Penpot/penpot
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2025-03-12 07:41:43 -05:00
Code Issues Activity

🐛 System start and stop without LDAP connection

Browse source
This commit is contained in:
Vitaly Kornilov 2020-07-25 00:13:04 +03:00 • committed by Andrey Antukh
parent 272c27061d
commit f2c4ff7518
1 changed files with 45 additions and 39 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

84
backend/src/uxbox/http/auth/ldap.clj
View file

@ -6,52 +6,58 @@
[uxbox.common.exceptions :as ex]
[uxbox.config :as cfg]
[uxbox.services.mutations :as sm]
[uxbox.http.session :as session]))
[uxbox.http.session :as session]
[clojure.tools.logging :as log]))
(defn replace-several [s & {:as replacements}]
(reduce-kv clojure.string/replace s replacements))
(defstate ldap-pool
:start (client/connect (merge
{:host {:address (:ldap-auth-host cfg/config)
:port (:ldap-auth-port cfg/config)}}
(-> cfg/config
(select-keys [:ldap-auth-ssl
:ldap-auth-starttls
:ldap-bind-dn
:ldap-bind-password])
(set/rename-keys {:ldap-auth-ssl :ssl?
:ldap-auth-starttls :startTLS?
:ldap-bind-dn :bind-dn
:ldap-bind-password :password}))))
:stop (client/close ldap-pool))
(defstate *ldap-pool
:start (delay
(try
(client/connect (merge {:host {:address (:ldap-auth-host cfg/config)
:port (:ldap-auth-port cfg/config)}}
(-> cfg/config
(select-keys [:ldap-auth-ssl
:ldap-auth-starttls
:ldap-bind-dn
:ldap-bind-password])
(set/rename-keys {:ldap-auth-ssl :ssl?
:ldap-auth-starttls :startTLS?
:ldap-bind-dn :bind-dn
:ldap-bind-password :password}))))
(catch Exception e
(log/errorf e "Cannot connect to LDAP %s:%s"
(:ldap-auth-host cfg/config) (:ldap-auth-port cfg/config)))))
:stop (when (realized? *ldap-pool)
(some-> *ldap-pool deref (client/close))))
(defn- auth-with-ldap [username password]
(let [conn (client/get-connection ldap-pool)
user-search-query (replace-several (:ldap-auth-user-query cfg/config)
"$username" username)
user-attributes (-> cfg/config
(select-keys [:ldap-auth-username-attribute
:ldap-auth-email-attribute
:ldap-auth-fullname-attribute
:ldap-auth-avatar-attribute])
vals)]
(try
(when-some [user-entry (-> conn
(client/search
(:ldap-auth-base-dn cfg/config)
{:filter user-search-query
:sizelimit 1
:attributes user-attributes})
first)]
(when-not (client/bind? conn (:dn user-entry) password)
(ex/raise :type :authentication
:code ::wrong-credentials))
(set/rename-keys user-entry {(keyword (:ldap-auth-avatar-attribute cfg/config)) :photo
(keyword (:ldap-auth-fullname-attribute cfg/config)) :fullname
(keyword (:ldap-auth-email-attribute cfg/config)) :email}))
(finally (client/release-connection ldap-pool conn)))))
(when-let [conn (some-> *ldap-pool deref (client/get-connection))]
(let [user-search-query (replace-several (:ldap-auth-user-query cfg/config)
"$username" username)
user-attributes (-> cfg/config
(select-keys [:ldap-auth-username-attribute
:ldap-auth-email-attribute
:ldap-auth-fullname-attribute
:ldap-auth-avatar-attribute])
vals)]
(try
(when-some [user-entry (-> conn
(client/search
(:ldap-auth-base-dn cfg/config)
{:filter user-search-query
:sizelimit 1
:attributes user-attributes})
first)]
(when-not (client/bind? conn (:dn user-entry) password)
(ex/raise :type :authentication
:code ::wrong-credentials))
(set/rename-keys user-entry {(keyword (:ldap-auth-avatar-attribute cfg/config)) :photo
(keyword (:ldap-auth-fullname-attribute cfg/config)) :fullname
(keyword (:ldap-auth-email-attribute cfg/config)) :email}))
(finally (client/release-connection @*ldap-pool conn))))))
(defn auth [req]
(let [data (:body-params req)