This commit is contained in:
James Cole 2021-10-30 06:50:04 +02:00
parent 6f8778d87f
commit 280975b81a
No known key found for this signature in database
GPG Key ID: BDE6667570EADBD5
7 changed files with 142 additions and 112 deletions

View File

@ -199,10 +199,9 @@ LDAP_PASSWORD=super_secret
LDAP_AUTH_FIELD=uid
#
# If you wish to only authenticate users from a specific group, use the
# group filter. Leave empty or remove if not in use.
# If you wish to only authenticate users from a specific group, use the base DN above.
#
# Example: cn=Administrators,dc=local,dc=com
# If you require extra/special filters please use the LDAP_GROUP_FILTER with a valid DN.
#
# The group filter will only be applied after the user is authenticated.
#

View File

@ -4,7 +4,7 @@ declare(strict_types=1);
namespace FireflyIII\Ldap\Rules;
use LdapRecord\Laravel\Auth\Rule;
use LdapRecord\Models\ActiveDirectory\Group;
use LdapRecord\Models\Attributes\DistinguishedName;
use LdapRecord\Query\ObjectNotFoundException;
use Log;
@ -23,12 +23,58 @@ class UserDefinedRule extends Rule
{
$groupFilter = config('ldap.group_filter');
Log::debug(sprintf('UserDefinedRule with group filter "%s"', $groupFilter));
if (null !== $groupFilter && '' !== (string)$groupFilter) {
Log::debug('Group filter is not empty, will now apply it.');
return $this->user->groups()->recursive()->exists(Group::findOrFail($groupFilter));
}
Log::debug('Group filter is empty or NULL, so will return true.');
return true;
if (empty($groupFilter)) {
Log::debug('Group filter is empty, return true.');
return true;
}
Log::debug('Group filter is not empty, continue.');
// group class:
// use ;
$openLDAP = class_exists(\LdapRecord\Models\OpenLDAP\Group::class) ? \LdapRecord\Models\OpenLDAP\Group::class : '';
$activeDirectory = class_exists(\LdapRecord\Models\ActiveDirectory\Group::class) ? \LdapRecord\Models\ActiveDirectory\Group::class : '';
$groupClass = env('LDAP_DIALECT') === 'OpenLDAP' ? $openLDAP : $activeDirectory;
Log::debug(sprintf('Will use group class "%s"', $groupClass));
// We've been given an invalid group filter. We will assume the
// developer is using some group ANR attribute, and attempt
// to check the user's membership with the resulting group.
if (!DistinguishedName::isValid($groupFilter)) {
Log::debug('UserDefinedRule: Is not valid DN');
return $this->user->groups()->recursive()->exists($groupClass::findByAnrOrFail($groupFilter));
}
$head = strtolower(DistinguishedName::make($groupFilter)->head());
Log::debug(sprintf('UserDefinedRule: Head is "%s"', $head));
// If the head of the DN we've been given is an OU, we will assume
// the developer is looking to filter users based on hierarchy.
// Otherwise, we'll attempt locating a group by the given
// group filter and checking the users group membership.
if ('ou' === $head) {
Log::debug('UserDefinedRule: Will return if user is a descendant of.');
return $this->user->isDescendantOf($groupFilter);
}
Log::debug('UserDefinedRule: Will return if user exists in group.');
return $this->user->groups()->recursive()->exists($groupClass::findOrFail($groupFilter));
//
//
// // old
// $groupFilter = config('ldap.group_filter');
//
// if (null !== $groupFilter && '' !== (string)$groupFilter) {
//
//
// return $this->user->groups()->recursive()->exists(Group::findOrFail($groupFilter));
// }
// Log::debug('Group filter is empty or NULL, so will return true.');
//
// return true;
}
}

