mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-11 07:42:56 +03:00
559 lines
17 KiB
Go
559 lines
17 KiB
Go
package service
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/tls"
|
|
"encoding/base64"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/url"
|
|
"path"
|
|
"strings"
|
|
"time"
|
|
"unicode/utf8"
|
|
|
|
"github.com/go-ldap/ldap/v3"
|
|
"github.com/google/uuid"
|
|
"github.com/pocket-id/pocket-id/backend/internal/storage"
|
|
"github.com/pocket-id/pocket-id/backend/internal/utils"
|
|
"golang.org/x/text/unicode/norm"
|
|
"gorm.io/gorm"
|
|
|
|
"github.com/pocket-id/pocket-id/backend/internal/common"
|
|
"github.com/pocket-id/pocket-id/backend/internal/dto"
|
|
"github.com/pocket-id/pocket-id/backend/internal/model"
|
|
)
|
|
|
|
type LdapService struct {
|
|
db *gorm.DB
|
|
httpClient *http.Client
|
|
appConfigService *AppConfigService
|
|
userService *UserService
|
|
groupService *UserGroupService
|
|
fileStorage storage.FileStorage
|
|
}
|
|
|
|
type savePicture struct {
|
|
userID string
|
|
username string
|
|
picture string
|
|
}
|
|
|
|
func NewLdapService(db *gorm.DB, httpClient *http.Client, appConfigService *AppConfigService, userService *UserService, groupService *UserGroupService, fileStorage storage.FileStorage) *LdapService {
|
|
return &LdapService{
|
|
db: db,
|
|
httpClient: httpClient,
|
|
appConfigService: appConfigService,
|
|
userService: userService,
|
|
groupService: groupService,
|
|
fileStorage: fileStorage,
|
|
}
|
|
}
|
|
|
|
func (s *LdapService) createClient() (*ldap.Conn, error) {
|
|
dbConfig := s.appConfigService.GetDbConfig()
|
|
|
|
if !dbConfig.LdapEnabled.IsTrue() {
|
|
return nil, fmt.Errorf("LDAP is not enabled")
|
|
}
|
|
|
|
// Setup LDAP connection
|
|
client, err := ldap.DialURL(dbConfig.LdapUrl.Value, ldap.DialWithTLSConfig(&tls.Config{
|
|
InsecureSkipVerify: dbConfig.LdapSkipCertVerify.IsTrue(), //nolint:gosec
|
|
}))
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to connect to LDAP: %w", err)
|
|
}
|
|
|
|
// Bind as service account
|
|
err = client.Bind(dbConfig.LdapBindDn.Value, dbConfig.LdapBindPassword.Value)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to bind to LDAP: %w", err)
|
|
}
|
|
return client, nil
|
|
}
|
|
|
|
func (s *LdapService) SyncAll(ctx context.Context) error {
|
|
// Setup LDAP connection
|
|
client, err := s.createClient()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create LDAP client: %w", err)
|
|
}
|
|
defer client.Close()
|
|
|
|
// Start a transaction
|
|
tx := s.db.Begin()
|
|
defer func() {
|
|
tx.Rollback()
|
|
}()
|
|
|
|
savePictures, deleteFiles, err := s.SyncUsers(ctx, tx, client)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to sync users: %w", err)
|
|
}
|
|
|
|
err = s.SyncGroups(ctx, tx, client)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to sync groups: %w", err)
|
|
}
|
|
|
|
// Commit the changes
|
|
err = tx.Commit().Error
|
|
if err != nil {
|
|
return fmt.Errorf("failed to commit changes to database: %w", err)
|
|
}
|
|
|
|
// Now that we've committed the transaction, we can perform operations on the storage layer
|
|
// First, save all new pictures
|
|
for _, sp := range savePictures {
|
|
err = s.saveProfilePicture(ctx, sp.userID, sp.picture)
|
|
if err != nil {
|
|
// This is not a fatal error
|
|
slog.Warn("Error saving profile picture for LDAP user", slog.String("username", sp.username), slog.Any("error", err))
|
|
}
|
|
}
|
|
|
