scimgateway 4.2.17 → 4.3.0

package/lib/scimgateway.js

@@ -1155,27 +1155,27 @@ const ScimGateway = function () {
       }
 
       if (!jsonBody.id) { // retrieve all attributes including id
+        let res
         let obj
         try {
           if (handle.createMethod === 'createUser') {
             if (jsonBody.userName) {
-              jsonBody.id = jsonBody.userName
-              obj = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'userName', operator: 'eq', value: jsonBody.userName }, [], ctx.ctxCopy)
+              res = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'userName', operator: 'eq', value: jsonBody.userName }, [], ctx.ctxCopy)
             } else if (jsonBody.externalId) {
-              jsonBody.id = jsonBody.externalId
-              obj = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }, [], ctx.ctxCopy)
+              res = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }, [], ctx.ctxCopy)
             }
           } else if (handle.createMethod === 'createGroup') {
             if (jsonBody.externalId) {
-              jsonBody.id = jsonBody.externalId
-              obj = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }, [], ctx.ctxCopy)
+              res = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'externalId', operator: 'eq', value: jsonBody.externalId }, [], ctx.ctxCopy)
             } else if (jsonBody.displayName) {
-              jsonBody.id = jsonBody.displayName
-              obj = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'displayName', operator: 'eq', value: jsonBody.displayName }, [], ctx.ctxCopy)
+              res = await this[handle.getMethod](ctx.params.baseEntity, { attribute: 'displayName', operator: 'eq', value: jsonBody.displayName }, [], ctx.ctxCopy)
             }
           }
         } catch (err) { }
-        if (obj && obj.id) jsonBody = obj
+        if (res.Resources && Array.isArray(res.Resources) && res.Resources.length === 1) {
+          obj = res.Resources[0]
+        }
+        if (obj && obj.id) jsonBody = obj // id found, using returned object
       }
 
       const location = `${ctx.origin}${ctx.path}/${jsonBody.id}`
@@ -1365,31 +1365,22 @@ const ScimGateway = function () {
           return
         }
 
-        const clearedObj = clearObjectValues(currentObj)
-        delete clearedObj.active
-        delete clearedObj.password
-        delete clearedObj.meta
-
-        // usePutSoftSync=true prevents removing existing roles (only add roles)
-        if (config.scim.usePutSoftSync) {
-          if (clearedObj.roles && Array.isArray(clearedObj.roles)) {
-            for (let i = 0; i < clearedObj.roles.length; i++) {
-              if (clearedObj.roles[i].operation && clearedObj.roles[i].operation === 'delete') {
-                clearedObj.roles.splice(i, 1) // delete
+        let clearedObj = {}
+        if (!config.scim.usePutSoftSync) { // usePutSoftSync=true keeps eksisting attributes (and groups) that are not included in PUT jsonBody
+          clearedObj = clearObjectValues(currentObj)
+          delete clearedObj.active
+          delete clearedObj.password
+          delete clearedObj.meta
+        }
+        if (config.scim.usePutGroupMemberOfUser) { // group member of user instead of default user member of group
+          if (clearedObj.groups && Array.isArray(clearedObj.groups)) {
+            for (let i = 0; i < clearedObj.groups.length; i++) {
+              if (clearedObj.groups[i].operation && clearedObj.groups[i].operation === 'delete') {
+                clearedObj.groups.splice(i, 1) // delete
                 i -= 1
               }
             }
           }
-          if (config.scim.usePutGroupMemberOfUser) { // group member of user instead of default user member of group
-            if (clearedObj.groups && Array.isArray(clearedObj.groups)) {
-              for (let i = 0; i < clearedObj.groups.length; i++) {
-                if (clearedObj.groups[i].operation && clearedObj.groups[i].operation === 'delete') {
-                  clearedObj.groups.splice(i, 1) // delete
-                  i -= 1
-                }
-              }
-            }
-          }
         }
 
         // merge cleared object with the new
@@ -1479,25 +1470,18 @@ const ScimGateway = function () {
               return await this[handler.groups.modifyMethod](ctx.params.baseEntity, grp, obj, ctx.ctxCopy)
             }
 
-            let errRemove
+            let errRemove = []
             if (!config.scim.usePutSoftSync) { // default will remove any existing groups not included, usePutSoftSync=true prevents removing existing groups (only add groups)
-              await Promise.all(removeGrps.map((grp) => removeGroups(grp)))
-                .then()
-                .catch((err) => {
-                  errRemove = err
-                })
+              const res = await Promise.allSettled(removeGrps.map((grp) => removeGroups(grp)))
+              errRemove = res.filter(result => result.status === 'rejected').map(result => result.reason.message)
             }
 
