Replace entire codebase with homarr-labs/homarr
This commit is contained in:
Thomas Camlong
@@ -0,0 +1,39 @@
|
||||
import bcrypt from "bcrypt";
|
||||
import type { z } from "zod/v4";
|
||||
|
||||
import { createLogger } from "@homarr/core/infrastructure/logs";
|
||||
import type { Database } from "@homarr/db";
|
||||
import { and, eq } from "@homarr/db";
|
||||
import { users } from "@homarr/db/schema";
|
||||
import type { userSignInSchema } from "@homarr/validation/user";
|
||||
|
||||
const logger = createLogger({ module: "basicAuthorization" });
|
||||
|
||||
export const authorizeWithBasicCredentialsAsync = async (
|
||||
db: Database,
|
||||
credentials: z.infer<typeof userSignInSchema>,
|
||||
) => {
|
||||
const user = await db.query.users.findFirst({
|
||||
where: and(eq(users.name, credentials.name.toLowerCase()), eq(users.provider, "credentials")),
|
||||
});
|
||||
|
||||
if (!user?.password) {
|
||||
logger.info("User not found", { userName: credentials.name });
|
||||
return null;
|
||||
}
|
||||
|
||||
logger.info("User is trying to log in. Checking password...", { userName: user.name });
|
||||
const isValidPassword = await bcrypt.compare(credentials.password, user.password);
|
||||
|
||||
if (!isValidPassword) {
|
||||
logger.warn("Password for user was incorrect", { userName: user.name });
|
||||
return null;
|
||||
}
|
||||
|
||||
logger.info("User successfully authorized", { userName: user.name });
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
name: user.name,
|
||||
};
|
||||
};
|
||||
@@ -0,0 +1,149 @@
|
||||
import { CredentialsSignin } from "@auth/core/errors";
|
||||
import { z } from "zod/v4";
|
||||
|
||||
import { createId } from "@homarr/common";
|
||||
import { createLogger } from "@homarr/core/infrastructure/logs";
|
||||
import type { Database, InferInsertModel } from "@homarr/db";
|
||||
import { and, eq } from "@homarr/db";
|
||||
import { users } from "@homarr/db/schema";
|
||||
import type { ldapSignInSchema } from "@homarr/validation/user";
|
||||
|
||||
import { env } from "../../../env";
|
||||
import { LdapClient } from "../ldap-client";
|
||||
|
||||
const logger = createLogger({ module: "ldapAuthorization" });
|
||||
|
||||
export const authorizeWithLdapCredentialsAsync = async (
|
||||
db: Database,
|
||||
credentials: z.infer<typeof ldapSignInSchema>,
|
||||
) => {
|
||||
logger.info("User is trying to log in using LDAP. Connecting to LDAP server...", { userName: credentials.name });
|
||||
const client = new LdapClient();
|
||||
await client
|
||||
.bindAsync({
|
||||
distinguishedName: env.AUTH_LDAP_BIND_DN,
|
||||
password: env.AUTH_LDAP_BIND_PASSWORD,
|
||||
})
|
||||
.catch((error) => {
|
||||
throw new CredentialsSignin("Failed to connect to LDAP server", { cause: error });
|
||||
});
|
||||
|
||||
logger.info("Connected to LDAP server. Searching for user...");
|
||||
|
||||
const ldapUser = await client
|
||||
.searchAsync({
|
||||
base: env.AUTH_LDAP_BASE,
|
||||
options: {
|
||||
filter: createLdapUserFilter(credentials.name),
|
||||
scope: env.AUTH_LDAP_SEARCH_SCOPE,
|
||||
attributes: [env.AUTH_LDAP_USERNAME_ATTRIBUTE, env.AUTH_LDAP_USER_MAIL_ATTRIBUTE],
|
||||
},
|
||||
})
|
||||
.then((entries) => {
|
||||
if (entries.length > 1) {
|
||||
logger.warn(`Multiple LDAP users found for ${credentials.name}, expected only one.`);
|
||||
throw new CredentialsSignin();
|
||||
}
|
||||
|
||||
return entries.at(0);
|
||||
});
|
||||
|
||||
if (!ldapUser) {
|
||||
throw new CredentialsSignin(`User not found in LDAP username="${credentials.name}"`);
|
||||
}
|
||||
|
||||
// Validate email
|
||||
const mailResult = await z.string().email().safeParseAsync(ldapUser[env.AUTH_LDAP_USER_MAIL_ATTRIBUTE]);
|
||||
|
||||
if (!mailResult.success) {
|
||||
logger.error("User found in LDAP but with invalid or non-existing Email", {
|
||||
userName: credentials.name,
|
||||
emailValue: ldapUser[env.AUTH_LDAP_USER_MAIL_ATTRIBUTE],
|
||||
});
|
||||
throw new CredentialsSignin("User found in LDAP but with invalid or non-existing Email");