|
// Delete all old files
|
|
for _, path := range deleteFiles {
|
|
err = s.fileStorage.Delete(ctx, path)
|
|
if err != nil {
|
|
// This is not a fatal error
|
|
slog.Error("Failed to delete file after LDAP sync", slog.String("path", path), slog.Any("error", err))
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
//nolint:gocognit
|
|
func (s *LdapService) SyncGroups(ctx context.Context, tx *gorm.DB, client *ldap.Conn) error {
|
|
dbConfig := s.appConfigService.GetDbConfig()
|
|
|
|
searchAttrs := []string{
|
|
dbConfig.LdapAttributeGroupName.Value,
|
|
dbConfig.LdapAttributeGroupUniqueIdentifier.Value,
|
|
dbConfig.LdapAttributeGroupMember.Value,
|
|
}
|
|
|
|
searchReq := ldap.NewSearchRequest(
|
|
dbConfig.LdapBase.Value,
|
|
ldap.ScopeWholeSubtree,
|
|
0, 0, 0, false,
|
|
dbConfig.LdapUserGroupSearchFilter.Value,
|
|
searchAttrs,
|
|
[]ldap.Control{},
|
|
)
|
|
result, err := client.Search(searchReq)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to query LDAP: %w", err)
|
|
}
|
|
|
|
// Create a mapping for groups that exist
|
|
ldapGroupIDs := make(map[string]struct{}, len(result.Entries))
|
|
|
|
for _, value := range result.Entries {
|
|
ldapId := convertLdapIdToString(value.GetAttributeValue(dbConfig.LdapAttributeGroupUniqueIdentifier.Value))
|
|
|
|
// Skip groups without a valid LDAP ID
|
|
if ldapId == "" {
|
|
slog.Warn("Skipping LDAP group without a valid unique identifier", slog.String("attribute", dbConfig.LdapAttributeGroupUniqueIdentifier.Value))
|
|
continue
|
|
}
|
|
|
|
ldapGroupIDs[ldapId] = struct{}{}
|
|
|
|
// Try to find the group in the database
|
|
var databaseGroup model.UserGroup
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Where("ldap_id = ?", ldapId).
|
|
First(&databaseGroup).
|
|
Error
|
|
if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
|
|
// This could error with ErrRecordNotFound and we want to ignore that here
|
|
return fmt.Errorf("failed to query for LDAP group ID '%s': %w", ldapId, err)
|
|
}
|
|
|
|
// Get group members and add to the correct Group
|
|
groupMembers := value.GetAttributeValues(dbConfig.LdapAttributeGroupMember.Value)
|
|
membersUserId := make([]string, 0, len(groupMembers))
|
|
for _, member := range groupMembers {
|
|
username := getDNProperty(dbConfig.LdapAttributeUserUsername.Value, member)
|
|
|
|
// If username extraction fails, try to query LDAP directly for the user
|
|
if username == "" {
|
|
// Query LDAP to get the user by their DN
|
|
userSearchReq := ldap.NewSearchRequest(
|
|
member,
|
|
ldap.ScopeBaseObject,
|
|
0, 0, 0, false,
|
|
"(objectClass=*)",
|
|
[]string{dbConfig.LdapAttributeUserUsername.Value, dbConfig.LdapAttributeUserUniqueIdentifier.Value},
|
|
[]ldap.Control{},
|
|
)
|
|
|
|
userResult, err := client.Search(userSearchReq)
|
|
if err != nil || len(userResult.Entries) == 0 {
|
|
slog.WarnContext(ctx, "Could not resolve group member DN", slog.String("member", member), slog.Any("error", err))
|
|
continue
|
|
}
|
|
|
|
username = userResult.Entries[0].GetAttributeValue(dbConfig.LdapAttributeUserUsername.Value)
|
|
if username == "" {
|
|
slog.WarnContext(ctx, "Could not extract username from group member DN", slog.String("member", member))
|
|
continue
|
|
}
|
|
}
|
|
|
|
username = norm.NFC.String(username)
|
|
|
|
var databaseUser model.User
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Where("username = ? AND ldap_id IS NOT NULL", username).
|
|
First(&databaseUser).
