LDAP improvements (#4283)
Ylian Saint-Hilaire committed
Jul 19, 2022 at 13:50 UTC
466c765df5ecff62e312d5cd887b83a4a341556e
1 file changed
+152
-228
webserver.js
+152
-228
@@ -440,253 +440,177 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
440
}, 0);
441
});
442
} else if (domain.auth == 'ldap') {
443
- if (domain.ldapoptions.url == 'test') {
444
- // Fake LDAP login
445
- var xxuser = domain.ldapoptions[name.toLowerCase()];
446
- if (xxuser == null) {
447
- fn(new Error('invalid password'));
448
- return;
443
+ // This method will handle LDAP login
444
+ const ldapHandler = function ldapHandlerFunc(err, xxuser) {
445
+ if (ldapHandlerFunc.ldapobj) { try { ldapHandlerFunc.ldapobj.close(); } catch (ex) { console.log(ex); } } // Close the LDAP object
446
+ if (err) { fn(new Error('invalid password')); return; }
447
+
448
+ // Save this LDAP user to file if needed
449
+ if (typeof domain.ldapsaveusertofile == 'string') {
450
+ obj.fs.appendFile(domain.ldapsaveusertofile, JSON.stringify(xxuser, null, 2) + '\r\n\r\n', function (err) { });
451
+ }
452
+
453
+ // Work on getting the userid for this LDAP user
454
+ var shortname = null;
455
+ if ('[object Array]' == Object.prototype.toString.call(email)) {
456
+ // mail may be multivalued in ldap in which case, answer would be an array. Use the 1st one.
457
+ email = email[0];
458
+ }
459
+ if (email) { email = email.toLowerCase(); } // it seems some code otherwhere also lowercase the emailaddress. be compatible.
460
+ var username = xxuser['displayName'];
461
+ if (domain.ldapusername) { username = xxuser[domain.ldapusername]; }
462
+ if (domain.ldapuserbinarykey) {
463
+ // Use a binary key as the userid
464
+ if (xxuser[domain.ldapuserbinarykey]) { shortname = Buffer.from(xxuser[domain.ldapuserbinarykey], 'binary').toString('hex').toLowerCase(); }
465
+ } else if (domain.ldapuserkey) {
466
+ // Use a string key as the userid
467
+ if (xxuser[domain.ldapuserkey]) { shortname = xxuser[domain.ldapuserkey]; }
468
} else {
450
- // Save this LDAP user to file if needed
451
- if (typeof domain.ldapsaveusertofile == 'string') {
452
- obj.fs.appendFile(domain.ldapsaveusertofile, JSON.stringify(xxuser, null, 2) + '\r\n\r\n', function (err) { });
453
- }
469
+ // Use the default key as the userid
470
+ if (xxuser.objectSid) { shortname = Buffer.from(xxuser.objectSid, 'binary').toString('hex').toLowerCase(); }
471
+ else if (xxuser.objectGUID) { shortname = Buffer.from(xxuser.objectGUID, 'binary').toString('hex').toLowerCase(); }
472
+ else if (xxuser.name) { shortname = xxuser.name; }
473
+ else if (xxuser.cn) { shortname = xxuser.cn; }
474
+ }
475
+ if (shortname == null) { fn(new Error('no user identifier')); return; }
476
+ if (username == null) { username = shortname; }
477
+ var userid = 'user/' + domain.id + '/' + shortname;
478
+
479
+ // Work on getting the email address for this LDAP user
480
+ var email = null;
481
+ if (domain.ldapuseremail) { email = xxuser[domain.ldapuseremail]; } else if (xxuser.mail) { email = xxuser.mail; } // Use given feild name or default
482
+ if ('[object Array]' == Object.prototype.toString.call(email)) { email = email[0]; } // Mail may be multivalued in LDAP in which case, answer is an array. Use the 1st value.
483
+ if (email) { email = email.toLowerCase(); } // it seems some code elsewhere also lowercase the emailaddress, so let's be consistant.
