jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Only list users in ldap groups who have access to the app

Browse Source 
Fixes #215
This commit is contained in:
Johannes Zellner
2017-03-13 11:06:27 +01:00
parent 2f598529fc
commit 1763144278
2 changed files with 72 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
src/ldap.js
View File

@@ -105,40 +105,48 @@ function userSearch(req, res, next) {
function groupSearch(req, res, next) {
debug('group search: dn %s, scope %s, filter %s (from %s)', req.dn.toString(), req.scope, req.filter.toString(), req.connection.ldap.id);
user.list(function (error, result){
if (error) return next(new ldap.OperationsError(error.toString()));
getAppByRequest(req, function (error, app) {
if (error) return next(error);
var groups = [{
name: 'users',
admin: false
}, {
name: 'admins',
admin: true
}];
user.list(function (error, result){
if (error) return next(new ldap.OperationsError(error.toString()));
groups.forEach(function (group) {
var dn = ldap.parseDN('cn=' + group.name + ',ou=groups,dc=cloudron');
var members = group.admin ? result.filter(function (entry) { return entry.admin; }) : result;
async.filter(result, apps.hasAccessTo.bind(null, app), function (error, result) {
if (error) return next(new ldap.OperationsError(error.toString()));
var obj = {
dn: dn.toString(),
attributes: {
objectclass: ['group'],
cn: group.name,
memberuid: members.map(function(entry) { return entry.id; })
}
};
var groups = [{
name: 'users',
admin: false
}, {
name: 'admins',
admin: true
}];
// ensure all filter values are also lowercase
var lowerCaseFilter = safe(function () { return ldap.parseFilter(req.filter.toString().toLowerCase()); }, null);
if (!lowerCaseFilter) return next(new ldap.OperationsError(safe.error.toString()));
groups.forEach(function (group) {
var dn = ldap.parseDN('cn=' + group.name + ',ou=groups,dc=cloudron');
var members = group.admin ? result.filter(function (entry) { return entry.admin; }) : result;
if ((req.dn.equals(dn) || req.dn.parentOf(dn)) && lowerCaseFilter.matches(obj.attributes)) {
res.send(obj);
}
var obj = {
dn: dn.toString(),
attributes: {
objectclass: ['group'],
cn: group.name,
memberuid: members.map(function(entry) { return entry.id; })
}
};
// ensure all filter values are also lowercase
var lowerCaseFilter = safe(function () { return ldap.parseFilter(req.filter.toString().toLowerCase()); }, null);
if (!lowerCaseFilter) return next(new ldap.OperationsError(safe.error.toString()));
if ((req.dn.equals(dn) || req.dn.parentOf(dn)) && lowerCaseFilter.matches(obj.attributes)) {
res.send(obj);
}
});
res.end();
});
});
res.end();
});
}