|
|
Error
|
|
if errors.Is(err, gorm.ErrRecordNotFound) {
|
|
// The user collides with a non-LDAP user, so we skip it
|
|
continue
|
|
} else if err != nil {
|
|
return fmt.Errorf("failed to query for existing user '%s': %w", username, err)
|
|
}
|
|
|
|
membersUserId = append(membersUserId, databaseUser.ID)
|
|
}
|
|
|
|
syncGroup := dto.UserGroupCreateDto{
|
|
Name: value.GetAttributeValue(dbConfig.LdapAttributeGroupName.Value),
|
|
FriendlyName: value.GetAttributeValue(dbConfig.LdapAttributeGroupName.Value),
|
|
LdapID: ldapId,
|
|
}
|
|
dto.Normalize(syncGroup)
|
|
|
|
err = syncGroup.Validate()
|
|
if err != nil {
|
|
slog.WarnContext(ctx, "LDAP user group object is not valid", slog.Any("error", err))
|
|
continue
|
|
}
|
|
|
|
if databaseGroup.ID == "" {
|
|
newGroup, err := s.groupService.createInternal(ctx, syncGroup, tx)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create group '%s': %w", syncGroup.Name, err)
|
|
}
|
|
|
|
_, err = s.groupService.updateUsersInternal(ctx, newGroup.ID, membersUserId, tx)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to sync users for group '%s': %w", syncGroup.Name, err)
|
|
}
|
|
} else {
|
|
_, err = s.groupService.updateInternal(ctx, databaseGroup.ID, syncGroup, true, tx)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to update group '%s': %w", syncGroup.Name, err)
|
|
}
|
|
|
|
_, err = s.groupService.updateUsersInternal(ctx, databaseGroup.ID, membersUserId, tx)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to sync users for group '%s': %w", syncGroup.Name, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Get all LDAP groups from the database
|
|
var ldapGroupsInDb []model.UserGroup
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Find(&ldapGroupsInDb, "ldap_id IS NOT NULL").
|
|
Select("ldap_id").
|
|
Error
|
|
if err != nil {
|
|
return fmt.Errorf("failed to fetch groups from database: %w", err)
|
|
}
|
|
|
|
// Delete groups that no longer exist in LDAP
|
|
for _, group := range ldapGroupsInDb {
|
|
if _, exists := ldapGroupIDs[*group.LdapID]; exists {
|
|
continue
|
|
}
|
|
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Delete(&model.UserGroup{}, "ldap_id = ?", group.LdapID).
|
|
Error
|
|
if err != nil {
|
|
return fmt.Errorf("failed to delete group '%s': %w", group.Name, err)
|
|
}
|
|
|
|
slog.Info("Deleted group", slog.String("group", group.Name))
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
//nolint:gocognit
|
|
func (s *LdapService) SyncUsers(ctx context.Context, tx *gorm.DB, client *ldap.Conn) (savePictures []savePicture, deleteFiles []string, err error) {
|
|
dbConfig := s.appConfigService.GetDbConfig()
|
|
|
|
searchAttrs := []string{
|
|
"memberOf",
|
|
"sn",
|
|
"cn",
|
|
dbConfig.LdapAttributeUserUniqueIdentifier.Value,
|
|
dbConfig.LdapAttributeUserUsername.Value,
|
|
dbConfig.LdapAttributeUserEmail.Value,
|
|
dbConfig.LdapAttributeUserFirstName.Value,
|
|
dbConfig.LdapAttributeUserLastName.Value,
|
|
dbConfig.LdapAttributeUserProfilePicture.Value,
|
|
dbConfig.LdapAttributeUserDisplayName.Value,
|
|
}
|
|
|
|
// Filters must start and finish with ()!
|
|
searchReq := ldap.NewSearchRequest(
|
|
dbConfig.LdapBase.Value,
|
|
ldap.ScopeWholeSubtree,
|
|
0, 0, 0, false,
|
|
dbConfig.LdapUserSearchFilter.Value,
|
|
searchAttrs,
|
|
[]ldap.Control{},
|
|
)
|
|
|
|
result, err := client.Search(searchReq)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("failed to query LDAP: %w", err)
|
|
}
|
|
|
|
// Create a mapping for users that exist
|
|
ldapUserIDs := make(map[string]struct{}, len(result.Entries))
|
|
savePictures = make([]savePicture, 0, len(result.Entries))
|
|
|
|
for _, value := range result.Entries {
|
|
ldapId := convertLdapIdToString(value.GetAttributeValue(dbConfig.LdapAttributeUserUniqueIdentifier.Value))
|
|
|
|
// Skip users without a valid LDAP ID
|
|
if ldapId == "" {
|
|
slog.Warn("Skipping LDAP user without a valid unique identifier", slog.String("attribute", dbConfig.LdapAttributeUserUniqueIdentifier.Value))
|
|
continue
|
|
}
|
|
|
|
ldapUserIDs[ldapId] = struct{}{}
|
|
|
|
// Get the user from the database
|
|
var databaseUser model.User
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Where("ldap_id = ?", ldapId).