|
||||
}
|
||||
|
||||
logger.info("User found in LDAP. Logging in...", { userName: credentials.name });
|
||||
|
||||
// Bind with user credentials to check if the password is correct
|
||||
const userClient = new LdapClient();
|
||||
await userClient
|
||||
.bindAsync({
|
||||
distinguishedName: ldapUser.dn,
|
||||
password: credentials.password,
|
||||
})
|
||||
.catch(() => {
|
||||
logger.warn("Wrong credentials for user", { userName: credentials.name });
|
||||
throw new CredentialsSignin();
|
||||
});
|
||||
await userClient.disconnectAsync();
|
||||
|
||||
logger.info("User credentials are correct. Retrieving user groups...", { userName: credentials.name });
|
||||
|
||||
const userGroups = await client
|
||||
.searchAsync({
|
||||
base: env.AUTH_LDAP_BASE,
|
||||
options: {
|
||||
// For example, if the user is doejohn, the filter will be (&(objectClass=group)(uid=doejohn)) or (&(objectClass=group)(uid=doejohn)(sAMAccountType=1234))
|
||||
filter: `(&(objectClass=${env.AUTH_LDAP_GROUP_CLASS})(${
|
||||
env.AUTH_LDAP_GROUP_MEMBER_ATTRIBUTE
|
||||
}=${ldapUser[env.AUTH_LDAP_GROUP_MEMBER_USER_ATTRIBUTE]})${env.AUTH_LDAP_GROUP_FILTER_EXTRA_ARG ?? ""})`,
|
||||
scope: env.AUTH_LDAP_SEARCH_SCOPE,
|
||||
attributes: ["cn"],
|
||||
},
|
||||
})
|
||||
.then((entries) => entries.map((entry) => entry.cn).filter((group): group is string => group !== undefined));
|
||||
|
||||
logger.info("User groups retrieved", { userName: credentials.name, groups: userGroups.length });
|
||||
|
||||
await client.disconnectAsync();
|
||||
|
||||
// Create or update user in the database
|
||||
let user = await db.query.users.findFirst({
|
||||
columns: {
|
||||
id: true,
|
||||
name: true,
|
||||
image: true,
|
||||
email: true,
|
||||
emailVerified: true,
|
||||
provider: true,
|
||||
},
|
||||
where: and(eq(users.email, mailResult.data), eq(users.provider, "ldap")),
|
||||
});
|
||||
|
||||
if (!user) {
|
||||
logger.info("User not found in the database. Creating...", { userName: credentials.name });
|
||||
|
||||
const insertUser = {
|
||||
id: createId(),
|
||||
name: credentials.name,
|
||||
email: mailResult.data,
|
||||
emailVerified: new Date(), // assume email is verified
|
||||
image: null,
|
||||
provider: "ldap",
|
||||
} satisfies InferInsertModel<typeof users>;
|
||||
|
||||
await db.insert(users).values(insertUser);
|
||||
|
||||
user = insertUser;
|
||||
|
||||
logger.info("User created successfully", { userName: credentials.name });
|
||||
}
|
||||
|
||||
return {
|
||||
id: user.id,
|
||||
name: credentials.name,
|
||||
// Groups is used in events.ts to synchronize groups with external systems
|
||||
groups: userGroups,
|
||||
};
|
||||
};
|
||||
|
||||
const createLdapUserFilter = (username: string) => {
|
||||
if (env.AUTH_LDAP_USERNAME_FILTER_EXTRA_ARG) {
|
||||
// For example, if the username is doejohn and the extra arg is (sAMAccountType=1234), the filter will be (&(uid=doejohn)(sAMAccountType=1234))
|
||||
return `(&(${env.AUTH_LDAP_USERNAME_ATTRIBUTE}=${username})${env.AUTH_LDAP_USERNAME_FILTER_EXTRA_ARG})`;
|
||||
}
|
||||
|
||||
// For example, if the username is doejohn, the filter will be (uid=doejohn)
|
||||
return `(${env.AUTH_LDAP_USERNAME_ATTRIBUTE}=${username})`;
|
||||
};
|
||||
34
packages/auth/providers/credentials/credentials-provider.ts
Normal file
34
packages/auth/providers/credentials/credentials-provider.ts
Normal file
@@ -0,0 +1,34 @@
|
||||
import type Credentials from "@auth/core/providers/credentials";
|
||||
|
||||
import type { Database } from "@homarr/db";
|
||||
import { ldapSignInSchema, userSignInSchema } from "@homarr/validation/user";
|
||||
|
||||
import { authorizeWithBasicCredentialsAsync } from "./authorization/basic-authorization";
|
||||
import { authorizeWithLdapCredentialsAsync } from "./authorization/ldap-authorization";
|
||||
|
||||
type CredentialsConfiguration = Parameters<typeof Credentials>[0];
|
||||
|
||||
export const createCredentialsConfiguration = (db: Database) =>
|
||||
({
|
||||
id: "credentials",
|
