depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #750 from fooker/master

Browse source 
Use ldap.usernameField over hardcoded uid fields
This commit is contained in:
Christoph (Sheogorath) Kern 2018-03-03 23:56:01 +01:00 committed by GitHub
commit 96c9096d50
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -175,7 +175,8 @@ There are some config settings you need to change in the files below.
| `HMD_LDAP_SEARCHBASE` | `o=users,dc=example,dc=com` | LDAP directory to begin search from | | `HMD_LDAP_SEARCHBASE` | `o=users,dc=example,dc=com` | LDAP directory to begin search from |
| `HMD_LDAP_SEARCHFILTER` | `(uid={{username}})` | LDAP filter to search with | | `HMD_LDAP_SEARCHFILTER` | `(uid={{username}})` | LDAP filter to search with |
| `HMD_LDAP_SEARCHATTRIBUTES` | `displayName, mail` | LDAP attributes to search with (use comma to separate) | | `HMD_LDAP_SEARCHATTRIBUTES` | `displayName, mail` | LDAP attributes to search with (use comma to separate) |
| `HMD_LDAP_USERNAMEFIELD` | `uid` | The LDAP field which is used as the username on HackMD | | `HMD_LDAP_USERIDFIELD` | `uidNumber` or `uid` or `sAMAccountName` | The LDAP field which is used uniquely identify a user on HackMD |
| `HMD_LDAP_USERNAMEFIELD` | Fallback to userid | The LDAP field which is used as the username on HackMD |
| `HMD_LDAP_TLS_CA` | `server-cert.pem, root.pem` | Root CA for LDAP TLS in PEM format (use comma to separate) | | `HMD_LDAP_TLS_CA` | `server-cert.pem, root.pem` | Root CA for LDAP TLS in PEM format (use comma to separate) |
| `HMD_LDAP_PROVIDERNAME` | `My institution` | Optional name to be displayed at login form indicating the LDAP provider | | `HMD_LDAP_PROVIDERNAME` | `My institution` | Optional name to be displayed at login form indicating the LDAP provider |
| `HMD_SAML_IDPSSOURL` | `https://idp.example.com/sso` | authentication endpoint of IdP. for details, see [guide](docs/guides/auth.md#saml-onelogin). | | `HMD_SAML_IDPSSOURL` | `https://idp.example.com/sso` | authentication endpoint of IdP. for details, see [guide](docs/guides/auth.md#saml-onelogin). |

3
config.json.example
View file

@ -78,7 +78,8 @@
"searchBase": "change this", "searchBase": "change this",
"searchFilter": "change this", "searchFilter": "change this",
"searchAttributes": ["change this"], "searchAttributes": ["change this"],
"usernameField": "change this e.g. uid", "usernameField": "change this e.g. cn",
"useridField": "change this e.g. uid",
"tlsOptions": { "tlsOptions": {
"changeme": "See https://nodejs.org/api/tls.html#tls_tls_connect_options_callback" "changeme": "See https://nodejs.org/api/tls.html#tls_tls_connect_options_callback"
} }

1
lib/config/default.js
View file

@ -115,6 +115,7 @@ module.exports = {
searchFilter: undefined, searchFilter: undefined,
searchAttributes: undefined, searchAttributes: undefined,
usernameField: undefined, usernameField: undefined,
useridField: undefined,
tlsca: undefined tlsca: undefined
}, },
saml: { saml: {

1
lib/config/environment.js
View file

@ -84,6 +84,7 @@ module.exports = {
searchFilter: process.env.HMD_LDAP_SEARCHFILTER, searchFilter: process.env.HMD_LDAP_SEARCHFILTER,
searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES), searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES),
usernameField: process.env.HMD_LDAP_USERNAMEFIELD, usernameField: process.env.HMD_LDAP_USERNAMEFIELD,
useridField: process.env.HMD_LDAP_USERIDFIELD,
tlsca: process.env.HMD_LDAP_TLS_CA tlsca: process.env.HMD_LDAP_TLS_CA
}, },
saml: { saml: {

5
lib/web/auth/ldap/index.js
View file

@ -24,8 +24,11 @@ passport.use(new LDAPStrategy({
} }
}, function (user, done) { }, function (user, done) {
var uuid = user.uidNumber || user.uid || user.sAMAccountName var uuid = user.uidNumber || user.uid || user.sAMAccountName
var username = uuid if (config.ldap.useridField && user[config.ldap.useridField]) {
uuid = user[config.ldap.useridField]
}
var username = uuid
if (config.ldap.usernameField && user[config.ldap.usernameField]) { if (config.ldap.usernameField && user[config.ldap.usernameField]) {
username = user[config.ldap.usernameField] username = user[config.ldap.usernameField]
} }