View File

@ -23,21 +23,12 @@ class UserDefinedScope implements Scope
*/
public function apply(Builder $query, Model $model)
{
Log::debug('UserDefinedScope is disabled.');
// scope is disabled:
/*
$groupFilter = config('ldap.group_filter');
Log::debug(sprintf('UserDefinedScope with group filter "%s"', $groupFilter));
if (null !== $groupFilter && '' !== (string)$groupFilter) {
Log::debug('UserDefinedScope: Group filter is not empty, will now apply it.');
$query->in($groupFilter);
}
Log::debug('UserDefinedScope: done!');
*/
// $groupFilter = config('ldap.group_filter');
// Log::debug(sprintf('UserDefinedScope with group filter "%s"', $groupFilter));
// if (null !== $groupFilter && '' !== (string)$groupFilter) {
// Log::debug('UserDefinedScope: Group filter is not empty, will now apply it.');
// $query->in($groupFilter);
// }
// Log::debug('UserDefinedScope: done!');
}
}

View File

@ -22,7 +22,6 @@ declare(strict_types=1);
namespace FireflyIII\Providers;
use FireflyIII\Ldap\Scopes\UserDefinedScope;
use FireflyIII\Support\Authentication\RemoteUserGuard;
use FireflyIII\Support\Authentication\RemoteUserProvider;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
@ -67,12 +66,5 @@ class AuthServiceProvider extends ServiceProvider
$this->registerPolicies();
Passport::routes();
Passport::tokensExpireIn(now()->addDays(14));
if (class_exists(\LdapRecord\Models\OpenLDAP\User::class)) {
\LdapRecord\Models\OpenLDAP\User::addGlobalScope(
new UserDefinedScope
);
}
}
}

View File

@ -103,10 +103,10 @@
"league/fractal": "0.*",
"pragmarx/google2fa": "^8.0",
"predis/predis": "^1.1",
"psr/log": "<2",
"ramsey/uuid": "^4.2",
"rcrowe/twigbridge": "^0.12.1",
"spatie/data-transfer-object": "^3.1",
"psr/log": "<2"
"spatie/data-transfer-object": "^3.1"
},
"require-dev": {
"barryvdh/laravel-debugbar": "^3.6",