484
+
485
+ // Work on getting the real name for this LDAP user
486
+ var realname = null;
487
+ if (domain.ldapuserrealname) { realname = xxuser[domain.ldapuserrealname]; }
488
+
489
+ // Work on getting the phone number for this LDAP user
490
+ var phonenumber = null;
491
+ if (domain.ldapuserphonenumber) { phonenumber = xxuser[domain.ldapuserphonenumber]; }
492
+
493
+ // Work on getting the image of this LDAP user
494
+ /*
495
+ var userimage = null;
496
+ if (domain.ldapuserimage && xxuser[domain.ldapuserimage]) {
497
+ console.log('IMAGE', Buffer.from(xxuser[domain.ldapuserimage], 'utf8'));
498
+ userimage = 'data:image/jpeg;base64,' + Buffer.from(xxuser[domain.ldapuserimage], 'binary').toString('base64');
499
+ }
500
+ */
501
455
- // Work on getting the userid for this LDAP user
456
- var username = xxuser['displayName'];
457
- if (domain.ldapusername) { username = xxuser[domain.ldapusername]; }
458
- var shortname = null;
459
- if (domain.ldapuserbinarykey) {
460
- // Use a binary key as the userid
461
- if (xxuser[domain.ldapuserbinarykey]) { shortname = Buffer.from(xxuser[domain.ldapuserbinarykey], 'binary').toString('hex'); }
462
- } else if (domain.ldapuserkey) {
463
- // Use a string key as the userid
464
- if (xxuser[domain.ldapuserkey]) { shortname = xxuser[domain.ldapuserkey]; }
465
- } else {
466
- // Use the default key as the userid
467
- if (xxuser.objectSid) { shortname = Buffer.from(xxuser.objectSid, 'binary').toString('hex').toLowerCase(); }
468
- else if (xxuser.objectGUID) { shortname = Buffer.from(xxuser.objectGUID, 'binary').toString('hex').toLowerCase(); }
469
- else if (xxuser.name) { shortname = xxuser.name; }
470
- else if (xxuser.cn) { shortname = xxuser.cn; }
471
- }
472
- if (shortname == null) { fn(new Error('no user identifier')); return; }
473
- if (username == null) { username = shortname; }
474
- var userid = 'user/' + domain.id + '/' + shortname;
502
+ // Display user information extracted from LDAP data
503
+ /*
504
+ console.log('shortname', shortname);
505
+ console.log('email', email);
506
+ console.log('realname', realname);
507
+ console.log('phonenumber', phonenumber);
508
+ console.log('userimage', userimage);
509
+ */
510
+
511
+ // If there is a testing userid, use that
512
+ if (ldapHandlerFunc.ldapShortName) {
513
+ shortname = ldapHandlerFunc.ldapShortName;
514
+ userid = 'user/' + domain.id + '/' + shortname;
515
+ }
516
476
- // Work on getting the email address for this LDAP user
477
- var email = null;
478
- if (domain.ldapuseremail) { email = xxuser[domain.ldapuseremail]; } else if (xxuser.mail) { email = xxuser.mail; } // Use given feild name or default
479
- if ('[object Array]' == Object.prototype.toString.call(email)) { email = email[0]; } // Mail may be multivalued in LDAP in which case, answer is an array. Use the 1st value.
480
- if (email) { email = email.toLowerCase(); } // it seems some code elsewhere also lowercase the emailaddress, so let's be consistant.
517
+ // Check if the user already exists
518
+ var user = obj.users[userid];
519
+ if (user == null) {
520
+ // This user does not exist, create a new account.