|
|
First(&databaseUser).
|
|
Error
|
|
|
|
// If a user is found (even if disabled), enable them since they're now back in LDAP
|
|
if databaseUser.ID != "" && databaseUser.Disabled {
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Model(&model.User{}).
|
|
Where("id = ?", databaseUser.ID).
|
|
Update("disabled", false).
|
|
Error
|
|
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("failed to enable user %s: %w", databaseUser.Username, err)
|
|
}
|
|
}
|
|
|
|
if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
|
|
// This could error with ErrRecordNotFound and we want to ignore that here
|
|
return nil, nil, fmt.Errorf("failed to query for LDAP user ID '%s': %w", ldapId, err)
|
|
}
|
|
|
|
// Check if user is admin by checking if they are in the admin group
|
|
isAdmin := false
|
|
for _, group := range value.GetAttributeValues("memberOf") {
|
|
if getDNProperty(dbConfig.LdapAttributeGroupName.Value, group) == dbConfig.LdapAttributeAdminGroup.Value {
|
|
isAdmin = true
|
|
break
|
|
}
|
|
}
|
|
|
|
newUser := dto.UserCreateDto{
|
|
Username: value.GetAttributeValue(dbConfig.LdapAttributeUserUsername.Value),
|
|
Email: utils.PtrOrNil(value.GetAttributeValue(dbConfig.LdapAttributeUserEmail.Value)),
|
|
FirstName: value.GetAttributeValue(dbConfig.LdapAttributeUserFirstName.Value),
|
|
LastName: value.GetAttributeValue(dbConfig.LdapAttributeUserLastName.Value),
|
|
DisplayName: value.GetAttributeValue(dbConfig.LdapAttributeUserDisplayName.Value),
|
|
IsAdmin: isAdmin,
|
|
LdapID: ldapId,
|
|
}
|
|
|
|
if newUser.DisplayName == "" {
|
|
newUser.DisplayName = strings.TrimSpace(newUser.FirstName + " " + newUser.LastName)
|
|
}
|
|
|
|
dto.Normalize(newUser)
|
|
|
|
err = newUser.Validate()
|
|
if err != nil {
|
|
slog.WarnContext(ctx, "LDAP user object is not valid", slog.Any("error", err))
|
|
continue
|
|
}
|
|
|
|
userID := databaseUser.ID
|
|
if databaseUser.ID == "" {
|
|
createdUser, err := s.userService.createUserInternal(ctx, newUser, true, tx)
|
|
if errors.Is(err, &common.AlreadyInUseError{}) {
|
|
slog.Warn("Skipping creating LDAP user", slog.String("username", newUser.Username), slog.Any("error", err))
|
|
continue
|
|
} else if err != nil {
|
|
return nil, nil, fmt.Errorf("error creating user '%s': %w", newUser.Username, err)
|
|
}
|
|
userID = createdUser.ID
|
|
} else {
|
|
_, err = s.userService.updateUserInternal(ctx, databaseUser.ID, newUser, false, true, tx)
|
|
if errors.Is(err, &common.AlreadyInUseError{}) {
|
|
slog.Warn("Skipping updating LDAP user", slog.String("username", newUser.Username), slog.Any("error", err))
|
|
continue
|
|
} else if err != nil {
|
|
return nil, nil, fmt.Errorf("error updating user '%s': %w", newUser.Username, err)
|
|
}
|
|
}
|
|
|
|
// Save profile picture
|
|
pictureString := value.GetAttributeValue(dbConfig.LdapAttributeUserProfilePicture.Value)
|
|
if pictureString != "" {
|
|
// Storage operations must be executed outside of a transaction
|
|
savePictures = append(savePictures, savePicture{
|
|
userID: databaseUser.ID,
|
|
username: userID,
|
|
picture: pictureString,
|
|
})
|
|
}
|
|
}
|
|
|
|
// Get all LDAP users from the database
|
|
var ldapUsersInDb []model.User
|
|
err = tx.
|
|
WithContext(ctx).
|
|
Find(&ldapUsersInDb, "ldap_id IS NOT NULL").
|
|
Select("id, username, ldap_id, disabled").