152
composer.lock generated
View File

@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
"content-hash": "f10c2112760045ef3d05c52e3c824443",
"content-hash": "05ffbcec9e375bc412472e5c5e36ccf8",
"packages": [
{
"name": "bacon/bacon-qr-code",
@ -1844,16 +1844,16 @@
},
{
"name": "laravel/framework",
"version": "v8.67.0",
"version": "v8.68.1",
"source": {
"type": "git",
"url": "https://github.com/laravel/framework.git",
"reference": "fc52acafd069aedc079bf8f17d1a4af4ef489b1e"
"reference": "abe985ff1fb82dd04aab03bc1dc56e83fe61a59f"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/laravel/framework/zipball/fc52acafd069aedc079bf8f17d1a4af4ef489b1e",
"reference": "fc52acafd069aedc079bf8f17d1a4af4ef489b1e",
"url": "https://api.github.com/repos/laravel/framework/zipball/abe985ff1fb82dd04aab03bc1dc56e83fe61a59f",
"reference": "abe985ff1fb82dd04aab03bc1dc56e83fe61a59f",
"shasum": ""
},
"require": {
@ -1945,6 +1945,7 @@
"aws/aws-sdk-php": "Required to use the SQS queue driver, DynamoDb failed job storage and SES mail driver (^3.198.1).",
"brianium/paratest": "Required to run tests in parallel (^6.0).",
"doctrine/dbal": "Required to rename columns and drop SQLite columns (^2.13.3|^3.1.2).",
"ext-bcmath": "Required to use the multiple_of validation rule.",
"ext-ftp": "Required to use the Flysystem FTP driver.",
"ext-gd": "Required to use Illuminate\\Http\\Testing\\FileFactory::image().",
"ext-memcached": "Required to use the memcache cache driver.",
@ -2011,7 +2012,7 @@
"issues": "https://github.com/laravel/framework/issues",
"source": "https://github.com/laravel/framework"
},
"time": "2021-10-22T13:27:12+00:00"
"time": "2021-10-27T12:31:46+00:00"
},
{
"name": "laravel/passport",
@ -3774,16 +3775,16 @@
},
{
"name": "phpseclib/phpseclib",
"version": "3.0.10",
"version": "3.0.11",
"source": {
"type": "git",
"url": "https://github.com/phpseclib/phpseclib.git",
"reference": "62fcc5a94ac83b1506f52d7558d828617fac9187"
"reference": "6e794226a35159eb06f355efe59a0075a16551dd"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/62fcc5a94ac83b1506f52d7558d828617fac9187",
"reference": "62fcc5a94ac83b1506f52d7558d828617fac9187",
"url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/6e794226a35159eb06f355efe59a0075a16551dd",
"reference": "6e794226a35159eb06f355efe59a0075a16551dd",
"shasum": ""
},
"require": {
@ -3865,7 +3866,7 @@
],
"support": {
"issues": "https://github.com/phpseclib/phpseclib/issues",
"source": "https://github.com/phpseclib/phpseclib/tree/3.0.10"
"source": "https://github.com/phpseclib/phpseclib/tree/3.0.11"
},
"funding": [
{
@ -3881,7 +3882,7 @@
"type": "tidelift"
}
],
"time": "2021-08-16T04:24:45+00:00"
"time": "2021-10-27T03:01:46+00:00"
},
{
"name": "pragmarx/google2fa",
@ -4930,16 +4931,16 @@
},
{
"name": "symfony/console",
"version": "v5.3.7",
"version": "v5.3.10",
"source": {
"type": "git",
"url": "https://github.com/symfony/console.git",
"reference": "8b1008344647462ae6ec57559da166c2bfa5e16a"
"reference": "d4e409d9fbcfbf71af0e5a940abb7b0b4bad0bd3"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/symfony/console/zipball/8b1008344647462ae6ec57559da166c2bfa5e16a",
"reference": "8b1008344647462ae6ec57559da166c2bfa5e16a",
"url": "https://api.github.com/repos/symfony/console/zipball/d4e409d9fbcfbf71af0e5a940abb7b0b4bad0bd3",
"reference": "d4e409d9fbcfbf71af0e5a940abb7b0b4bad0bd3",
"shasum": ""
},
"require": {
@ -5009,7 +5010,7 @@
"terminal"
],
"support": {
"source": "https://github.com/symfony/console/tree/v5.3.7"
"source": "https://github.com/symfony/console/tree/v5.3.10"
},
"funding": [
{
