summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/config/default.js15
-rw-r--r--lib/config/environment.js21
-rw-r--r--lib/config/index.js1
-rw-r--r--lib/config/utils.js7
-rw-r--r--lib/migrations/20171009121200-longtext-for-mysql.js16
-rw-r--r--lib/models/note.js2
-rw-r--r--lib/models/revision.js6
-rw-r--r--lib/models/user.js9
-rw-r--r--lib/realtime.js6
-rw-r--r--[-rwxr-xr-x]lib/response.js2
-rw-r--r--lib/web/auth/index.js1
-rw-r--r--lib/web/auth/ldap/index.js8
-rw-r--r--lib/web/auth/saml/index.js95
13 files changed, 178 insertions, 11 deletions
diff --git a/lib/config/default.js b/lib/config/default.js
index 273bad02..8d36db02 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -96,8 +96,23 @@ module.exports = {
searchBase: undefined,
searchFilter: undefined,
searchAttributes: undefined,
+ usernameField: undefined,
tlsca: undefined
},
+ saml: {
+ idpSsoUrl: undefined,
+ idpCert: undefined,
+ issuer: undefined,
+ identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+ groupAttribute: undefined,
+ externalGroups: [],
+ requiredGroups: [],
+ attribute: {
+ id: undefined,
+ username: undefined,
+ email: undefined
+ }
+ },
email: true,
allowemailregister: true,
allowpdfexport: true
diff --git a/lib/config/environment.js b/lib/config/environment.js
index 0c272f05..27e63591 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -1,6 +1,6 @@
'use strict'
-const {toBooleanConfig} = require('./utils')
+const {toBooleanConfig, toArrayConfig} = require('./utils')
module.exports = {
domain: process.env.HMD_DOMAIN,
@@ -15,7 +15,7 @@ module.exports = {
preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD)
},
protocolusessl: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL),
- alloworigin: process.env.HMD_ALLOW_ORIGIN ? process.env.HMD_ALLOW_ORIGIN.split(',') : undefined,
+ alloworigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN),
usecdn: toBooleanConfig(process.env.HMD_USECDN),
allowanonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS),
allowfreeurl: toBooleanConfig(process.env.HMD_ALLOW_FREEURL),
@@ -70,9 +70,24 @@ module.exports = {
tokenSecret: process.env.HMD_LDAP_TOKENSECRET,
searchBase: process.env.HMD_LDAP_SEARCHBASE,
searchFilter: process.env.HMD_LDAP_SEARCHFILTER,
- searchAttributes: process.env.HMD_LDAP_SEARCHATTRIBUTES,
+ searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES),
+ usernameField: process.env.HMD_LDAP_USERNAMEFIELD,
tlsca: process.env.HMD_LDAP_TLS_CA
},
+ saml: {
+ idpSsoUrl: process.env.HMD_SAML_IDPSSOURL,
+ idpCert: process.env.HMD_SAML_IDPCERT,
+ issuer: process.env.HMD_SAML_ISSUER,
+ identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT,
+ groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE,
+ externalGroups: toArrayConfig(process.env.HMD_SAML_EXTERNALGROUPS, '|', []),
+ requiredGroups: toArrayConfig(process.env.HMD_SAML_REQUIREDGROUPS, '|', []),
+ attribute: {
+ id: process.env.HMD_SAML_ATTRIBUTE_ID,
+ username: process.env.HMD_SAML_ATTRIBUTE_USERNAME,
+ email: process.env.HMD_SAML_ATTRIBUTE_EMAIL
+ }
+ },
email: toBooleanConfig(process.env.HMD_EMAIL),
allowemailregister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER),
allowpdfexport: toBooleanConfig(process.env.HMD_ALLOW_PDF_EXPORT)
diff --git a/lib/config/index.js b/lib/config/index.js
index cf6f2ada..a14f3197 100644
--- a/lib/config/index.js
+++ b/lib/config/index.js
@@ -92,6 +92,7 @@ config.isGitHubEnable = config.github.clientID && config.github.clientSecret
config.isGitLabEnable = config.gitlab.clientID && config.gitlab.clientSecret
config.isMattermostEnable = config.mattermost.clientID && config.mattermost.clientSecret
config.isLDAPEnable = config.ldap.url
+config.isSAMLEnable = config.saml.idpSsoUrl
config.isPDFExportEnable = config.allowpdfexport
// generate correct path
diff --git a/lib/config/utils.js b/lib/config/utils.js
index 11bbd8cb..9ff2f96d 100644
--- a/lib/config/utils.js
+++ b/lib/config/utils.js
@@ -6,3 +6,10 @@ exports.toBooleanConfig = function toBooleanConfig (configValue) {
}
return configValue
}
+
+exports.toArrayConfig = function toArrayConfig (configValue, separator = ',', fallback) {
+ if (configValue && typeof configValue === 'string') {
+ return (configValue.split(separator).map(arrayItem => arrayItem.trim()))
+ }
+ return fallback
+}
diff --git a/lib/migrations/20171009121200-longtext-for-mysql.js b/lib/migrations/20171009121200-longtext-for-mysql.js
