MeshCentral will now auto-create LDAP user groups and sync users to their membership groups when the login using LDAP. (#4415)
Ylian Saint-Hilaire committed
Aug 21, 2022 at 21:19 UTC
8dd07495f50b756ccea83bd5bc5848c6265ddf41
3 files changed
+144
-28
meshuser.js
+21
-6
@@ -1514,11 +1514,11 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1514
db.Set(ugrp);
1515
if (db.changeStream == false) { parent.userGroups[ugrpid] = ugrp; }
1516
1517
- // Event the device group creation
1517
+ // Event the user group creation
1518
var event = { etype: 'ugrp', userid: user._id, username: user.name, ugrpid: ugrpid, name: ugrp.name, desc: ugrp.desc, action: 'createusergroup', links: ugrp.links, msgid: 69, msgArgv: [ugrp.name], msg: 'User group created: ' + ugrp.name, ugrpdomain: domain.id };
1519
parent.parent.DispatchEvent(['*', ugrpid, user._id], obj, event); // Even if DB change stream is active, this event must be acted upon.
1520
1521
- // Event any pending events, these must be sent out after the group creation event is displatched.
1521
+ // Event any pending events, these must be sent out after the group creation event is dispatched.
1522
for (var i in pendingDispatchEvents) { var ev = pendingDispatchEvents[i]; parent.parent.DispatchEvent(ev[0], ev[1], ev[2]); }
1523
1524
// Log in the auth log
@@ -1561,6 +1561,13 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1561
}
1562
var group = groups[0];
1563
1564
+ // If this user group is an externally managed user group, it can't be deleted unless there are no users in it.
1565
+ if (group.membershipType != null) {
1566
+ var userCount = 0;
1567
+ if (group.links != null) { for (var i in group.links) { if (i.startsWith('user/')) { userCount++; } } }
1568
+ if (userCount > 0) return;
1569
+ }
1570
+
1571
// Unlink any user and meshes that have a link to this group
1572
if (group.links) {
1573
for (var i in group.links) {
@@ -1621,7 +1628,8 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1628
change = '';
1629
var group = parent.userGroups[command.ugrpid];
1630
if (group != null) {
1624
- if ((common.validateString(command.name, 1, 64) == true) && (command.name != group.name)) { change = 'User group name changed from "' + group.name + '" to "' + command.name + '"'; group.name = command.name; }
1631
+ // If this user group is an externally managed user group, the name of the user group can't be edited
1632
+ if ((group.membershipType == null) && (common.validateString(command.name, 1, 64) == true) && (command.name != group.name)) { change = 'User group name changed from "' + group.name + '" to "' + command.name + '"'; group.name = command.name; }
1633
if ((common.validateString(command.desc, 0, 1024) == true) && (command.desc != group.desc)) { if (change != '') change += ' and description changed'; else change += 'User group "' + group.name + '" description changed'; group.desc = command.desc; }
1634
if ((typeof command.consent == 'number') && (command.consent != group.consent)) { if (change != '') change += ' and consent changed'; else change += 'User group "' + group.name + '" consent changed'; group.consent = command.consent; }
1635
@@ -5770,6 +5778,9 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5778
// Get the user group
5779
var group = parent.userGroups[command.ugrpid];
5780
if (group != null) {
5781
+ // If this user group is an externally managed user group, we can't add users to it.
5782
+ if ((group != null) && (group.membershipType != null)) return;
5783
+
5784
if (group.links == null) { group.links = {}; }
5785
5786
var unknownUsers = [], addedCount = 0, failCount = 0, knownUsers = [];
@@ -5779,7 +5790,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
5790
var chguser = parent.users[chguserid];
5791
if (chguser == null) { chguserid = 'user/' + addUserDomain.id + '/' + command.usernames[i]; chguser = parent.users[chguserid]; }
5792
if (chguser != null) {
5782
- // Add mesh to user
5793
+ // Add usr group to user
5794
if (chguser.links == null) { chguser.links = {}; }
5795
chguser.links[group._id] = { rights: 1 };
5796
db.SetUser(chguser);
@@ -6235,6 +6246,12 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
6246
6247
var chguser = parent.users[command.userid];
6248
if (chguser != null) {
6249
+ // Get the user group
6250
+ var group = parent.userGroups[command.ugrpid];
6251
+
6252
+ // If this user group is an externally managed user group, we can't remove a user from it.
