matty/peertube-theme-nctv-dark
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'feat/ldap_group' into 'master'

Browse Source 
✨ LDAP Groups to fix #19

Closes #19

See merge request framasoft/peertube/official-plugins!6
This commit is contained in:
Chocobozzz 2020-11-30 14:19:35 +01:00
commit 4786ea462f
1 changed files with 80 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
peertube-plugin-auth-ldap/main.js
View File

@ -78,6 +78,43 @@ async function register ({
default: 'uid'
})
registerSetting({
name: 'group-base',
label: 'Group base',
type: 'input',
private: true,
descriptionHTML: '<p>Fill the following settings to map PeerTube roles to LDAP Groups. LDAP users without any valid LDAP group will be refused login. Leave empty to let LDAP users join with default User role.</p>'
})
registerSetting({
name: 'group-filter',
label: 'Group filter',
type: 'input',
private: true,
default: '(member={{dn}})'
})
registerSetting({
name: 'group-admin',
label: 'Administrator group',
type: 'input',
private: true
})
registerSetting({
name: 'group-mod',
label: 'Moderator group',
type: 'input',
private: true
})
registerSetting({
name: 'group-user',
label: 'User group',
type: 'input',
private: true
})
registerIdAndPassAuth({
authName: 'ldap',
getWeight: () => store.weight,
@ -118,6 +155,11 @@ async function login (peertubeHelpers, settingsManager, options) {
'search-filter',
'mail-property',
'username-property',
'group-base',
'group-filter',
'group-admin',
'group-mod',
'group-user',
])
if (!settings['url']) {
@ -131,6 +173,8 @@ async function login (peertubeHelpers, settingsManager, options) {
bindCredentials: settings['bind-credentials'],
searchBase: settings['search-base'],
searchFilter: settings['search-filter'],
groupSearchBase: settings['group-base'],
groupSearchFilter: settings['group-filter'],
reconnect: true,
tlsOptions: {
rejectUnauthorized: settings['insecure-tls'] !== true
@ -176,10 +220,45 @@ async function login (peertubeHelpers, settingsManager, options) {
let email = user[mailProperty]
if (Array.isArray(email)) email = email[0]
if (!settings['group-base'] || !settings['group-filter']) {
// Return user without fetching role from LDAP groups
return res({
username,
email
})
}
if (!settings['group-admin'] || !settings['group-mod'] || !settings['group-user']) {
logger.info('Do not login user %s because admin did not configure LDAP Groups.', options.id)
return res(null)
}
const groupAdmin = settings['group-admin']
const groupMod = settings['group-mod']
const groupUser = settings['group-user']
const roles = user._groups.map(element => element['dn'])
let role = null
if (roles.includes(groupAdmin)) {
role = 0
} else if (roles.includes(groupMod)) {
role = 1
} else if (roles.includes(groupUser)) {
role = 2
}
if (role === null) {
logger.warn('User %s does not have any allowed LDAP groups.', options.id)
return res(null)
}
return res({
username,
email
email,
role
})
})
})
}