LDAP fixes.
Ylian Saint-Hilaire committed
Apr 11, 2019 at 14:52 UTC
ba3503ebe0d711b3c5867590c232b873f38f7524
3 files changed
+58
-29
meshcentral.js
+1
@@ -558,6 +558,7 @@ function CreateMeshCentralServer(config, args) {
558
process.exit();
559
return;
560
}
561
+ if ((obj.config.domains[i].auth == 'ldap') || (obj.config.domains[i].auth == 'sspi')) { obj.config.domains[i].newaccounts = 0; } // No new accounts allowed in SSPI/LDAP authentication modes.
562
}
563
564
// Log passed arguments into Windows Service Log
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.3.2-i",
3
+ "version": "0.3.2-k",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+56
-28
@@ -219,36 +219,64 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
219
if (!module.parent) console.log('authenticating %s:%s:%s', domain.id, name, pass);
220
221
if (domain.auth == 'ldap') {
222
- // LDAP login
223
- var LdapAuth = require('ldapauth-fork');
224
- var ldap = new LdapAuth(domain.ldapoptions);
225
- ldap.authenticate(name, pass, function (err, xxuser) {
226
- try { ldap.close(); } catch (ex) { console.log(ex); } // Close the LDAP object
227
- if (err) { fn(new Error('invalid password')); return; }
228
- if (xxuser.objectSid == null) { fn(new Error('no objectSid')); return; }
229
- var userid = 'user/' + domain.id + '/' + Buffer.from(xxuser.objectSid, 'binary').toString('hex').toLowerCase();
230
- var user = obj.users[userid];
231
- if (user == null) {
232
- // This user does not exist, create a new account.
233
- var name = null;
234
- if (xxuser.displayName) { name = xxuser.displayName; }
235
- else if (xxuser.name) { name = xxuser.name; }
236
- else if (xxuser.cn) { name = xxuser.cn; }
237
- if (name == null) { fn(new Error('no user name')); return; }
238
- var user = { type: 'user', _id: userid, name: name, creation: Math.floor(Date.now() / 1000), login: Math.floor(Date.now() / 1000), domain: domain.id };
239
- var usercount = 0;
240
- for (var i in obj.users) { if (obj.users[i].domain == domain.id) { usercount++; } }
241
- if (usercount == 0) { user.siteadmin = 0xFFFFFFFF; if (domain.newaccounts === 2) { domain.newaccounts = 0; } } // If this is the first user, give the account site admin.
242
- obj.users[user._id] = user;
243
- obj.db.SetUser(user);
244
- obj.parent.DispatchEvent(['*', 'server-users'], obj, { etype: 'user', username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msg: 'Account created, name is ' + name, domain: domain.id });
245
- return fn(null, user._id);
222
+ if (domain.ldapoptions.url == 'test') {
223
+ // Fake LDAP login
224
+ var xxuser = domain.ldapoptions[name.toLowerCase()];
225
+ if (xxuser == null) {
226
+ fn(new Error('invalid password'));
227
+ return;
228
} else {
247
- // This is an existing user
248
- if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
249
- return fn(null, user._id);
229
+ var shortname = null;
230
+ if (xxuser.name) { shortname = xxuser.name; }
231
+ else if (xxuser.cn) { shortname = xxuser.cn; }
232
+ if (shortname == null) { fn(new Error('no short name')); return; }
233
+ var userid = 'user/' + domain.id + '/' + shortname;
234
+ var user = obj.users[userid];
235
+ if (user == null) {
236
+ var user = { type: 'user', _id: userid, name: shortname, creation: Math.floor(Date.now() / 1000), login: Math.floor(Date.now() / 1000), domain: domain.id };
237
+ var usercount = 0;
238
+ for (var i in obj.users) { if (obj.users[i].domain == domain.id) { usercount++; } }
239
+ if (usercount == 0) { user.siteadmin = 0xFFFFFFFF; if (domain.newaccounts === 2) { domain.newaccounts = 0; } } // If this is the first user, give the account site admin.
240
+ obj.users[user._id] = user;
241
+ obj.db.SetUser(user);
242
+ obj.parent.DispatchEvent(['*', 'server-users'], obj, { etype: 'user', username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msg: 'Account created, name is ' + name, domain: domain.id });
243
+ return fn(null, user._id);
244
+ } else {
245
+ // This is an existing user
246
+ if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
247
+ return fn(null, user._id);
248
+ }
249
}
251
- });
250
+ } else {
251
+ // LDAP login
252
+ var LdapAuth = require('ldapauth-fork');
253
+ var ldap = new LdapAuth(domain.ldapoptions);
254
+ ldap.authenticate(name, pass, function (err, xxuser) {
255
+ try { ldap.close(); } catch (ex) { console.log(ex); } // Close the LDAP object
256
+ if (err) { fn(new Error('invalid password')); return; }
257
+ var shortname = null;
258
+ if (xxuser.name) { shortname = xxuser.name; }
259
+ else if (xxuser.cn) { shortname = xxuser.cn; }
260
+ if (shortname == null) { fn(new Error('no short name')); return; }
261
+ var userid = 'user/' + domain.id + '/' + shortname;
262
+ var user = obj.users[userid];
263
+ if (user == null) {
264
+ // This user does not exist, create a new account.
265
+ var user = { type: 'user', _id: userid, name: shortname, creation: Math.floor(Date.now() / 1000), login: Math.floor(Date.now() / 1000), domain: domain.id };
266
+ var usercount = 0;
267
+ for (var i in obj.users) { if (obj.users[i].domain == domain.id) { usercount++; } }
268
+ if (usercount == 0) { user.siteadmin = 0xFFFFFFFF; if (domain.newaccounts === 2) { domain.newaccounts = 0; } } // If this is the first user, give the account site admin.
269
+ obj.users[user._id] = user;
270
+ obj.db.SetUser(user);
271
+ obj.parent.DispatchEvent(['*', 'server-users'], obj, { etype: 'user', username: user.name, account: obj.CloneSafeUser(user), action: 'accountcreate', msg: 'Account created, name is ' + name, domain: domain.id });
272
+ return fn(null, user._id);
273
+ } else {
274
+ // This is an existing user
275
+ if ((user.siteadmin) && (user.siteadmin != 0xFFFFFFFF) && (user.siteadmin & 32) != 0) { fn('locked'); return; }
276
+ return fn(null, user._id);
277
+ }
278
+ });
279
+ }
280
} else {
281
// Regular login
282
var user = obj.users['user/' + domain.id + '/' + name.toLowerCase()];