6253
+ if ((group != null) && (group.membershipType != null)) return;
6254
+
6255
if ((chguser.links != null) && (chguser.links[command.ugrpid] != null)) {
6256
delete chguser.links[command.ugrpid];
6257
@@ -6248,8 +6265,6 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
6265
parent.parent.DispatchEvent([chguser._id], obj, 'resubscribe');
6266
}
6267
6251
- // Get the user group
6252
- var group = parent.userGroups[command.ugrpid];
6268
if (group != null) {
6269
// Remove the user from the group
6270
if ((group.links != null) && (group.links[command.userid] != null)) {
views/default.handlebars
+17
-13
@@ -7539,7 +7539,7 @@
7539
if (usergroups != null) {
7540
var userGroupCount = 0, newUserGroup = false;
7541
for (var i in usergroups) {
7542
- if (usergroups[i]._id.split('/')[1] != nodeid.split('/')[1]) continue;
7542
+ if ((usergroups[i].membershipType != null) || (usergroups[i]._id.split('/')[1] != nodeid.split('/')[1])) continue;
7543
userGroupCount++; if ((currentNode.links == null) || (currentNode.links[i] == null)) { newUserGroup = true; }
7544
}
7545
if ((userGroupCount > 0) && (newUserGroup)) { x += '<a href=# onclick="return p20showAddMeshUserDialog(6)" style=cursor:pointer;margin-right:10px><img src=images/icon-addnew.png border=0 height=12 width=12> ' + "Add User Group" + '</a>'; }
@@ -12562,7 +12562,7 @@
12562
if (usergroups != null) {
12563
var userGroupCount = 0, newUserGroup = false;
12564
for (var i in usergroups) {
12565
- if (usergroups[i]._id.split('/')[1] != currentMesh._id.split('/')[1]) continue;
12565
+ if ((usergroups[i].membershipType != null) || (usergroups[i]._id.split('/')[1] != currentMesh._id.split('/')[1])) continue;
12566
userGroupCount++;
12567
if ((currentMesh.links == null) || (currentMesh.links[i] == null)) { newUserGroup = true; }
12568
}
@@ -13035,7 +13035,7 @@
13035
if (selected == null) {
13036
var ousergroups = getOrderedList(usergroups, 'name');
13037
for (var i in ousergroups) {
13038
- if (currentNode._id.split('/')[1] != ousergroups[i]._id.split('/')[1]) continue;
13038
+ if ((ousergroups[i].membershipType != null) || (currentNode._id.split('/')[1] != ousergroups[i]._id.split('/')[1])) continue;
13039
if ((currentNode.links == null) || (currentNode.links[ousergroups[i]._id] == null)) { y += '<option value=' + encodeURIComponentEx(ousergroups[i]._id) + '>' + EscapeHtml(ousergroups[i].name) + '</option>'; }
13040
}
13041
} else {
@@ -15151,7 +15151,7 @@
15151
// Add user group name
15152
var gname = EscapeHtml(group.name);
15153
if (gname.length == 0) { gname = '<i>' + "None" + '</i>'; }
15154
- if ((userinfo.siteadmin & 256) != 0) { gname = '<span tabindex=0 title="' + "Click here to edit the user group name" + '" onclick=p51editgroup(1) onkeyup="if (event.key == \'Enter\') p51editgroup(1)" style=cursor:pointer>' + gname + ' <img class=hoverButton src="images/link5.png" /></span>'; }
15154
+ if ((currentUserGroup.membershipType == null) && ((userinfo.siteadmin & 256) != 0)) { gname = '<span tabindex=0 title="' + "Click here to edit the user group name" + '" onclick=p51editgroup(1) onkeyup="if (event.key == \'Enter\') p51editgroup(1)" style=cursor:pointer>' + gname + ' <img class=hoverButton src="images/link5.png" /></span>'; }
15155
QH('p51groupName', gname);
15156
15157
var usercount = 0, meshcount = 0, devicecount = 0;
@@ -15172,8 +15172,11 @@
15172
x += addDeviceAttribute("Domain", (d != '')?EscapeHtml(d):('<i>' + "Default" + '</i>'));
15173
x += addDeviceAttribute("Group Identifier", EscapeHtml(group._id));
15174
}