-            let errAdd
-            await Promise.all(addGrps.map((grp) => addGroups(grp)))
-              .then()
-              .catch((err) => {
-                errAdd = err
-              })
+            const res = await Promise.allSettled(addGrps.map((grp) => addGroups(grp)))
+            const errAdd = res.filter(result => result.status === 'rejected').map(result => result.reason.message)
 
             let errMsg = ''
-            if (errRemove) errMsg = `removeGroups error: ${errRemove.message}`
-            if (errAdd) errMsg += `${errMsg ? ' ' : ''}addGroups error: ${errAdd.message}`
+            if (errRemove.lenght > 0) errMsg = `removeGroups errors: ${errRemove.join(', ')}`
+            if (errAdd.length > 0) errMsg += `${errMsg ? ' ' : ''}addGroups errors: ${errAdd.join(', ')}`
             if (errMsg) throw new Error(errMsg)
           }
         }
@@ -1787,49 +1771,53 @@ const ScimGateway = function () {
 
   logger.info('===================================================================')
 
-  if (config.localhostonly === true) {
-    logger.info(`${gwName}[${pluginName}] denying other clients than localhost (127.0.0.1)`)
-    if (config.certificate && config.certificate.key && config.certificate.cert) {
+  if (!config.port) {
+    logger.info(`${gwName}[${pluginName}] port deactivated, not allowing incoming traffic`)
+  } else {
+    if (config.localhostonly === true) {
+      logger.info(`${gwName}[${pluginName}] denying other clients than localhost (127.0.0.1)`)
+      if (config.certificate && config.certificate.key && config.certificate.cert) {
       // SSL
-      server = https.createServer({
-        key: fs.readFileSync(configDir + '/certs/' + config.certificate.key),
-        cert: fs.readFileSync(configDir + '/certs/' + config.certificate.cert)
-      }, app.callback()).listen(config.port, 'localhost')
-      logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
-    } else if (config.certificate && config.certificate.pfx && config.certificate.pfx.bundle) {
+        server = https.createServer({
+          key: fs.readFileSync(configDir + '/certs/' + config.certificate.key),
+          cert: fs.readFileSync(configDir + '/certs/' + config.certificate.cert)
+        }, app.callback()).listen(config.port, 'localhost')
+        logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
+      } else if (config.certificate && config.certificate.pfx && config.certificate.pfx.bundle) {
       // SSL using PFX / PKCS#12
-      server = https.createServer({
-        pfx: fs.readFileSync(configDir + '/certs/' + config.certificate.pfx.bundle),
-        passphrase: pwPfxPassword
-      }, app.callback()).listen(config.port, 'localhost')
-      logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
-    } else {
+        server = https.createServer({
+          pfx: fs.readFileSync(configDir + '/certs/' + config.certificate.pfx.bundle),
+          passphrase: pwPfxPassword
+        }, app.callback()).listen(config.port, 'localhost')
+        logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
+      } else {
       // none SSL
-      server = http.createServer(app.callback()).listen(config.port, 'localhost')
-      logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on port ${config.port}...\n`)
-    }
-  } else {
-    logger.info(`${gwName}[${pluginName}] accepting requests from all clients`)
-    if (config.certificate && config.certificate.key && config.certificate.cert) {
+        server = http.createServer(app.callback()).listen(config.port, 'localhost')
+        logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on port ${config.port}...\n`)
+      }
+    } else {
+      logger.info(`${gwName}[${pluginName}] accepting requests from all clients`)
+      if (config.certificate && config.certificate.key && config.certificate.cert) {
       // SSL self signed cert e.g: openssl req -nodes -newkey rsa:2048 -x509 -sha256 -days 3650 -keyout key.pem -out cert.pem -subj "/O=NodeJS/OU=Testing/CN=<FQDN>"
       // Note, self signed certificate (cert.pem) also needs to be imported at the CA Connector Server
-      server = https.createServer({
-        key: fs.readFileSync(configDir + '/certs/' + config.certificate.key),
-        cert: fs.readFileSync(configDir + '/certs/' + config.certificate.cert),
-        ca: (config.certificate.ca) ? fs.readFileSync(configDir + '/certs/' + config.certificate.ca) : null
-      }, app.callback()).listen(config.port)
-      logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
-    } else if (config.certificate && config.certificate.pfx && config.certificate.pfx.bundle) {
+        server = https.createServer({
+          key: fs.readFileSync(configDir + '/certs/' + config.certificate.key),
+          cert: fs.readFileSync(configDir + '/certs/' + config.certificate.cert),
+          ca: (config.certificate.ca) ? fs.readFileSync(configDir + '/certs/' + config.certificate.ca) : null
+        }, app.callback()).listen(config.port)
+        logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
+      } else if (config.certificate && config.certificate.pfx && config.certificate.pfx.bundle) {
       // SSL using PFX / PKCS#12
-      server = https.createServer({
-        pfx: fs.readFileSync(configDir + '/certs/' + config.certificate.pfx.bundle),
-        passphrase: pwPfxPassword
-      }, app.callback()).listen(config.port)
-      logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
-    } else {
+        server = https.createServer({
+          pfx: fs.readFileSync(configDir + '/certs/' + config.certificate.pfx.bundle),
+          passphrase: pwPfxPassword
+        }, app.callback()).listen(config.port)
+        logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on TLS port ${config.port}...\n`)
+      } else {
       // none SSL
-      server = http.createServer(app.callback()).listen(config.port)
-      logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on port ${config.port}...\n`)
+        server = http.createServer(app.callback()).listen(config.port)
+        logger.info(`${gwName}[${pluginName}] now listening SCIM ${config.scim.version} on port ${config.port}...\n`)
+      }
     }
   }
 