|
|
Error
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("failed to fetch users from database: %w", err)
|
|
}
|
|
|
|
// Mark users as disabled or delete users that no longer exist in LDAP
|
|
deleteFiles = make([]string, 0, len(ldapUserIDs))
|
|
for _, user := range ldapUsersInDb {
|
|
// Skip if the user ID exists in the fetched LDAP results
|
|
if _, exists := ldapUserIDs[*user.LdapID]; exists {
|
|
continue
|
|
}
|
|
|
|
if dbConfig.LdapSoftDeleteUsers.IsTrue() {
|
|
err = s.userService.disableUserInternal(ctx, tx, user.ID)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("failed to disable user %s: %w", user.Username, err)
|
|
}
|
|
|
|
slog.Info("Disabled user", slog.String("username", user.Username))
|
|
} else {
|
|
err = s.userService.deleteUserInternal(ctx, tx, user.ID, true)
|
|
if err != nil {
|
|
target := &common.LdapUserUpdateError{}
|
|
if errors.As(err, &target) {
|
|
return nil, nil, fmt.Errorf("failed to delete user %s: LDAP user must be disabled before deletion", user.Username)
|
|
}
|
|
return nil, nil, fmt.Errorf("failed to delete user %s: %w", user.Username, err)
|
|
}
|
|
|
|
slog.Info("Deleted user", slog.String("username", user.Username))
|
|
|
|
// Storage operations must be executed outside of a transaction
|
|
deleteFiles = append(deleteFiles, path.Join("profile-pictures", user.ID+".png"))
|
|
}
|
|
}
|
|
|
|
return savePictures, deleteFiles, nil
|
|
}
|
|
|
|
func (s *LdapService) saveProfilePicture(parentCtx context.Context, userId string, pictureString string) error {
|
|
var reader io.ReadSeeker
|
|
|
|
_, err := url.ParseRequestURI(pictureString)
|
|
if err == nil {
|
|
ctx, cancel := context.WithTimeout(parentCtx, 15*time.Second)
|
|
defer cancel()
|
|
|
|
var req *http.Request
|
|
req, err = http.NewRequestWithContext(ctx, http.MethodGet, pictureString, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create request: %w", err)
|
|
}
|
|
|
|
var res *http.Response
|
|
res, err = s.httpClient.Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to download profile picture: %w", err)
|
|
}
|
|
defer res.Body.Close()
|
|
|
|
data, err := io.ReadAll(res.Body)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to read profile picture: %w", err)
|
|
}
|
|
|
|
reader = bytes.NewReader(data)
|
|
} else if decodedPhoto, err := base64.StdEncoding.DecodeString(pictureString); err == nil {
|
|
// If the photo is a base64 encoded string, decode it
|
|
reader = bytes.NewReader(decodedPhoto)
|
|
} else {
|
|
// If the photo is a string, we assume that it's a binary string
|
|
reader = bytes.NewReader([]byte(pictureString))
|
|
}
|
|
|
|
// Update the profile picture
|
|
err = s.userService.UpdateProfilePicture(parentCtx, userId, reader)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to update profile picture: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// getDNProperty returns the value of a property from a LDAP identifier
|
|
// See: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/distinguished-names
|
|
func getDNProperty(property string, str string) string {
|
|
// Example format is "CN=username,ou=people,dc=example,dc=com"
|
|
// First we split at the comma
|
|
property = strings.ToLower(property)
|
|
l := len(property) + 1
|
|
for _, v := range strings.Split(str, ",") {
|
|
v = strings.TrimSpace(v)
|
|
if len(v) > l && strings.ToLower(v)[0:l] == property+"=" {
|
|
return v[l:]
|
|
}
|
|
}
|
|
|
|
// CN not found, return an empty string
|
|
return ""
|
|
}
|
|
|
|
// convertLdapIdToString converts LDAP IDs to valid UTF-8 strings.
|
|
// LDAP servers may return binary UUIDs (16 bytes) or other non-UTF-8 data.
|
|
func convertLdapIdToString(ldapId string) string {
|
|
if utf8.ValidString(ldapId) {
|
|
return norm.NFC.String(ldapId)
|
|
}
|
|
|
|
// Try to parse as binary UUID (16 bytes)
|
|
if len(ldapId) == 16 {
|
|
if parsedUUID, err := uuid.FromBytes([]byte(ldapId)); err == nil {
|
|
return parsedUUID.String()
|
|
}
|
|
}
|
|
|
|
// As a last resort, encode as base64 to make it UTF-8 safe
|
|
return base64.StdEncoding.EncodeToString([]byte(ldapId))
|
|
}
|