15175
+ if (currentUserGroup.membershipType != null) {
15176
+ x += addDeviceAttribute("Group Type", EscapeHtml(currentUserGroup.membershipType));
15177
+ }
15178
if ((userinfo.siteadmin & 256) != 0) {
15176
- x += addDeviceAttribute("Description", '<span onclick=p51editgroup(2) style=cursor:pointer>' + desc + ' <img class=hoverButton src="images/link5.png" /></span>');
15179
+ x += addDeviceAttribute("Description", '<span onclick=p51editgroup(2,' + (currentUserGroup.membershipType != null) + ') style=cursor:pointer>' + desc + ' <img class=hoverButton src="images/link5.png" /></span>');
15180
} else {
15181
x += addDeviceAttribute("Description", desc);
15182
}
@@ -15217,7 +15220,7 @@
15220
QH('p51group', x);
15221
15222
x = '<br />';
15220
- if ((userinfo.siteadmin & 256) != 0) {
15223
+ if ((currentUserGroup.membershipType == null) && ((userinfo.siteadmin & 256) != 0)) {
15224
x += '<a href=# onclick="return p51showAddUserDialog()" style=cursor:pointer;margin-right:10px><img src=images/icon-addnew.png border=0 height=12 width=12> ' + "Add Users" + '</a>';
15225
}
15226
x += '<table style="color:black;background-color:#EEE;border-color:#AAA;border-width:1px;border-style:solid;border-collapse:collapse" border=0 cellpadding=2 cellspacing=0 width=100%><tbody><tr style=background-color:#AAAAAA;font-weight:bold><th scope=col style=text-align:left;width:430px>' + "Group Members" + '</th><th scope=col style=text-align:left></th></tr>';
@@ -15235,7 +15238,8 @@
15238
15239
// Display all users for this user group
15240
for (var i in sortedusers) {
15238
- var trash = '<a href=# onclick=\'return p51deleteUser(event,"' + encodeURIComponentEx(sortedusers[i].id) + '")\' title="' + "Remove user rights to this device group" + '" style=cursor:pointer><img src=images/trash.png border=0 height=10 width=10></a>';
15241
+ var trash = '';
15242
+ if (currentUserGroup.membershipType == null) { trash = '<a href=# onclick=\'return p51deleteUser(event,"' + encodeURIComponentEx(sortedusers[i].id) + '")\' title="' + "Remove user rights to this device group" + '" style=cursor:pointer><img src=images/trash.png border=0 height=10 width=10></a>'; }
15243
var username = EscapeHtml(decodeURIComponent(sortedusers[i].name));
15244
if (users != null) { username = '<a href=# onclick=\'gotoUser("' + encodeURIComponentEx(sortedusers[i].id) + '");haltEvent(event);\'>' + username + '</a>'; }
15245
x += '<tr ' + (((count % 2) == 0) ? 'style=background-color:#DDD' : '') + '><td><div title="' + "User" + '" class=m2></div><div> ' + username + '<div></div></div></td><td><div style=float:right>' + trash + '</div></td></tr>';
@@ -15294,7 +15298,7 @@
15298
if (count == 1) { x += '<tr><td><div style=padding:6px> <i>' + "No devices in common" + '</i><div></div></div></td><td></td></tr>'; }
15299
x += '</tbody></table>';
15300
15297
- if ((userinfo.siteadmin & 256) != 0) {
15301
+ if (((currentUserGroup.membershipType == null) || (usercount == 0)) && ((userinfo.siteadmin & 256) != 0)) {
15302
x += '<div style=font-size:small;text-align:right><span><a href=# onclick=p51showDeleteUserGroupDialog() style=cursor:pointer>' + "Delete User Group" + '</a></span></div>';
15303
}
15304
@@ -15349,9 +15353,9 @@
15353
meshserver.send({ action: 'removemeshuser', meshid: meshid, userid: currentUserGroup._id });
15354
}
15355
15352
- function p51editgroup(focus) {
15356
+ function p51editgroup(focus, nameReadOnly) {
15357
if (xxdialogMode) return;
15354
- var x = addHtmlValue("Name", '<input id=dp51name style=width:230px maxlength=32 onchange=p51editgroupValidate() onkeyup=p51editgroupValidate(event) />');