521
+ var user = { type: 'user', _id: userid, name: username, creation: Math.floor(Date.now() / 1000), login: Math.floor(Date.now() / 1000), access: Math.floor(Date.now() / 1000), domain: domain.id };
522
+ if (email) { user['email'] = email; user['emailVerified'] = true; }
523
+ if (domain.newaccountsrights) { user.siteadmin = domain.newaccountsrights; }
524
+ if (obj.common.validateStrArray(domain.newaccountrealms)) { user.groups = domain.newaccountrealms; }
525
+ var usercount = 0;
526
+ for (var i in obj.users) { if (obj.users[i].domain == domain.id) { usercount++; } }
527
+ if (usercount == 0) { user.siteadmin = 4294967295; /*if (domain.newaccounts === 2) { delete domain.newaccounts; }*/ } // If this is the first user, give the account site admin.
528
482
- // Work on getting the real name for this LDAP user
483
- var realname = null;
484
- if (domain.ldapuserrealname) { realname = xxuser[domain.ldapuserrealname]; }
529
+ // Auto-join any user groups
530
+ if (typeof domain.newaccountsusergroups == 'object') {
531
+ for (var i in domain.newaccountsusergroups) {
532
+ var ugrpid = domain.newaccountsusergroups[i];
533
+ if (ugrpid.indexOf('/') < 0) { ugrpid = 'ugrp/' + domain.id + '/' + ugrpid; }
534
+ var ugroup = obj.userGroups[ugrpid];
535
+ if (ugroup != null) {
536
+ // Add group to the user
537
+ if (user.links == null) { user.links = {}; }
538
+ user.links[ugroup._id] = { rights: 1 };
539
486
- // Work on getting the real name for this LDAP user
487
- var phonenumber = null;
488
- if (domain.ldapuserphonenumber) { phonenumber = xxuser[domain.ldapuserphonenumber]; }
540
+ // Add user to the group
541
+ ugroup.links[user._id] = { userid: user._id, name: user.name, rights: 1 };
542
+ db.Set(ugroup);
543
490
- // Check if the user already exists
491
- var user = obj.users[userid];
492
- if (user == null) {
493
- // Create a new user
494
- var user = { type: 'user', _id: userid, name: username, creation: Math.floor(Date.now() / 1000), login: Math.floor(Date.now() / 1000), access: Math.floor(Date.now() / 1000), domain: domain.id };
495
- if (email) { user['email'] = email; user['emailVerified'] = true; }
496
- if (domain.newaccountsrights) { user.siteadmin = domain.newaccountsrights; }
497
- if (obj.common.validateStrArray(domain.newaccountrealms)) { user.groups = domain.newaccountrealms; }
498
- var usercount = 0;
499
- for (var i in obj.users) { if (obj.users[i].domain == domain.id) { usercount++; } }
500
- if (usercount == 0) { user.siteadmin = 4294967295; /*if (domain.newaccounts === 2) { delete domain.newaccounts; }*/ } // If this is the first user, give the account site admin.
501
-
502
- // Auto-join any user groups
503
- if (typeof domain.newaccountsusergroups == 'object') {
504
- for (var i in domain.newaccountsusergroups) {
505
- var ugrpid = domain.newaccountsusergroups[i];
506
- if (ugrpid.indexOf('/') < 0) { ugrpid = 'ugrp/' + domain.id + '/' + ugrpid; }
507
- var ugroup = obj.userGroups[ugrpid];
508
- if (ugroup != null) {
509
- // Add group to the user
510
- if (user.links == null) { user.links = {}; }
511
- user.links[ugroup._id] = { rights: 1 };
512
-
513
- // Add user to the group
514
- ugroup.links[user._id] = { userid: user._id, name: user.name, rights: 1 };
515
- db.Set(ugroup);
516
-
517
- // Notify user group change
518
- var event = { etype: 'ugrp', ugrpid: ugroup._id, name: ugroup.name, desc: ugroup.desc, action: 'usergroupchange', links: ugroup.links, msgid: 71, msgArgs: [user.name, ugroup.name], msg: 'Added user ' + user.name + ' to user group ' + ugroup.name, addUserDomain: domain.id };
519
- if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user group. Another event will come.