||||
type: "credentials",
|
||||
name: "Credentials",
|
||||
// eslint-disable-next-line no-restricted-syntax
|
||||
async authorize(credentials) {
|
||||
const data = await userSignInSchema.parseAsync(credentials);
|
||||
|
||||
return await authorizeWithBasicCredentialsAsync(db, data);
|
||||
},
|
||||
}) satisfies CredentialsConfiguration;
|
||||
|
||||
export const createLdapConfiguration = (db: Database) =>
|
||||
({
|
||||
id: "ldap",
|
||||
type: "credentials",
|
||||
name: "Ldap",
|
||||
// eslint-disable-next-line no-restricted-syntax
|
||||
async authorize(credentials) {
|
||||
const data = await ldapSignInSchema.parseAsync(credentials);
|
||||
return await authorizeWithLdapCredentialsAsync(db, data).catch(() => null);
|
||||
},
|
||||
}) satisfies CredentialsConfiguration;
|
||||
90
packages/auth/providers/credentials/ldap-client.ts
Normal file
90
packages/auth/providers/credentials/ldap-client.ts
Normal file
@@ -0,0 +1,90 @@
|
||||
import type { Entry, SearchOptions as LdapSearchOptions } from "ldapts";
|
||||
import { Client } from "ldapts";
|
||||
|
||||
import { objectEntries } from "@homarr/common";
|
||||
|
||||
import { env } from "../../env";
|
||||
|
||||
export interface BindOptions {
|
||||
distinguishedName: string;
|
||||
password: string;
|
||||
}
|
||||
|
||||
interface SearchOptions {
|
||||
base: string;
|
||||
options: LdapSearchOptions;
|
||||
}
|
||||
|
||||
export class LdapClient {
|
||||
private client: Client;
|
||||
|
||||
constructor() {
|
||||
this.client = new Client({
|
||||
url: env.AUTH_LDAP_URI,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Binds to the LDAP server with the provided distinguishedName and password.
|
||||
* @param distinguishedName distinguishedName to bind to
|
||||
* @param password password to bind with
|
||||
* @returns void
|
||||
*/
|
||||
public async bindAsync({ distinguishedName, password }: BindOptions) {
|
||||
return await this.client.bind(distinguishedName, password);
|
||||
}
|
||||
|
||||
/**
|
||||
* Search for entries in the LDAP server.
|
||||
* @param base base DN to start the search
|
||||
* @param options search options
|
||||
* @returns list of search results
|
||||
*/
|
||||
public async searchAsync({ base, options }: SearchOptions) {
|
||||
const { searchEntries } = await this.client.search(base, options);
|
||||
|
||||
return searchEntries.map((entry) => {
|
||||
return {
|
||||
...objectEntries(entry)
|
||||
.map(([key, value]) => [key, LdapClient.convertEntryPropertyToString(value)] as const)
|
||||
.reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {} as Record<string, string>),
|
||||
dn: LdapClient.getEntryDn(entry),
|
||||
} as {
|
||||
[key: string]: string;
|
||||
dn: string;
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
private static convertEntryPropertyToString(value: Entry[string]) {
|
||||
const firstValue = Array.isArray(value) ? (value[0] ?? "") : value;
|
||||
|
||||
if (typeof firstValue === "string") {
|
||||
return firstValue;
|
||||
}
|
||||
|
||||
return firstValue.toString("utf8");
|
||||
}
|
||||
|
||||
/**
|
||||
* dn is the only attribute returned with special characters formatted in UTF-8 (Bad for any letters with an accent)
|
||||
* Regex replaces any backslash followed by 2 hex characters with a percentage unless said backslash is preceded by another backslash.
|
||||
* That can then be processed by decodeURIComponent which will turn back characters to normal.
|
||||
* @param entry search entry from ldap
|
||||
* @returns normalized distinguishedName
|
||||
*/
|
||||
private static getEntryDn(entry: Entry) {
|
||||
try {
|
||||
return decodeURIComponent(entry.dn.replace(/(?<!\\)\\([0-9a-fA-F]{2})/g, "%$1"));
|
||||
} catch {
|
||||
throw new Error(`Cannot resolve distinguishedName for the entry ${entry.dn}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Disconnects the client from the LDAP server.
|
||||
*/
|
||||
public async disconnectAsync() {
|
||||
await this.client.unbind();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user