@ -5025,7 +5026,7 @@
"type": "tidelift"
}
],
"time": "2021-08-25T20:02:16+00:00"
"time": "2021-10-26T09:30:15+00:00"
},
{
"name": "symfony/css-selector",
@ -5534,16 +5535,16 @@
},
{
"name": "symfony/http-foundation",
"version": "v5.3.7",
"version": "v5.3.10",
"source": {
"type": "git",
"url": "https://github.com/symfony/http-foundation.git",
"reference": "e36c8e5502b4f3f0190c675f1c1f1248a64f04e5"
"reference": "9f34f02e8a5fdc7a56bafe011cea1ce97300e54c"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/symfony/http-foundation/zipball/e36c8e5502b4f3f0190c675f1c1f1248a64f04e5",
"reference": "e36c8e5502b4f3f0190c675f1c1f1248a64f04e5",
"url": "https://api.github.com/repos/symfony/http-foundation/zipball/9f34f02e8a5fdc7a56bafe011cea1ce97300e54c",
"reference": "9f34f02e8a5fdc7a56bafe011cea1ce97300e54c",
"shasum": ""
},
"require": {
@ -5587,7 +5588,7 @@
"description": "Defines an object-oriented layer for the HTTP specification",
"homepage": "https://symfony.com",
"support": {
"source": "https://github.com/symfony/http-foundation/tree/v5.3.7"
"source": "https://github.com/symfony/http-foundation/tree/v5.3.10"
},
"funding": [
{
@ -5603,20 +5604,20 @@
"type": "tidelift"
}
],
"time": "2021-08-27T11:20:35+00:00"
"time": "2021-10-11T15:41:55+00:00"
},
{
"name": "symfony/http-kernel",
"version": "v5.3.9",
"version": "v5.3.10",
"source": {
"type": "git",
"url": "https://github.com/symfony/http-kernel.git",
"reference": "ceaf46a992f60e90645e7279825a830f733a17c5"
"reference": "703e4079920468e9522b72cf47fd76ce8d795e86"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/symfony/http-kernel/zipball/ceaf46a992f60e90645e7279825a830f733a17c5",
"reference": "ceaf46a992f60e90645e7279825a830f733a17c5",
"url": "https://api.github.com/repos/symfony/http-kernel/zipball/703e4079920468e9522b72cf47fd76ce8d795e86",
"reference": "703e4079920468e9522b72cf47fd76ce8d795e86",
"shasum": ""
},
"require": {
@ -5699,7 +5700,7 @@
"description": "Provides a structured process for converting a Request into a Response",
"homepage": "https://symfony.com",
"support": {
"source": "https://github.com/symfony/http-kernel/tree/v5.3.9"
"source": "https://github.com/symfony/http-kernel/tree/v5.3.10"
},
"funding": [
{
@ -5715,7 +5716,7 @@
"type": "tidelift"
}
],
"time": "2021-09-28T10:25:11+00:00"
"time": "2021-10-29T08:36:48+00:00"
},
{
"name": "symfony/mime",
@ -6929,16 +6930,16 @@
},
{
"name": "symfony/string",
"version": "v5.3.7",
"version": "v5.3.10",
"source": {
"type": "git",
"url": "https://github.com/symfony/string.git",
"reference": "8d224396e28d30f81969f083a58763b8b9ceb0a5"
"reference": "d70c35bb20bbca71fc4ab7921e3c6bda1a82a60c"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/symfony/string/zipball/8d224396e28d30f81969f083a58763b8b9ceb0a5",
"reference": "8d224396e28d30f81969f083a58763b8b9ceb0a5",
"url": "https://api.github.com/repos/symfony/string/zipball/d70c35bb20bbca71fc4ab7921e3c6bda1a82a60c",
"reference": "d70c35bb20bbca71fc4ab7921e3c6bda1a82a60c",
"shasum": ""
},
"require": {
@ -6992,7 +6993,7 @@
"utf8"
],
"support": {
"source": "https://github.com/symfony/string/tree/v5.3.7"
"source": "https://github.com/symfony/string/tree/v5.3.10"
},
"funding": [
{
@ -7008,20 +7009,20 @@
"type": "tidelift"
}
],
"time": "2021-08-26T08:00:08+00:00"
"time": "2021-10-27T18:21:46+00:00"
},
{
"name": "symfony/translation",
"version": "v5.3.9",
"version": "v5.3.10",
"source": {
"type": "git",
"url": "https://github.com/symfony/translation.git",
"reference": "6e69f3551c1a3356cf6ea8d019bf039a0f8b6886"