520
- parent.DispatchEvent(['*', ugroup._id, user._id], obj, event);
521
- }
544
+ // Notify user group change
545
+ var event = { etype: 'ugrp', ugrpid: ugroup._id, name: ugroup.name, desc: ugroup.desc, action: 'usergroupchange', links: ugroup.links, msgid: 71, msgArgs: [user.name, ugroup.name], msg: 'Added user ' + user.name + ' to user group ' + ugroup.name, addUserDomain: domain.id };
546
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user group. Another event will come.
547
+ parent.DispatchEvent(['*', ugroup._id, user._id], obj, event);
548
}
549
}
550
+ }
551
525
- obj.users[user._id] = user;
552
+ obj.users[user._id] = user;
553
+ obj.db.SetUser(user);
554
+ var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msgid: 128, msgArgs: [user.name], msg: 'Account created, name is ' + user.name, domain: domain.id };
555
+ if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to create the user. Another event will come.
556
+ obj.parent.DispatchEvent(['*', 'server-users'], obj, event);
557
+ return fn(null, user._id);
558
+ } else {
559
+ // This is an existing user
560
+ // If the display username has changes, update it.
561
+ if (user.name != username) {
562
+ user.name = username;
563
+ obj.db.SetUser(user);
564
+ var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msgid: 127, msgArgs: [user.name], msg: 'Changed account display name to ' + user.name, domain: domain.id };
565
+ if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
566
+ parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
567
+ }
568
+ // Check if user email has changed
569
+ var emailreason = null;
570
+ if (user.email && !email) { // email unset in ldap => unset
571
+ delete user.email;
572
+ delete user.emailVerified;
573
+ emailreason = 'Unset email (no more email in LDAP)'
574
+ } else if (user.email != email) { // update email
575
+ user['email'] = email;
576
+ user['emailVerified'] = true;
577
+ emailreason = 'Set account email to ' + email + '. Sync with LDAP.';
578
+ }
579
+ if (emailreason) {
580
obj.db.SetUser(user);
527
- var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msgid: 128, msgArgs: [user.name], msg: 'Account created, name is ' + user.name, domain: domain.id };
528
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to create the user. Another event will come.
529
- obj.parent.DispatchEvent(['*', 'server-users'], obj, event);
530
- return fn(null, user._id);
581
+ var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msg: emailreason, domain: domain.id };
582
+ if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
583
+ parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
584
+ }
585
+ // If user is locker out, block here.
586
+ if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
587
+ return fn(null, user._id);
588
+ }
589
+ }
590
+
591
+ if (domain.ldapoptions.url == 'test') {
592
+ // Test LDAP login
593
+ var xxuser = domain.ldapoptions[name.toLowerCase()];
594
+ if (xxuser == null) { fn(new Error('invalid password')); return; } else {
595
+ ldapHandler.ldapShortName = name.toLowerCase();
596
+ if (typeof xxuser == 'string') {
597
+ // This test LDAP user points to a JSON file we user information, load it.
598
+ ldapHandler(null, require(xxuser));
599
} else {
532
- // This is an existing user
533
- // If the display username has changes, update it.
534
- if (user.name != username) {
535
- user.name = username;
536
- obj.db.SetUser(user);
537
- var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msgid: 127, msgArgs: [user.name], msg: 'Changed account display name to ' + user.name, domain: domain.id };
538
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
539
- parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
540
- }
541
- // Check if user email has changed
542
- var emailreason = null;
543
- if (user.email && !email) { // email unset in ldap => unset
544
- delete user.email;
545
- delete user.emailVerified;
546
- emailreason = 'Unset email (no more email in LDAP)'
547
- } else if (user.email != email) { // update email
548
- user['email'] = email;
549
- user['emailVerified'] = true;
550
- emailreason = 'Set account email to ' + email + '. Sync with LDAP.';
551
- }
552
- if (emailreason) {
553
- obj.db.SetUser(user);
554
- var event = { etype: 'user', userid: userid, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msg: emailreason, domain: domain.id };
555
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
556
- parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
557
- }
558
- // If user is locker out, block here.