15358
+ var x = addHtmlValue("Name", '<input id=dp51name style=width:230px maxlength=32 onchange=p51editgroupValidate() onkeyup=p51editgroupValidate(event) ' + (nameReadOnly ? 'readonly disabled' : '') + '/>');
15359
x += addHtmlValue("Description", '<div style=width:230px;margin:0;padding:0><textarea id=dp51desc maxlength=1024 style=width:100%;resize:none></textarea></div>');
15360
setDialogMode(2, "Edit User Group", 3, p51editgroupEx, x);
15361
Q('dp51name').value = currentUserGroup.name;
@@ -15893,7 +15897,7 @@
15897
if ((userinfo.siteadmin & 256) != 0) {
15898
var userGroupCount = 0, newUserGroup = false;
15899
for (var i in usergroups) {
15896
- if (usergroups[i]._id.split('/')[1] != currentUser._id.split('/')[1]) continue;
15900
+ if ((usergroups[i].membershipType != null) || (usergroups[i]._id.split('/')[1] != currentUser._id.split('/')[1])) continue;
15901
userGroupCount++;
15902
if ((currentUser.links == null) || (currentUser.links[i] == null)) { newUserGroup = true; }
15903
}
@@ -15911,7 +15915,7 @@
15915
groupname = EscapeHtml(group.name);
15916
if (usergroups != null) { groupname = '<a href=# onclick=\'gotoUserGroup("' + encodeURIComponentEx(ougroups[i]._id) + '");haltEvent(event);\'>' + groupname + '</a>'; }
15917
}
15914
- if ((userinfo.siteadmin & 256) != 0) { trash = '<a href=# onclick=\'return p30RemoveUserGroup(event,"' + encodeURIComponentEx(ougroups[i]._id) + '")\' title="' + "Remove user group membership" + '" style=cursor:pointer><img src=images/trash.png border=0 height=10 width=10></a>'; }
15918
+ if ((group.membershipType == null) && ((userinfo.siteadmin & 256) != 0)) { trash = '<a href=# onclick=\'return p30RemoveUserGroup(event,"' + encodeURIComponentEx(ougroups[i]._id) + '")\' title="' + "Remove user group membership" + '" style=cursor:pointer><img src=images/trash.png border=0 height=10 width=10></a>'; }
15919
x += '<tr ' + (((++count % 2) == 0) ? 'style=background-color:#DDD' : '') + '><td><div title="' + "User Group" + '" class=m4></div><div> ' + groupname + '<div></div></div></td><td><div style=float:right>' + trash + '</div></td></tr>';
15920
}
15921
}
@@ -15986,7 +15990,7 @@
15990
if (xxdialogMode || (usergroups == null)) return;
15991
var y = '';
15992
for (var i in usergroups) {
15989
- if (usergroups[i]._id.split('/')[1] != currentUser._id.split('/')[1]) continue;
15993
+ if ((usergroups[i].membershipType != null) || (usergroups[i]._id.split('/')[1] != currentUser._id.split('/')[1])) continue;
15994
if ((currentUser.links == null) || (currentUser.links[i] == null)) { y += '<option value=' + encodeURIComponentEx(i) + '>' + EscapeHtml(usergroups[i].name) + '</option>'; }
15995
}
15996
var x = addHtmlValue("User Group", '<div style=width:230px;margin:0;padding:0><select id=dp2groupid style=width:100%>' + y + '</select></div>');
webserver.js
+106
-9
@@ -472,21 +472,18 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
472
if (username == null) { username = shortname; }
473
var userid = 'user/' + domain.id + '/' + shortname;
474
475
+ // Get the list of groups this user is a member of.
476
+ var userMemberships = xxuser[(typeof domain.ldapusergroups == 'string') ? domain.ldapusergroups : 'memberOf'];
477
+ if (typeof userMemberships == 'string') { userMemberships = [userMemberships]; }
478
+ if (Array.isArray(userMemberships) == false) { userMemberships = []; }
479
+
480
// See if the user is required to be part of an LDAP user group in order to log into this server.
