Added newAccountsRights to SSO strategies
Ylian Saint-Hilaire committed
May 28, 2020 at 18:04 UTC
2bd1d55403eea1bf8fbafdf2dc2149b47045f9b9
4 files changed
+27
-18
common.js
+22
@@ -269,4 +269,26 @@ module.exports.copyFile = function(source, target, cb) {
269
wr.on('close', function (ex) { done(); });
270
rd.pipe(wr);
271
function done(err) { if (!cbCalled) { cb(err); cbCalled = true; } }
272
+}
273
+
274
+module.exports.meshServerRightsArrayToNumber = function (val) {
275
+ if (val == null) return null;
276
+ if (typeof val == 'number') return val;
277
+ if (Array.isArray(val)) {
278
+ var newAccRights = 0;
279
+ for (var j in val) {
280
+ var r = val[j].toLowerCase();
281
+ if (r == 'fulladmin') { newAccRights = 4294967295; } // 0xFFFFFFFF
282
+ if (r == 'serverbackup') { newAccRights |= 1; }
283
+ if (r == 'manageusers') { newAccRights |= 2; }
284
+ if (r == 'serverrestore') { newAccRights |= 4; }
285
+ if (r == 'fileaccess') { newAccRights |= 8; }
286
+ if (r == 'serverupdate') { newAccRights |= 16; }
287
+ if (r == 'locked') { newAccRights |= 32; }
288
+ if (r == 'nonewgroups') { newAccRights |= 64; }
289
+ if (r == 'notools') { newAccRights |= 128; }
290
+ }
291
+ return newAccRights;
292
+ }
293
+ return null;
294
}
\ No newline at end of file
meshcentral.js
+2
-17
@@ -1063,23 +1063,8 @@ function CreateMeshCentralServer(config, args) {
1063
if ((obj.config.domains[i].auth == 'ldap') || (obj.config.domains[i].auth == 'sspi')) { obj.config.domains[i].newaccounts = 0; } // No new accounts allowed in SSPI/LDAP authentication modes.
1064
1065
// Convert newAccountsRights from a array of strings to flags number.
1066
- if (obj.config.domains[i].newaccountsrights && Array.isArray(obj.config.domains[i].newaccountsrights)) {
1067
- var newAccRights = 0;
1068
- for (var j in obj.config.domains[i].newaccountsrights) {
1069
- var r = obj.config.domains[i].newaccountsrights[j].toLowerCase();
1070
- if (r == 'fulladmin') { newAccRights = 4294967295; } // 0xFFFFFFFF
1071
- if (r == 'serverbackup') { newAccRights |= 1; }
1072
- if (r == 'manageusers') { newAccRights |= 2; }
1073
- if (r == 'serverrestore') { newAccRights |= 4; }
1074
- if (r == 'fileaccess') { newAccRights |= 8; }
1075
- if (r == 'serverupdate') { newAccRights |= 16; }
1076
- if (r == 'locked') { newAccRights |= 32; }
1077
- if (r == 'nonewgroups') { newAccRights |= 64; }
1078
- if (r == 'notools') { newAccRights |= 128; }
1079
- }
1080
- obj.config.domains[i].newaccountsrights = newAccRights;
1081
- }
1082
- if (obj.config.domains[i].newaccountsrights && (typeof (obj.config.domains[i].newaccountsrights) != 'number')) { delete obj.config.domains[i].newaccountsrights; }
1066
+ obj.config.domains[i].newaccountsrights = obj.common.meshServerRightsArrayToNumber(obj.config.domains[i].newaccountsrights);
1067
+ if (typeof (obj.config.domains[i].newaccountsrights) != 'number') { delete obj.config.domains[i].newaccountsrights; }
1068
1069
// Check if there is a web views path and/or web public path for this domain
1070
if ((__dirname.endsWith('/node_modules/meshcentral')) || (__dirname.endsWith('\\node_modules\\meshcentral')) || (__dirname.endsWith('/node_modules/meshcentral/')) || (__dirname.endsWith('\\node_modules\\meshcentral\\'))) {
sample-config-advanced.json
+1
@@ -212,6 +212,7 @@
212
"_disableRequestedAuthnContext": true,
213
"newAccounts": true,
214
"_newAccountsUserGroups": [ "ugrp//xxxxxxxxxxxxxxxxx" ],
215
+ "_newAccountsRights": [ "nonewgroups", "notools" ],
216
"entityid": "meshcentral",
217
"idpurl": "https://server/saml2",
218
"cert": "saml.pem"
webserver.js
+2
-1
@@ -1845,6 +1845,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1845
user = { type: 'user', _id: userid, name: req.user.name, email: req.user.email, creation: Math.floor(Date.now() / 1000), domain: domain.id };
1846
if (req.user.email != null) { user.email = req.user.email; user.emailVerified = true; }
1847
if (domain.newaccountsrights) { user.siteadmin = domain.newaccountsrights; } // New accounts automatically assigned server rights.
1848
+ if (domain.authstrategies[req.user.strategy].newaccountsrights) { user.siteadmin = obj.common.meshServerRightsArrayToNumber(domain.authstrategies[req.user.strategy].newaccountsrights); } // If there are specific SSO server rights, use these instead.
1849
if (newAccountRealms) { user.groups = newAccountRealms; } // New accounts automatically part of some groups (Realms).
1850
obj.users[userid] = user;
1851
@@ -4583,7 +4584,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4584
path: (typeof domain.authstrategies.intel.callbackurl == 'string') ? domain.authstrategies.intel.callbackurl : (url + 'auth-intel-callback'),
4585
entryPoint: domain.authstrategies.intel.idpurl, issuer: 'meshcentral'
4586
};
4586
- if (domain.authstrategies.saml.disablerequestedauthncontext != null) { options.disableRequestedAuthnContext = domain.authstrategies.saml.disablerequestedauthncontext; }
4587
+ if (domain.authstrategies.intel.disablerequestedauthncontext != null) { options.disableRequestedAuthnContext = domain.authstrategies.intel.disablerequestedauthncontext; }
4588
parent.debug('web', 'Adding Intel SSO with options: ' + JSON.stringify(options));
4589
if (typeof domain.authstrategies.intel.entityid == 'string') { options.issuer = domain.authstrategies.intel.entityid; }
4590
options.cert = cert.toString().split('-----BEGIN CERTIFICATE-----').join('').split('-----END CERTIFICATE-----').join('');