@@ -1929,11 +1917,13 @@ const ScimGateway = function () {
     }
     logger.info(`${gwName}[${pluginName}] pheww... ${requestCounter} requests have been processed in the period ${startTime} - ${utils.timestamp()}\n`)
     logger.close()
-    server.close(function () {
-      setTimeout(function () { // plugins may also use SIGTERM/SIGINT
-        process.exit(0)
-      }, 0.5 * 1000)
-    })
+    if (server) {
+      server.close(function () {
+        setTimeout(function () { // plugins may also use SIGTERM/SIGINT
+          process.exit(0)
+        }, 0.5 * 1000)
+      })
+    }
     setTimeout(function () { // problem closing server connections in time due to keep-alive sessions (active browser connection?), now forcing exit
       process.exit(1)
     }, 2 * 1000)

package/lib/utils.js

@@ -390,10 +390,10 @@ module.exports.fsExistsSync = function (f) {
 }
 
 // createRandomPassword creates a random password, syntax:
-// utils.createRandomPassword(12) => 12 characters, lower, upper and special
-// utils.createRandomPassword(12, utils.createRandomPassword.alphaLower)
+// utils.createRandomPassword(12) => 12 characters: lower, upper, numeric and special
+// utils.createRandomPassword(12, utils.createRandomPassword.alphaLower, utils.createRandomPassword.alphaUpper)
 // https://gist.github.com/6174/6062387
-module.exports.createRandomPassword = (function () {
+module.exports.createRandomPassword = function (len, ...set) {
   const gen = (min, max) => max++ && [...Array(max - min)].map((s, i) => String.fromCharCode(min + i))
   const sets = {
     num: gen(48, 57),
@@ -405,5 +405,19 @@ module.exports.createRandomPassword = (function () {
     if (set.length < 1) { set = Object.values(sets).flat() }
     for (let i = 0; i < len; i++) { yield set[Math.random() * set.length | 0] }
   }
-  return Object.assign((len, ...set) => [...iter(len, set.flat())].join(''), sets)
-}())
+  let res
+  if (len > 3 && set.length === 0) { // ensure all variants are included: lower, upper, numeric and special
+    res = Object.assign((len, set) => [...iter(len, set.flat())].join(''), sets)(len, set)
+    let pos = Math.random() * len | 0
+    if (pos > len - 4) pos = len - 4
+    res = res.split('')
+    res.splice(pos, 1, Object.assign((len, set) => [...iter(len, set.flat())].join(''), sets)(1, sets.num))
+    res.splice(pos + 1, 1, Object.assign((len, set) => [...iter(len, set.flat())].join(''), sets)(1, sets.alphaUpper))
+    res.splice(pos + 2, 1, Object.assign((len, set) => [...iter(len, set.flat())].join(''), sets)(1, sets.special))
+    res.splice(pos + 3, 1, Object.assign((len, set) => [...iter(len, set.flat())].join(''), sets)(1, sets.alphaLower))
+    res = res.join('')
+  } else {
+    res = Object.assign((len, set) => [...iter(len, set.flat())].join(''), sets)(len, set)
+  }
+  return res
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimgateway",
-  "version": "4.2.17",
+  "version": "4.3.0",
   "description": "Using SCIM protocol as a gateway for user provisioning to other endpoints",
   "author": "Jarle Elshaug <jarle.elshaug@gmail.com> (https://elshaug.xyz)",
   "homepage": "https://elshaug.xyz",
@@ -22,11 +22,10 @@
     "scim",
     "gateway",
     "proxy",
-    "azure",
-    "identity",
-    "manager",
+    "iga",
     "provisioning",
-    "iga"
+    "azure",
+    "entra"
   ],
   "engines": {
     "node": ">=16.0.0"
@@ -41,15 +40,15 @@
     "koa": "^2.14.2",
     "koa-bodyparser": "^4.4.1",
     "koa-router": "^12.0.1",
-    "ldapjs": "^3.0.5",
+    "ldapjs": "^3.0.7",
     "lokijs": "^1.5.12",
-    "mongodb": "^6.1.0",
+    "mongodb": "^6.3.0",
     "node-machine-id": "1.1.9",
-    "nodemailer": "^6.9.6",
-    "passport": "^0.6.0",
+    "nodemailer": "^6.9.7",
+    "passport": "^0.7.0",
     "passport-azure-ad": "^4.3.5",
     "soap": "^1.0.0",
-    "tedious": "^16.5.0",
+    "tedious": "^16.6.1",
     "winston": "^3.11.0"
   },
   "devDependencies": {