559
- if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
560
- return fn(null, user._id);
600
+ // THe user information is in the config.json, use it.
601
+ ldapHandler(null, xxuser);
602
}
603
}
604
} else {
605
// LDAP login
606
var LdapAuth = require('ldapauth-fork');
607
var ldap = new LdapAuth(domain.ldapoptions);
567
- ldap.on('error', function (err) { console.log('ldap error: ', err); });
568
- ldap.authenticate(name, pass, function (err, xxuser) {
608
+ ldapHandler.ldapobj = ldap;
609
+ ldap.on('error', function (err) {
610
try { ldap.close(); } catch (ex) { console.log(ex); } // Close the LDAP object
570
- if (err) { fn(new Error('invalid password')); return; }
571
-
572
- // Save this LDAP user to file if needed
573
- if (typeof domain.ldapsaveusertofile == 'string') {
574
- obj.fs.appendFile(domain.ldapsaveusertofile, JSON.stringify(xxuser, null, 2) + '\r\n\r\n', function (err) { });
575
- }
576
-
577
- // Work on getting the userid for this LDAP user
578
- var shortname = null;
579
- if ('[object Array]' == Object.prototype.toString.call(email)) {
580
- // mail may be multivalued in ldap in which case, answer would be an array. Use the 1st one.
581
- email = email[0];
582
- }
583
- if (email) { email = email.toLowerCase(); } // it seems some code otherwhere also lowercase the emailaddress. be compatible.
584
- var username = xxuser['displayName'];
585
- if (domain.ldapusername) { username = xxuser[domain.ldapusername]; }
586
- if (domain.ldapuserbinarykey) {
587
- // Use a binary key as the userid
588
- if (xxuser[domain.ldapuserbinarykey]) { shortname = Buffer.from(xxuser[domain.ldapuserbinarykey], 'binary').toString('hex').toLowerCase(); }
589
- } else if (domain.ldapuserkey) {
590
- // Use a string key as the userid
591
- if (xxuser[domain.ldapuserkey]) { shortname = xxuser[domain.ldapuserkey]; }
592
- } else {
593
- // Use the default key as the userid
594
- if (xxuser.objectSid) { shortname = Buffer.from(xxuser.objectSid, 'binary').toString('hex').toLowerCase(); }
595
- else if (xxuser.objectGUID) { shortname = Buffer.from(xxuser.objectGUID, 'binary').toString('hex').toLowerCase(); }
596
- else if (xxuser.name) { shortname = xxuser.name; }
597
- else if (xxuser.cn) { shortname = xxuser.cn; }
598
- }
599
- if (shortname == null) { fn(new Error('no user identifier')); return; }
600
- if (username == null) { username = shortname; }
601
- var userid = 'user/' + domain.id + '/' + shortname;
602
-
603
- // Work on getting the email address for this LDAP user
604
- var email = null;
605
- if (domain.ldapuseremail) { email = xxuser[domain.ldapuseremail]; } else if (xxuser.mail) { email = xxuser.mail; } // Use given feild name or default
606
- if ('[object Array]' == Object.prototype.toString.call(email)) { email = email[0]; } // Mail may be multivalued in LDAP in which case, answer is an array. Use the 1st value.
607
- if (email) { email = email.toLowerCase(); } // it seems some code elsewhere also lowercase the emailaddress, so let's be consistant.
608
-
609
- // Work on getting the real name for this LDAP user
610
- var realname = null;
611
- if (domain.ldapuserrealname) { realname = xxuser[domain.ldapuserrealname]; }
612
-
613
- // Work on getting the real name for this LDAP user
614
- var phonenumber = null;
615
- if (domain.ldapuserphonenumber) { phonenumber = xxuser[domain.ldapuserphonenumber]; }
616
-
617
- // Check if the user already exists
618
- var user = obj.users[userid];
619
- if (user == null) {
620
- // This user does not exist, create a new account.