new file mode 100644
index 00000000..61b409ca
--- /dev/null
+++ b/lib/migrations/20171009121200-longtext-for-mysql.js
@@ -0,0 +1,16 @@
+'use strict'
+module.exports = {
+ up: function (queryInterface, Sequelize) {
+ queryInterface.changeColumn('Notes', 'content', {type: Sequelize.TEXT('long')})
+ queryInterface.changeColumn('Revisions', 'patch', {type: Sequelize.TEXT('long')})
+ queryInterface.changeColumn('Revisions', 'content', {type: Sequelize.TEXT('long')})
+ queryInterface.changeColumn('Revisions', 'latContent', {type: Sequelize.TEXT('long')})
+ },
+
+ down: function (queryInterface, Sequelize) {
+ queryInterface.changeColumn('Notes', 'content', {type: Sequelize.TEXT})
+ queryInterface.changeColumn('Revisions', 'patch', {type: Sequelize.TEXT})
+ queryInterface.changeColumn('Revisions', 'content', {type: Sequelize.TEXT})
+ queryInterface.changeColumn('Revisions', 'latContent', {type: Sequelize.TEXT})
+ }
+}
diff --git a/lib/models/note.js b/lib/models/note.js
index c0ef1374..33dde80d 100644
--- a/lib/models/note.js
+++ b/lib/models/note.js
@@ -60,7 +60,7 @@ module.exports = function (sequelize, DataTypes) {
}
},
content: {
- type: DataTypes.TEXT,
+ type: DataTypes.TEXT('long'),
get: function () {
return sequelize.processData(this.getDataValue('content'), '')
},
diff --git a/lib/models/revision.js b/lib/models/revision.js
index 225a95d4..32c57d03 100644
--- a/lib/models/revision.js
+++ b/lib/models/revision.js
@@ -58,7 +58,7 @@ module.exports = function (sequelize, DataTypes) {
defaultValue: Sequelize.UUIDV4
},
patch: {
- type: DataTypes.TEXT,
+ type: DataTypes.TEXT('long'),
get: function () {
return sequelize.processData(this.getDataValue('patch'), '')
},
@@ -67,7 +67,7 @@ module.exports = function (sequelize, DataTypes) {
}
},
lastContent: {
- type: DataTypes.TEXT,
+ type: DataTypes.TEXT('long'),
get: function () {
return sequelize.processData(this.getDataValue('lastContent'), '')
},
@@ -76,7 +76,7 @@ module.exports = function (sequelize, DataTypes) {
}
},
content: {
- type: DataTypes.TEXT,
+ type: DataTypes.TEXT('long'),
get: function () {
return sequelize.processData(this.getDataValue('content'), '')
},
diff --git a/lib/models/user.js b/lib/models/user.js
index 27566def..f421fe43 100644
--- a/lib/models/user.js
+++ b/lib/models/user.js
@@ -143,6 +143,15 @@ module.exports = function (sequelize, DataTypes) {
photo = letterAvatars(profile.username)
}
break
+ case 'saml':
+ if (profile.emails[0]) {
+ photo = 'https://www.gravatar.com/avatar/' + md5(profile.emails[0])
+ if (bigger) photo += '?s=400'
+ else photo += '?s=96'
+ } else {
+ photo = letterAvatars(profile.username)
+ }
+ break
}
return photo
},
diff --git a/lib/realtime.js b/lib/realtime.js
index 361bbf09..e03e2d0b 100644
--- a/lib/realtime.js
+++ b/lib/realtime.js
@@ -709,7 +709,7 @@ function connection (socket) {
return failConnection(404, 'note id not found', socket)
}
- if (isDuplicatedInSocketQueue(socket, connectionSocketQueue)) return
+ if (isDuplicatedInSocketQueue(connectionSocketQueue, socket)) return
// store noteId in this socket session
socket.noteId = noteId
@@ -723,8 +723,8 @@ function connection (socket) {
var maxrandomcount = 10
var found = false
do {
- Object.keys(notes[noteId].users).forEach(function (user) {
- if (user.color === color) {
+ Object.keys(notes[noteId].users).forEach(function (userId) {
+ if (notes[noteId].users[userId].color === color) {
found = true
}
})
diff --git a/lib/response.js b/lib/response.js
index 61ce5747..9f3d5a44 100755..100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -68,6 +68,7 @@ function showIndex (req, res, next) {
dropbox: config.isDropboxEnable,
google: config.isGoogleEnable,
ldap: config.isLDAPEnable,
+ saml: config.isSAMLEnable,
email: config.isEmailEnable,
allowemailregister: config.allowemailregister,
allowpdfexport: config.allowpdfexport,
@@ -100,6 +101,7 @@ function responseHackMD (res, note) {
dropbox: config.isDropboxEnable,
google: config.isGoogleEnable,
ldap: config.isLDAPEnable,
+ saml: config.isSAMLEnable,
email: config.isEmailEnable,
allowemailregister: config.allowemailregister,
allowpdfexport: config.allowpdfexport
diff --git a/lib/web/auth/index.js b/lib/web/auth/index.js
index 4b618101..db5ff11d 100644
--- a/lib/web/auth/index.js
+++ b/lib/web/auth/index.js
@@ -37,6 +37,7 @@ if (config.isMattermostEnable) authRouter.use(require('./mattermost'))
