fix oidc sync groups
Signed-off-by: si458 <simonsmith5521@gmail.com>
si458 committed
May 21, 2024 at 16:05 UTC
5c13f178be800a1be21db05ace4cc0b36852f1b6
1 file changed
+27
-17
webserver.js
+27
-17
@@ -2591,24 +2591,24 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2591
const groups = { 'enabled': typeof strategy.groups == 'object' }
2592
parent.authLog(req.user.strategy.toUpperCase(), `User Authorized: ${JSON.stringify(req.user)}`);
2593
if (groups.enabled) { // Groups only available for OIDC strategy currently
2594
- groups.userMemberships = obj.common.convertStrArray(req.user.groups)
2595
- groups.syncEnabled = (strategy.groups.sync === true || strategy.groups.sync?.filter) ? true : false
2596
- groups.syncMemberships = []
2597
- groups.siteAdminEnabled = strategy.groups.siteadmin ? true : false
2598
- groups.grantAdmin = false
2599
- groups.revokeAdmin = strategy.groups.revokeAdmin ? strategy.groups.revokeAdmin : true
2600
- groups.requiredGroups = obj.common.convertStrArray(strategy.groups.required)
2601
- groups.siteAdmin = obj.common.convertStrArray(strategy.groups.siteadmin)
2602
- groups.syncFilter = obj.common.convertStrArray(strategy.groups.sync?.filter)
2594
+ groups.userMemberships = obj.common.convertStrArray(req.user.groups);
2595
+ groups.syncEnabled = (strategy.groups.sync === true || strategy.groups.sync?.filter) ? true : false;
2596
+ groups.syncMemberships = [];
2597
+ groups.siteAdminEnabled = strategy.groups.siteadmin ? true : false;
2598
+ groups.grantAdmin = false;
2599
+ groups.revokeAdmin = strategy.groups.revokeAdmin ? strategy.groups.revokeAdmin : true;
2600
+ groups.requiredGroups = obj.common.convertStrArray(strategy.groups.required);
2601
+ groups.siteAdmin = obj.common.convertStrArray(strategy.groups.siteadmin);
2602
+ groups.syncFilter = obj.common.convertStrArray(strategy.groups.sync?.filter);
2603
2604
// Fancy Logs
2605
- let groupMessage = ''
2605
+ let groupMessage = '';
2606
if (groups.userMemberships.length == 1) { groupMessage = ` Found membership: "${groups.userMemberships[0]}"` }
2607
else { groupMessage = ` Found ${groups.userMemberships.length} memberships: ["${groups.userMemberships.join('", "')}"]` }
2608
parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}"` + groupMessage);
2609
2610
// Check user membership in required groups
2611
- if (groups.requiredGroups != null) {
2611
+ if (groups.requiredGroups.length > 0) {
2612
let match = false
2613
for (var i in groups.requiredGroups) {
2614
if (groups.userMemberships.indexOf(groups.requiredGroups[i]) != -1) {
@@ -2617,7 +2617,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2617
}
2618
}
2619
if (match === false) {
2620
- parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" Login denied. No memberhip to required group.`);
2620
+ parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" Login denied. No membership to required group.`);
2621
req.session.loginmode = 1;
2622
req.session.messageid = 111; // Access Denied.
2623
res.redirect(domain.url + getQueryPortion(req));
@@ -2640,15 +2640,25 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
2640
2641
// Check if we need to sync user-memberships (IdP) with user-groups (meshcentral)
2642
if (groups.syncEnabled === true) {
2643
- for (var i in groups.syncFilter) {
2644
- if (groups.userMemberships.indexOf(groups.syncFilter[i]) >= 0) { groups.syncMemberships.push(groups.syncFilter[i]); }
2643
+ if (groups.syncFilter.length > 0){ // config.json has specified sync.filter so loop and use it
2644
+ for (var i in groups.syncFilter) {
2645
+ if (groups.userMemberships.indexOf(groups.syncFilter[i]) >= 0) { groups.syncMemberships.push(groups.syncFilter[i]); }
2646
+ }
2647
+ } else { // config.json doesnt have sync.filter specified so we are going to sync all the users groups from oidc instead
2648
+ for (var i in groups.userMemberships) {
2649
+ groups.syncMemberships.push(groups.userMemberships[i]);
2650
+ }
2651
}
2652
if (groups.syncMemberships.length > 0) {
2647
- parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" Filtered user memberships from config to sync: ${groups.syncMemberships.join(', ')}`);
2653
+ parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" User memberships to sync: ${groups.syncMemberships.join(', ')}`);
2654
} else {
2655
groups.syncMemberships = null;
2650
- groups.syncEnabled = false
2651
- parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" No sync memberships found after filter: ${strategy.groups.sync.filter.join(', ')}`);
2656
+ groups.syncEnabled = false;
2657
+ if (groups.syncFilter.length > 0){
2658
+ parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" No sync memberships found using filters: ${groups.syncFilter.join(', ')}`);
2659
+ } else {
2660
+ parent.authLog('handleStrategyLogin', `${req.user.strategy.toUpperCase()}: GROUPS: USER: "${req.user.sid}" No sync memberships found`);
2661
+ }
2662
}
2663
}
2664
}