Added LDAP membership user group sync options (#4415)
Ylian Saint-Hilaire committed
Aug 22, 2022 at 11:43 UTC
00765288e696479901b00b717913ef5fa69ab432
1 file changed
+23
-1
webserver.js
+23
-1
@@ -13,7 +13,7 @@
13
/*jshint esversion: 6 */
14
'use strict';
15
16
-// SerialTunnel object is used to embed TLS within another connection.e
16
+// SerialTunnel object is used to embed TLS within another connection.
17
function SerialTunnel(options) {
18
var obj = new require('stream').Duplex(options);
19
obj.forwardwrite = null;
@@ -486,6 +486,28 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
486
if (userMembershipMatch === false) { parent.debug('ldap', 'Denying login to a user that is not a member of a LDAP required group.'); fn('denied'); return; } // If there is no match, deny the login
487
}
488
489
+ // See if we need to sync LDAP user memberships with user groups
490
+ if (domain.ldapsyncwithusergroups === true) { domain.ldapsyncwithusergroups = {}; }
491
+ if (typeof domain.ldapsyncwithusergroups == 'object') {
492
+ // LDAP user memberships sync is enabled, see if there are any filters to apply
493
+ if (typeof domain.ldapsyncwithusergroups.filter == 'string') { domain.ldapsyncwithusergroups.filter = [domain.ldapsyncwithusergroups.filter]; }
494
+ if (Array.isArray(domain.ldapsyncwithusergroups.filter)) {
495
+ const g = [];
496
+ for (var i in userMemberships) {
497
+ var match = false;
498
+ for (var j in domain.ldapsyncwithusergroups.filter) {
499
+ if (userMemberships[i].indexOf(domain.ldapsyncwithusergroups.filter[j]) >= 0) { match = true; }
500
+ }
501
+ if (match) { g.push(userMemberships[i]); }
502
+ }
503
+ console.log(g);
504
+ userMemberships = g;
505
+ }
506
+ } else {
507
+ // LDAP user memberships sync is disabled, sync the user with empty membership
508
+ userMemberships = [];
509
+ }
510
+
511
// Get the email address for this LDAP user
512
var email = null;
513
if (domain.ldapuseremail) { email = xxuser[domain.ldapuseremail]; } else if (xxuser['mail']) { email = xxuser['mail']; } // Use given feild name or default