621
- var user = { type: 'user', _id: userid, name: username, creation: Math.floor(Date.now() / 1000), login: Math.floor(Date.now() / 1000), access: Math.floor(Date.now() / 1000), domain: domain.id };
622
- if (email) { user['email'] = email; user['emailVerified'] = true; }
623
- if (domain.newaccountsrights) { user.siteadmin = domain.newaccountsrights; }
624
- if (obj.common.validateStrArray(domain.newaccountrealms)) { user.groups = domain.newaccountrealms; }
625
- var usercount = 0;
626
- for (var i in obj.users) { if (obj.users[i].domain == domain.id) { usercount++; } }
627
- if (usercount == 0) { user.siteadmin = 4294967295; /*if (domain.newaccounts === 2) { delete domain.newaccounts; }*/ } // If this is the first user, give the account site admin.
628
-
629
- // Auto-join any user groups
630
- if (typeof domain.newaccountsusergroups == 'object') {
631
- for (var i in domain.newaccountsusergroups) {
632
- var ugrpid = domain.newaccountsusergroups[i];
633
- if (ugrpid.indexOf('/') < 0) { ugrpid = 'ugrp/' + domain.id + '/' + ugrpid; }
634
- var ugroup = obj.userGroups[ugrpid];
635
- if (ugroup != null) {
636
- // Add group to the user
637
- if (user.links == null) { user.links = {}; }
638
- user.links[ugroup._id] = { rights: 1 };
639
-
640
- // Add user to the group
641
- ugroup.links[user._id] = { userid: user._id, name: user.name, rights: 1 };
642
- db.Set(ugroup);
643
-
644
- // Notify user group change
645
- var event = { etype: 'ugrp', ugrpid: ugroup._id, name: ugroup.name, desc: ugroup.desc, action: 'usergroupchange', links: ugroup.links, msgid: 71, msgArgs: [user.name, ugroup.name], msg: 'Added user ' + user.name + ' to user group ' + ugroup.name, addUserDomain: domain.id };
646
- if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user group. Another event will come.
647
- parent.DispatchEvent(['*', ugroup._id, user._id], obj, event);
648
- }
649
- }
650
- }
651
-
652
- obj.users[user._id] = user;
653
- obj.db.SetUser(user);
654
- var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msgid: 128, msgArgs: [user.name], msg: 'Account created, name is ' + user.name, domain: domain.id };
655
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to create the user. Another event will come.
656
- obj.parent.DispatchEvent(['*', 'server-users'], obj, event);
657
- return fn(null, user._id);
658
- } else {
659
- // This is an existing user
660
- // If the display username has changes, update it.
661
- if (user.name != username) {
662
- user.name = username;
663
- obj.db.SetUser(user);
664
- var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msgid: 127, msgArgs: [user.name], msg: 'Changed account display name to ' + user.name, domain: domain.id };
665
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
666
- parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
667
- }
668
- // Check if user email has changed
669
- var emailreason = null;
670
- if (user.email && !email) { // email unset in ldap => unset
671
- delete user.email;
672
- delete user.emailVerified;
673
- emailreason = 'Unset email (no more email in LDAP)'
674
- } else if (user.email != email) { // update email
675
- user['email'] = email;
676
- user['emailVerified'] = true;
677
- emailreason = 'Set account email to ' + email + '. Sync with LDAP.';
678
- }
679
- if (emailreason) {
680
- obj.db.SetUser(user);
681
- var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msg: emailreason, domain: domain.id };
682
- if (obj.db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
683
- parent.DispatchEvent(['*', 'server-users', user._id], obj, event);
684
- }
685
- // If user is locker out, block here.
686
- if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
687
- return fn(null, user._id);
688
- }
611
+ console.log('ldap error: ', err);
612
});
613
+ ldap.authenticate(name, pass, ldapHandler);
614
}
615
} else {
616
// Regular login