481
if (typeof domain.ldapuserrequiredgroupmembership == 'string') { domain.ldapuserrequiredgroupmembership = [domain.ldapuserrequiredgroupmembership]; }
482
if (Array.isArray(domain.ldapuserrequiredgroupmembership) && (domain.ldapuserrequiredgroupmembership.length > 0)) {
478
- // We must be part of a LDAP user group, lets get the list of groups this user is a member of.
479
- const memberOfKey = (typeof domain.ldapusergroups == 'string') ? domain.ldapusergroups : 'memberOf';
480
- var userMemberships = xxuser[memberOfKey];
481
- if (typeof userMemberships == 'string') { userMemberships = [userMemberships]; }
482
- if (Array.isArray(userMemberships) == false) { userMemberships = []; }
483
-
483
// Look for a matching LDAP user group
484
var userMembershipMatch = false;
485
for (var i in domain.ldapuserrequiredgroupmembership) { if (userMemberships.indexOf(domain.ldapuserrequiredgroupmembership[i]) >= 0) { userMembershipMatch = true; } }
487
-
488
- // If there is no match, deny the login
489
- if (userMembershipMatch === false) { fn('denied'); return; }
486
+ if (userMembershipMatch === false) { fn('denied'); return; } // If there is no match, deny the login
487
}
488
489
// Get the email address for this LDAP user
@@ -578,6 +575,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
575
// Indicate that this user has a image
576
if (userimage != null) { user.flags = 1; }
577
578
+ // Synd the user with LDAP matching user groups
579
+ if (syncExternalUserGroups(domain, user, userMemberships, 'ldap') == true) { userChanged = true; }
580
+
581
obj.users[user._id] = user;
582
obj.db.SetUser(user);
583
var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msgid: 128, msgArgs: [user.name], msg: 'Account created, name is ' + user.name, domain: domain.id };
@@ -612,6 +612,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
612
if ((userimage != null) && ((user.flags == null) || ((user.flags & 1) == 0))) { if (user.flags == null) { user.flags = 1; } else { user.flags += 1; } userChanged = true; }
613
if ((userimage == null) && (user.flags != null) && ((user.flags & 1) != 0)) { if (user.flags == 1) { delete user.flags; } else { user.flags -= 1; } userChanged = true; }
614
615
+ // Synd the user with LDAP matching user groups
616
+ if (syncExternalUserGroups(domain, user, userMemberships, 'ldap') == true) { userChanged = true; }
617
+
618
// If the user changed, save the changes to the database here
619
if (userChanged) {
620
obj.db.SetUser(user);
@@ -8694,5 +8697,99 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
8697
return r;
8698
}
8699
8700
+ // Sync an account with an external user group.
8701
+ // Return true if the user was changed
8702
+ function syncExternalUserGroups(domain, user, userMemberships, userMembershipType) {
8703
+ var userChanged = false;
8704
+ if (user.links == null) { user.links = {}; }
8705
+
8706
+ // Create a user of memberships for this user that type
8707
+ var existingUserMemberships = {};
8708
+ for (var i in user.links) {
8709
+ if (i.startsWith('ugrp/') && (obj.userGroups[i] != null) && (obj.userGroups[i].membershipType == userMembershipType)) { existingUserMemberships[i] = obj.userGroups[i]; }
8710
+ }
8711
+
8712
+ // Go thru the list user memberships and create and add to any user groups as needed
8713
+ for (var i in userMemberships) {
8714
+ const membership = userMemberships[i];
8715
+ var ugrpid = 'ugrp/' + domain.id + '/' + obj.crypto.createHash('sha384').update(membership).digest('base64').replace(/\+/g, '@').replace(/\//g, '$');
8716
+ var ugrp = obj.userGroups[ugrpid];
8717
+ if (ugrp == null) {
8718
+ // This user group does not exist, create it
8719
+ ugrp = { type: 'ugrp', _id: ugrpid, name: membership, domain: domain.id, membershipType: userMembershipType, links: {} };
8720
+
8721
+ // Save the new group
8722
+ db.Set(ugrp);
8723
+ if (db.changeStream == false) { obj.userGroups[ugrpid] = ugrp; }
8724
+
8725
+ // Event the user group creation
8726
+ var event = { etype: 'ugrp', ugrpid: ugrpid, name: ugrp.name, action: 'createusergroup', links: ugrp.links, msgid: 69, msgArgv: [ugrp.name], msg: 'User group created: ' + ugrp.name, ugrpdomain: domain.id };
8727
+ parent.DispatchEvent(['*', ugrpid, user._id], obj, event); // Even if DB change stream is active, this event must be acted upon.
