn'],
@@ -129,13 +156,13 @@ describe('ldap-authentication test', () => {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
-      groupsSearchBase: 'dc=example,dc=com',
+      groupsSearchBase: userSearchBase,
       groupClass: 'groupOfNames',
       groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dn',
@@ -153,10 +180,10 @@ describe('ldap-authentication test', () => {
       },
       userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
-      groupsSearchBase: 'dc=example,dc=com',
+      groupsSearchBase: userSearchBase,
       groupClass: 'groupOfNames',
       groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dn',
@@ -178,10 +205,10 @@ describe('ldap-authentication test', () => {
       },
       userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
-      groupsSearchBase: 'dc=example,dc=com',
+      groupsSearchBase: userSearchBase,
       groupClass: 'groupOfUniqueNames',
     }
 
@@ -200,7 +227,7 @@ describe('ldap-authentication negative test', () => {
       adminDn: 'cn=not-exist,dc=example,dc=com',
       adminPassword: 'password',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
@@ -213,20 +240,23 @@ describe('ldap-authentication negative test', () => {
     }
 
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+    expect(e.code).toEqual(AUTH_RESULT_FAILURE)
   })
   it('wrong admin password should fail', async () => {
     let options = {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminDn: adminDn,
       adminPassword: '',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
 
+    // '' is a falsy value, so this exercises the options validation, not the server
     let e = null
     try {
       await authenticate(options)
@@ -235,16 +265,17 @@ describe('ldap-authentication negative test', () => {
     }
 
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
   })
   it('admin auth wrong username should fail', async () => {
     let options = {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'wrong',
     }
@@ -257,16 +288,18 @@ describe('ldap-authentication negative test', () => {
     }
 
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+    expect(e.code).toEqual(AUTH_RESULT_FAILURE_IDENTITY_NOT_FOUND)
   })
   it('admin auth wrong user password should fail', async () => {
     let options = {
       ldapOpts: {
         url: url,
       },
-      adminDn: 'cn=read-only-admin,dc=example,dc=com',
-      adminPassword: 'password',
+      adminDn: adminDn,
+      adminPassword: adminPassword,
       userPassword: 'wrongpassword',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
@@ -279,6 +312,8 @@ describe('ldap-authentication negative test', () => {
     }
 
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+    expect(e.code).toEqual(AUTH_RESULT_FAILURE_CREDENTIAL_INVALID)
   })
   it('user auth wrong username should fail', async () => {
     let options = {
@@ -287,7 +322,7 @@ describe('ldap-authentication negative test', () => {
       },
       userDn: 'cn=not-exist,dc=example,dc=com',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
@@ -300,6 +335,7 @@ describe('ldap-authentication negative test', () => {
     }
 
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
   })
   it('user auth wrong user password should fail', async () => {
     let options = {
@@ -308,7 +344,7 @@ describe('ldap-authentication negative test', () => {
       },
       userDn: 'cn=gauss,dc=example,dc=com',
       userPassword: 'wrongpassword',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
     }
@@ -321,6 +357,7 @@ describe('ldap-authentication negative test', () => {
     }
 
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
   })
   it('Use an regular user to authenticate iteself without search with wrong password should fail', async () => {
     let options = {
@@ -331,13 +368,16 @@ describe('ldap-authentication negative test', () => {
       userPassword: '',
     }
 
+    let e = null
     try {
       await authenticate(options)
     } catch (error) {
       e = error
     }
 
+    // '' is a falsy value, so this exercises the options validation, not the server
     expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
   })
   it('Wrong options give LdapAuthenticationError', async () => {
     let options = {
@@ -347,10 +387,11 @@ describe('ldap-authentication negative test', () => {
       userDn: 'cn=einstein,ou=users,dc=example,dc=com',
       userPassword: 'password',
       usernameAttribute: 'wrongattribute',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       username: 'einstein',
     }
 
+    let e = null
     try {
       await authenticate(options)
     } catch (error) {
@@ -369,10 +410,11 @@ describe('ldap-authentication negative test', () => {
       userDn: 'uid=einstein,dc=example,dc=com',
       userPassword: 'password',
       usernameAttribute: 'cn',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       username: 'einstein',
     }
 
+    let e = null
     try {
       await authenticate(options)
     } catch (error) {
@@ -390,11 +432,12 @@ describe('ldap-authentication negative test', () => {
       userDn: 'uid=einstein,dc=example,dc=com',
       userPassword: 'password',
       usernameAttribute: 'cn',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       username: 'einstein',
       starttls: true,
     }
 
+    let e = null
     try {
       await authenticate(options)
     } catch (error) {
@@ -410,10 +453,10 @@ describe('ldap-authentication negative test', () => {
       },
       userDn: 'cn=gauss,ou=users,dc=example,dc=com',
       userPassword: 'password',
-      userSearchBase: 'dc=example,dc=com',
+      userSearchBase: userSearchBase,
       usernameAttribute: 'uid',
       username: 'gauss',
-      groupsSearchBase: 'dc=example,dc=com',
+      groupsSearchBase: userSearchBase,
       groupClass: 'groupOfNames',
       groupMemberAttribute: 'member',
       groupMemberUserAttribute: 'dnWRONG',
@@ -423,4 +466,43 @@ describe('ldap-authentication negative test', () => {
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeLessThan(1)
   })
+  it('Missing required options should throw LdapAuthenticationError listing all of them', async () => {
+    let e = null
+    try {
+      await authenticate({
+        ldapOpts: {
+          url: url,
+        },
+        adminDn: adminDn,
+        usernameAttribute: 'uid',
+        username: 'gauss',
+      })
+    } catch (error) {
+      e = error
+    }
+
+    expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+    // all missing fields are reported at once, not one assert at a time
+    expect(e.message).toContain('adminPassword')
+    expect(e.message).toContain('userSearchBase')
+    expect(e.message).toContain('userPassword')
+  })
+  it('No adminDn and no userDn should throw LdapAuthenticationError', async () => {
+    let e = null
+    try {
+      await authenticate({
+        ldapOpts: {
+          url: url,
+        },
+        userPassword: 'password',
+      })
+    } catch (error) {
+      e = error
+    }
+
+    expect(e).toBeTruthy()
+    expect(e).toBeInstanceOf(LdapAuthenticationError)
+    expect(e.message).toContain('adminDn or userDn')
+  })
 })

package/.github/workflows/publish.yml

@@ -1,53 +0,0 @@
-name: 'Publish to npm'
-
-env:
-  INGITHUB: true
-
-on:
-  release:
-    types: [created]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    name: 'Publish ${{ github.ref_name }}'
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install LDAP tools
-        run: sudo apt-get install -y ldap-utils
-
-      - name: Start containers
-        run: docker compose -f "docker-compose.yml" up -d
-
-      - name: Wait for LDAP server to become available
-        uses: nick-fields/retry@v2
-        with:
-          timeout_minutes: 5
-          max_attempts: 10
-          polling_interval_seconds: 3
-          command: |
-            ldapsearch -LLL -o 'ldif-wrap=no' \
-              -H ldap://localhost:1389 \
-              -D 'cn=read-only-admin,dc=example,dc=com' \
-              -w password \
-              -b 'cn=einstein,ou=users,dc=example,dc=com' DN
-
-      - name: Use Node.js 22.x
-        uses: actions/setup-node@v3
-        with:
-          node-version: 22.x
-          registry-url: 'https://registry.npmjs.org'
-
-      - run: npm ci
-      - run: npm run test
-
-      - name: Stop containers
-        if: always()
-        run: docker compose -f "docker-compose.yml" down
-
-      - name: Publish to npm
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}