if (config.isDropboxEnable) authRouter.use(require('./dropbox'))
if (config.isGoogleEnable) authRouter.use(require('./google'))
if (config.isLDAPEnable) authRouter.use(require('./ldap'))
+if (config.isSAMLEnable) authRouter.use(require('./saml'))
if (config.isEmailEnable) authRouter.use(require('./email'))
// logout
diff --git a/lib/web/auth/ldap/index.js b/lib/web/auth/ldap/index.js
index 9a63578a..cc0d29ad 100644
--- a/lib/web/auth/ldap/index.js
+++ b/lib/web/auth/ldap/index.js
@@ -24,9 +24,15 @@ passport.use(new LDAPStrategy({
}
}, function (user, done) {
var uuid = user.uidNumber || user.uid || user.sAMAccountName
+ var username = uuid
+
+ if (config.ldap.usernameField && user[config.ldap.usernameField]) {
+ username = user[config.ldap.usernameField]
+ }
+
var profile = {
id: 'LDAP-' + uuid,
- username: uuid,
+ username: username,
displayName: user.displayName,
emails: user.mail ? [user.mail] : [],
avatarUrl: null,
diff --git a/lib/web/auth/saml/index.js b/lib/web/auth/saml/index.js
new file mode 100644
index 00000000..386293ae
--- /dev/null
+++ b/lib/web/auth/saml/index.js
@@ -0,0 +1,95 @@
+'use strict'
+
+const Router = require('express').Router
+const passport = require('passport')
+const SamlStrategy = require('passport-saml').Strategy
+const config = require('../../../config')
+const models = require('../../../models')
+const logger = require('../../../logger')
+const {urlencodedParser} = require('../../utils')
+const fs = require('fs')
+const intersection = function (array1, array2) { return array1.filter((n) => array2.includes(n)) }
+
+let samlAuth = module.exports = Router()
+
+passport.use(new SamlStrategy({
+ callbackUrl: config.serverurl + '/auth/saml/callback',
+ entryPoint: config.saml.idpSsoUrl,
+ issuer: config.saml.issuer || config.serverurl,
+ cert: fs.readFileSync(config.saml.idpCert, 'utf-8'),
+ identifierFormat: config.saml.identifierFormat
+}, function (user, done) {
+ // check authorization if needed
+ if (config.saml.externalGroups && config.saml.grouptAttribute) {
+ var externalGroups = intersection(config.saml.externalGroups, user[config.saml.groupAttribute])
+ if (externalGroups.length > 0) {
+ logger.error('saml permission denied: ' + externalGroups.join(', '))
+ return done('Permission denied', null)
+ }
+ }
+ if (config.saml.requiredGroups && config.saml.grouptAttribute) {
+ if (intersection(config.saml.requiredGroups, user[config.saml.groupAttribute]).length === 0) {
+ logger.error('saml permission denied')
+ return done('Permission denied', null)
+ }
+ }
+ // user creation
+ var uuid = user[config.saml.attribute.id] || user.nameID
+ var profile = {
+ provider: 'saml',
+ id: 'SAML-' + uuid,
+ username: user[config.saml.attribute.username] || user.nameID,
+ emails: user[config.saml.attribute.email] ? [user[config.saml.attribute.email]] : []
+ }
+ if (profile.emails.length === 0 && config.saml.identifierFormat === 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress') {
+ profile.emails.push(user.nameID)
+ }
+ var stringifiedProfile = JSON.stringify(profile)
+ models.User.findOrCreate({
+ where: {
+ profileid: profile.id.toString()
+ },
+ defaults: {
+ profile: stringifiedProfile
+ }
+ }).spread(function (user, created) {
+ if (user) {
+ var needSave = false
+ if (user.profile !== stringifiedProfile) {
+ user.profile = stringifiedProfile
+ needSave = true
+ }
+ if (needSave) {
+ user.save().then(function () {
+ if (config.debug) { logger.debug('user login: ' + user.id) }
+ return done(null, user)
+ })
+ } else {
+ if (config.debug) { logger.debug('user login: ' + user.id) }
+ return done(null, user)
+ }
+ }
+ }).catch(function (err) {
+ logger.error('saml auth failed: ' + err)
+ return done(err, null)
+ })
+}))
+
+samlAuth.get('/auth/saml',
+ passport.authenticate('saml', {
+ successReturnToOrRedirect: config.serverurl + '/',
+ failureRedirect: config.serverurl + '/'
+ })
+)
+
+samlAuth.post('/auth/saml/callback', urlencodedParser,
+ passport.authenticate('saml', {
+ successReturnToOrRedirect: config.serverurl + '/',
+ failureRedirect: config.serverurl + '/'
+ })
+)
+
+samlAuth.get('/auth/saml/metadata', function (req, res) {
+ res.type('application/xml')
+ res.send(passport._strategy('saml').generateServiceProviderMetadata())
+})
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-27 20:05:17 +0000