"reference": "6ef197aea2ac8b9cd63e0da7522b3771714035aa"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/symfony/translation/zipball/6e69f3551c1a3356cf6ea8d019bf039a0f8b6886",
"reference": "6e69f3551c1a3356cf6ea8d019bf039a0f8b6886",
"url": "https://api.github.com/repos/symfony/translation/zipball/6ef197aea2ac8b9cd63e0da7522b3771714035aa",
"reference": "6ef197aea2ac8b9cd63e0da7522b3771714035aa",
"shasum": ""
},
"require": {
@ -7087,7 +7088,7 @@
"description": "Provides tools to internationalize your application",
"homepage": "https://symfony.com",
"support": {
"source": "https://github.com/symfony/translation/tree/v5.3.9"
"source": "https://github.com/symfony/translation/tree/v5.3.10"
},
"funding": [
{
@ -7103,7 +7104,7 @@
"type": "tidelift"
}
],
"time": "2021-08-26T08:22:53+00:00"
"time": "2021-10-10T06:43:24+00:00"
},
{
"name": "symfony/translation-contracts",
@ -7185,16 +7186,16 @@
},
{
"name": "symfony/var-dumper",
"version": "v5.3.8",
"version": "v5.3.10",
"source": {
"type": "git",
"url": "https://github.com/symfony/var-dumper.git",
"reference": "eaaea4098be1c90c8285543e1356a09c8aa5c8da"
"reference": "875432adb5f5570fff21036fd22aee244636b7d1"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/symfony/var-dumper/zipball/eaaea4098be1c90c8285543e1356a09c8aa5c8da",
"reference": "eaaea4098be1c90c8285543e1356a09c8aa5c8da",
"url": "https://api.github.com/repos/symfony/var-dumper/zipball/875432adb5f5570fff21036fd22aee244636b7d1",
"reference": "875432adb5f5570fff21036fd22aee244636b7d1",
"shasum": ""
},
"require": {
@ -7253,7 +7254,7 @@
"dump"
],
"support": {
"source": "https://github.com/symfony/var-dumper/tree/v5.3.8"
"source": "https://github.com/symfony/var-dumper/tree/v5.3.10"
},
"funding": [
{
@ -7269,7 +7270,7 @@
"type": "tidelift"
}
],
"time": "2021-09-24T15:59:58+00:00"
"time": "2021-10-26T09:30:15+00:00"
},
{
"name": "tijsverkoyen/css-to-inline-styles",
@ -7844,16 +7845,16 @@
},
{
"name": "composer/ca-bundle",
"version": "1.2.11",
"version": "1.3.1",
"source": {
"type": "git",
"url": "https://github.com/composer/ca-bundle.git",
"reference": "0b072d51c5a9c6f3412f7ea3ab043d6603cb2582"
"reference": "4c679186f2aca4ab6a0f1b0b9cf9252decb44d0b"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/composer/ca-bundle/zipball/0b072d51c5a9c6f3412f7ea3ab043d6603cb2582",
"reference": "0b072d51c5a9c6f3412f7ea3ab043d6603cb2582",
"url": "https://api.github.com/repos/composer/ca-bundle/zipball/4c679186f2aca4ab6a0f1b0b9cf9252decb44d0b",
"reference": "4c679186f2aca4ab6a0f1b0b9cf9252decb44d0b",
"shasum": ""
},
"require": {
@ -7900,7 +7901,7 @@
"support": {
"irc": "irc://irc.freenode.org/composer",
"issues": "https://github.com/composer/ca-bundle/issues",
"source": "https://github.com/composer/ca-bundle/tree/1.2.11"
"source": "https://github.com/composer/ca-bundle/tree/1.3.1"
},
"funding": [
{
@ -7916,20 +7917,20 @@
"type": "tidelift"
}
],
"time": "2021-09-25T20:32:43+00:00"
"time": "2021-10-28T20:44:15+00:00"
},
{
"name": "composer/composer",
"version": "2.1.9",
"version": "2.1.10",
"source": {
"type": "git",
"url": "https://github.com/composer/composer.git",
"reference": "e558c88f28d102d497adec4852802c0dc14c7077"
"reference": "ea5f64d1a15c66942979b804c9fb3686be852ca0"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/composer/composer/zipball/e558c88f28d102d497adec4852802c0dc14c7077",
"reference": "e558c88f28d102d497adec4852802c0dc14c7077",
"url": "https://api.github.com/repos/composer/composer/zipball/ea5f64d1a15c66942979b804c9fb3686be852ca0",
"reference": "ea5f64d1a15c66942979b804c9fb3686be852ca0",
"shasum": ""
},
"require": {
@ -7940,7 +7941,7 @@
"composer/xdebug-handler": "^2.0",
