All files / src/sso userdb.ts

11.83% Statements 11/93
0% Branches 0/28
0% Functions 0/4
14.1% Lines 11/78

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 1471x   1x 1x   1x 1x   1x   1x                               1x                         1x                                                                                         1x                                                                                                   1x                        
import { adsi } from '../../lib/api';
import { IDirectorySearch, IADs } from '../../lib/adsi';
import { isOnDomain, isActiveDirectoryReachable } from './domain';
import dbg from 'debug';
import { Database, ADUser, ADUsers } from './interfaces';
import { activeDirectoryMutex } from './mutex';
import { openADConnection, closeADConnection } from './adConnection';
 
const debug = dbg('node-expose-sspi:userdb');
 
export const database: Database = {
  users: [],
};
 
/**
 *
 * This function is recommanded to be called before starting a server.
 *
 * Purpose is to cache all Active Directory (AD) users for
 * performance during authentication, just for increasing performance.
 *
 * Useless if you do not use AD.
 *
 * @export
 * @returns {Promise<void>}
 */
export async function init(): Promise<void> {
  if (!isOnDomain()) {
    return;
  }
  try {
    debug('init');
    // request all accounts from domain
    database.users = await getUsers();
  } catch (e) {
    debug('Cannot get users from AD. e: ', e);
  }
}
 
export async function getUser(ldapFilter: string): Promise<ADUser | undefined> {
  debug('getUser start ');
  if (!isOnDomain()) {
    return;
  }
  const adRelease = await activeDirectoryMutex.acquire();
  if (!isActiveDirectoryReachable()) {
    console.error('Warning: Active Directory not reachable');
    return;
  }
  openADConnection();
  let dirsearch: IDirectorySearch | undefined;
  try {
    const distinguishedName = await getDistinguishedName();
    dirsearch = await adsi.ADsOpenObject<IDirectorySearch>({
      binding: `LDAP://${distinguishedName}`,
      riid: 'IID_IDirectorySearch',
    });
    dirsearch.SetSearchPreference();
    dirsearch.ExecuteSearch({
      filter: `(&(objectClass=user)(objectCategory=person)${ldapFilter})`,
    });
 
    const hr = dirsearch.GetNextRow();
    if (hr === adsi.S_ADS_NOMORE_ROWS) {
      return undefined;
    }
    const row: ADUser = {};
    let colName = dirsearch.GetNextColumnName();
    while (colName !== adsi.S_ADS_NOMORE_COLUMNS) {
      const value = await dirsearch.GetColumn(colName as string);
      row[colName] = value;
      colName = dirsearch.GetNextColumnName();
    }
    return row;
  } finally {
    if (dirsearch) {
      dirsearch.Release();
    }
    closeADConnection();
    adRelease();
    debug('getUser end');
  }
}
 
export async function getUsers(): Promise<ADUsers> {
  debug('getUsers start ');
  if (!isOnDomain()) {
    return [];
  }
  const adRelease = await activeDirectoryMutex.acquire();
  if (!isActiveDirectoryReachable()) {
    console.error('Warning: Active Directory not reachable');
    return [];
  }
  const result: ADUsers = [];
  openADConnection();
  let dirsearch;
  try {
    const distinguishedName = await getDistinguishedName();
    dirsearch = await adsi.ADsOpenObject<IDirectorySearch>({
      binding: `LDAP://${distinguishedName}`,
      riid: 'IID_IDirectorySearch',
    });
    dirsearch.SetSearchPreference();
    dirsearch.ExecuteSearch({
      filter: '(&(objectClass=user)(objectCategory=person)(sn=*))',
    });
 
    while (true) {
      if (dirsearch.GetNextRow() === adsi.S_ADS_NOMORE_ROWS) {
        break;
      }
      const row: ADUser = {};
      let colName = dirsearch.GetNextColumnName();
      while (colName !== adsi.S_ADS_NOMORE_COLUMNS) {
        const value = await dirsearch.GetColumn(colName as string);
        row[colName] = value;
        colName = dirsearch.GetNextColumnName();
      }
      result.push(row);
    }
  } catch (error) {
    console.error('error: ', error);
  } finally {
    if (dirsearch) {
      dirsearch.Release();
    }
    closeADConnection();
    adRelease();
    debug('getUsers end');
  }
  return result;
}
 
export async function getDistinguishedName(): Promise<string> {
  let root: IADs | undefined;
  try {
    root = await adsi.ADsGestObject('LDAP://rootDSE');
    const distinguishedName = await root.Get('defaultNamingContext');
    return distinguishedName;
  } finally {
    if (root) {
      root.Release();
    }
  }
}