8728
+
8729
+ // Log in the auth log
8730
+ if (parent.authlog) { parent.authLog('https', 'Created ' + userMembershipType + ' user group ' + ugrp.name); }
8731
+ }
8732
+
8733
+ if (existingUserMemberships[ugrpid] == null) {
8734
+ // This user is not part of the user group, add it.
8735
+ if (user.links == null) { user.links = {}; }
8736
+ user.links[ugrp._id] = { rights: 1 };
8737
+ userChanged = true;
8738
+ db.SetUser(user);
8739
+ parent.DispatchEvent([user._id], obj, 'resubscribe');
8740
+
8741
+ // Notify user change
8742
+ var targets = ['*', 'server-users', user._id];
8743
+ var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msgid: 67, msgArgs: [user.name], msg: 'User group membership changed: ' + user.name, domain: domain.id };
8744
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
8745
+ parent.DispatchEvent(targets, obj, event);
8746
+
8747
+ // Add a user to the user group
8748
+ ugrp.links[user._id] = { userid: user._id, name: user.name, rights: 1 };
8749
+ db.Set(ugrp);
8750
+
8751
+ // Notify user group change
8752
+ var event = { etype: 'ugrp', userid: user._id, username: user.name, ugrpid: ugrp._id, name: ugrp.name, desc: ugrp.desc, action: 'usergroupchange', links: ugrp.links, msgid: 71, msgArgs: [user.name, ugrp.name], msg: 'Added user(s) ' + user.name + ' to user group ' + ugrp.name, addUserDomain: domain.id };
8753
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user group. Another event will come.
8754
+ parent.DispatchEvent(['*', ugrp._id, user._id], obj, event);
8755
+ } else {
8756
+ // User is already part of this user group
8757
+ delete existingUserMemberships[ugrpid];
8758
+ }
8759
+ }
8760
+
8761
+ // Remove the user from any memberships they don't belong to anymore
8762
+ for (var ugrpid in existingUserMemberships) {
8763
+ var ugrp = obj.userGroups[ugrpid];
8764
+ if ((user.links != null) && (user.links[ugrpid] != null)) {
8765
+ delete user.links[ugrpid];
8766
+
8767
+ // Notify user change
8768
+ var targets = ['*', 'server-users', user._id, user._id];
8769
+ var event = { etype: 'user', userid: user._id, username: user.name, account: obj.CloneSafeUser(user), action: 'accountchange', msgid: 67, msgArgs: [user.name], msg: 'User group membership changed: ' + user.name, domain: domain.id };
8770
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user. Another event will come.
8771
+ parent.DispatchEvent(targets, obj, event);
8772
+
8773
+ db.SetUser(user);
8774
+ parent.DispatchEvent([user._id], obj, 'resubscribe');
8775
+ }
8776
+
8777
+ if (ugrp != null) {
8778
+ // Remove the user from the group
8779
+ if ((ugrp.links != null) && (ugrp.links[user._id] != null)) {
8780
+ delete ugrp.links[user._id];
8781
+ db.Set(ugrp);
8782
+
8783
+ // Notify user group change
8784
+ var event = { etype: 'ugrp', userid: user._id, username: user.name, ugrpid: ugrp._id, name: ugrp.name, desc: ugrp.desc, action: 'usergroupchange', links: ugrp.links, msgid: 72, msgArgs: [user.name, ugrp.name], msg: 'Removed user ' + user.name + ' from user group ' + ugrp.name, domain: domain.id };
8785
+ if (db.changeStream) { event.noact = 1; } // If DB change stream is active, don't use this event to change the user group. Another event will come.
8786
+ parent.DispatchEvent(['*', ugrp._id, user._id], obj, event);
8787
+ }
8788
+ }
8789
+ }
8790
+
8791
+ return userChanged;
8792
+ }
8793
+
8794
return obj;
8795
};