"justinrainbow/json-schema": "^5.2.11",
"php": "^5.3.2 || ^7.0 || ^8.0",
"psr/log": "^1.0",
"psr/log": "^1.0 || ^2.0",
"react/promise": "^1.2 || ^2.7",
"seld/jsonlint": "^1.4",
"seld/phar-utils": "^1.0",
@ -7964,7 +7965,7 @@
"type": "library",
"extra": {
"branch-alias": {
"dev-master": "2.1-dev"
"dev-main": "2.1-dev"
}
},
"autoload": {
@ -7998,7 +7999,7 @@
"support": {
"irc": "ircs://irc.libera.chat:6697/composer",
"issues": "https://github.com/composer/composer/issues",
"source": "https://github.com/composer/composer/tree/2.1.9"
"source": "https://github.com/composer/composer/tree/2.1.10"
},
"funding": [
{
@ -8014,7 +8015,7 @@
"type": "tidelift"
}
],
"time": "2021-10-05T07:47:38+00:00"
"time": "2021-10-29T20:34:57+00:00"
},
{
"name": "composer/metadata-minifier",
@ -8087,16 +8088,16 @@
},
{
"name": "composer/semver",
"version": "3.2.5",
"version": "3.2.6",
"source": {
"type": "git",
"url": "https://github.com/composer/semver.git",
"reference": "31f3ea725711245195f62e54ffa402d8ef2fdba9"
"reference": "83e511e247de329283478496f7a1e114c9517506"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/composer/semver/zipball/31f3ea725711245195f62e54ffa402d8ef2fdba9",
"reference": "31f3ea725711245195f62e54ffa402d8ef2fdba9",
"url": "https://api.github.com/repos/composer/semver/zipball/83e511e247de329283478496f7a1e114c9517506",
"reference": "83e511e247de329283478496f7a1e114c9517506",
"shasum": ""
},
"require": {
@ -8148,7 +8149,7 @@
"support": {
"irc": "irc://irc.freenode.org/composer",
"issues": "https://github.com/composer/semver/issues",
"source": "https://github.com/composer/semver/tree/3.2.5"
"source": "https://github.com/composer/semver/tree/3.2.6"
},
"funding": [
{
@ -8164,7 +8165,7 @@
"type": "tidelift"
}
],
"time": "2021-05-24T12:41:47+00:00"
"time": "2021-10-25T11:34:17+00:00"
},
{
"name": "composer/spdx-licenses",
@ -9052,16 +9053,16 @@
},
{
"name": "phpdocumentor/reflection-docblock",
"version": "5.2.2",
"version": "5.3.0",
"source": {
"type": "git",
"url": "https://github.com/phpDocumentor/ReflectionDocBlock.git",
"reference": "069a785b2141f5bcf49f3e353548dc1cce6df556"
"reference": "622548b623e81ca6d78b721c5e029f4ce664f170"
},
"dist": {
"type": "zip",
"url": "https://api.github.com/repos/phpDocumentor/ReflectionDocBlock/zipball/069a785b2141f5bcf49f3e353548dc1cce6df556",
"reference": "069a785b2141f5bcf49f3e353548dc1cce6df556",
"url": "https://api.github.com/repos/phpDocumentor/ReflectionDocBlock/zipball/622548b623e81ca6d78b721c5e029f4ce664f170",
"reference": "622548b623e81ca6d78b721c5e029f4ce664f170",
"shasum": ""
},
"require": {
@ -9072,7 +9073,8 @@
"webmozart/assert": "^1.9.1"
},
"require-dev": {
"mockery/mockery": "~1.3.2"
"mockery/mockery": "~1.3.2",
"psalm/phar": "^4.8"
},
"type": "library",
"extra": {
@ -9102,9 +9104,9 @@
"description": "With this component, a library can provide support for annotations via DocBlocks or otherwise retrieve information that is embedded in a DocBlock.",
"support": {
"issues": "https://github.com/phpDocumentor/ReflectionDocBlock/issues",
"source": "https://github.com/phpDocumentor/ReflectionDocBlock/tree/master"
"source": "https://github.com/phpDocumentor/ReflectionDocBlock/tree/5.3.0"
},
"time": "2020-09-03T19:13:55+00:00"
"time": "2021-10-19T17:43:47+00:00"
},
{
"name": "phpdocumentor/type-resolver",

View File

@ -113,7 +113,7 @@ return [
'driver' => 'ldap',
'model' => env('LDAP_DIALECT') === 'OpenLDAP' ? $openLDAP : $activeDirectory,
'rules' => [
//UserDefinedRule::class,
UserDefinedRule::class,
],
'database' => [
'model' => FireflyIII\User::class,