X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=src%2Fauth.js;h=80fa122a6c87cffc4cdb3622bb61148efef7a900;hb=8dc61bb6fc5c3287aeec7ceeecace6ca63066269;hp=f49ca38130b3a0e839a51f73e0c5dc7d9c2b3839;hpb=7a5fd6540b6846475e4a355c68abb897ca8a4cb4;p=perso%2FImmae%2FProjets%2FNodejs%2FSurfer.git diff --git a/src/auth.js b/src/auth.js index f49ca38..80fa122 100644 --- a/src/auth.js +++ b/src/auth.js @@ -3,23 +3,67 @@ var passport = require('passport'), path = require('path'), safe = require('safetydance'), + fs = require('fs'), bcrypt = require('bcryptjs'), uuid = require('uuid/v4'), BearerStrategy = require('passport-http-bearer').Strategy, - LdapStrategy = require('passport-ldapjs').Strategy, - HttpSuccess = require('connect-lastmile').HttpSuccess; + ldapjs = require('ldapjs'), + HttpError = require('connect-lastmile').HttpError, + HttpSuccess = require('connect-lastmile').HttpSuccess, + webdavErrors = require('webdav-server').v2.Errors; + +const LDAP_URL = process.env.LDAP_URL; +const LDAP_USERS_BASE_DN = process.env.LDAP_USERS_BASE_DN; +const LOCAL_AUTH_FILE = path.resolve(process.env.LOCAL_AUTH_FILE || './.users.json'); +const TOKENSTORE_FILE = path.resolve(process.env.TOKENSTORE_FILE || './.tokens.json'); +const AUTH_METHOD = (LDAP_URL && LDAP_USERS_BASE_DN) ? 'ldap' : 'local'; + +if (AUTH_METHOD === 'ldap') { + console.log('Use ldap auth'); +} else { + console.log(`Use local auth file ${LOCAL_AUTH_FILE}`); +} -var LOCAL_AUTH_FILE = path.resolve(process.env.LOCAL_AUTH_FILE || './.users.json'); +var tokenStore = { + data: {}, + save: function () { + try { + fs.writeFileSync(TOKENSTORE_FILE, JSON.stringify(tokenStore.data), 'utf-8'); + } catch (e) { + console.error(`Unable to save tokenstore file at ${TOKENSTORE_FILE}`, e); + } + }, + get: function (token, callback) { + callback(tokenStore.data[token] ? null : 'not found', tokenStore.data[token]); + }, + set: function (token, data, callback) { + tokenStore.data[token] = data; + tokenStore.save(); + callback(null); + }, + del: function (token, callback) { + delete tokenStore.data[token]; + tokenStore.save(); + callback(null); + } +}; -var gTokenStore = {}; +// load token store data if any +try { + console.log(`Using tokenstore file: ${TOKENSTORE_FILE}`); + tokenStore.data = JSON.parse(fs.readFileSync(TOKENSTORE_FILE, 'utf-8')); +} catch (e) { + // start with empty token store +} function issueAccessToken() { return function (req, res, next) { var accessToken = uuid(); - gTokenStore[accessToken] = req.user; - - next(new HttpSuccess(201, { accessToken: accessToken, user: req.user })); + tokenStore.set(accessToken, req.user, function (error) { + if (error) return next(new HttpError(500, error)); + next(new HttpSuccess(201, { accessToken: accessToken, user: req.user })); + }); }; } @@ -33,69 +77,116 @@ passport.deserializeUser(function (id, done) { done(null, { uid: id }); }); -var LDAP_URL = process.env.LDAP_URL; -var LDAP_USERS_BASE_DN = process.env.LDAP_USERS_BASE_DN; +function verifyUser(username, password, callback) { + if (AUTH_METHOD === 'ldap') { + var ldapClient = ldapjs.createClient({ url: process.env.LDAP_URL }); + ldapClient.on('error', function (error) { + console.error('LDAP error', error); + }); -if (LDAP_URL && LDAP_USERS_BASE_DN) { - console.log('Enable ldap auth'); + ldapClient.bind(process.env.LDAP_BIND_DN, process.env.LDAP_BIND_PASSWORD, function (error) { + if (error) return callback(error); - exports.login = [ passport.authenticate('ldap'), issueAccessToken() ]; -} else { - console.log('Use local user file:', LOCAL_AUTH_FILE); + var filter = `(|(uid=${username})(mail=${username})(username=${username})(sAMAccountName=${username}))`; + ldapClient.search(process.env.LDAP_USERS_BASE_DN, { filter: filter }, function (error, result) { + if (error) return callback(error); - exports.login = [ - function (req, res, next) { - var users = safe.JSON.parse(safe.fs.readFileSync(LOCAL_AUTH_FILE)); - if (!users) return res.send(401); - if (!users[req.query.username]) return res.send(401); + var items = []; - bcrypt.compare(req.query.password, users[req.query.username].passwordHash, function (error, valid) { - if (error || !valid) return res.send(401); + result.on('searchEntry', function(entry) { items.push(entry.object); }); + result.on('error', callback); + result.on('end', function (result) { + if (result.status !== 0 || items.length === 0) return callback('Invalid credentials'); - req.user = { - username: req.query.username - }; + // pick the first found + var user = items[0]; - next(); + ldapClient.bind(user.dn, password, function (error) { + if (error) return callback('Invalid credentials'); + + callback(null, { username: username }); + }); + }); }); - }, - issueAccessToken() - ]; + }); + } else { + var users = safe.JSON.parse(safe.fs.readFileSync(LOCAL_AUTH_FILE)); + if (!users || !users[username]) return callback('Invalid credentials'); + + bcrypt.compare(password, users[username].passwordHash, function (error, valid) { + if (error || !valid) return callback('Invalid credentials'); + + callback(null, { username: username }); + }); + } } -var opts = { - server: { - url: LDAP_URL, - }, - base: LDAP_USERS_BASE_DN, - search: { - filter: '(|(username={{username}})(mail={{username}}))', - attributes: ['displayname', 'username', 'mail', 'uid'], - scope: 'sub' - }, - uidTag: 'cn', - usernameField: 'username', - passwordField: 'password', -}; +exports.login = [ + function (req, res, next) { + verifyUser(req.body.username, req.body.password, function (error, user) { + if (error) return next(new HttpError(401, 'Invalid credentials')); -passport.use(new LdapStrategy(opts, function (profile, done) { - done(null, profile); -})); + req.user = user; + + next(); + }); + }, + issueAccessToken() +]; exports.verify = passport.authenticate('bearer', { session: false }); passport.use(new BearerStrategy(function (token, done) { - if (!gTokenStore[token]) return done(null, false); - - return done(null, gTokenStore[token], { accessToken: token }); + tokenStore.get(token, function (error, result) { + if (error) { + console.error(error); + return done(null, false); + } + + done(null, result, { accessToken: token }); + }); })); exports.logout = function (req, res, next) { - delete gTokenStore[req.authInfo.accessToken]; + tokenStore.del(req.authInfo.accessToken, function (error) { + if (error) console.error(error); - next(new HttpSuccess(200, {})); + next(new HttpSuccess(200, {})); + }); }; exports.getProfile = function (req, res, next) { next(new HttpSuccess(200, { username: req.user.username })); }; + +// webdav usermanager +exports.WebdavUserManager = WebdavUserManager; + +// This implements the required interface only for the Basic Authentication for webdav-server +function WebdavUserManager() {}; + +WebdavUserManager.prototype.getDefaultUser = function (callback) { + // this is only a dummy user, since we always require authentication + var user = { + username: 'DefaultUser', + password: null, + isAdministrator: false, + isDefaultUser: true, + uid: 'DefaultUser' + }; + + callback(user); +}; + +WebdavUserManager.prototype.getUserByNamePassword = function (username, password, callback) { + verifyUser(username, password, function (error, user) { + if (error) return callback(webdavErrors.UserNotFound); + + callback(null, { + username: user.username, + isAdministrator: true, + isDefaultUser: false, + uid: user.username + }); + }); +};