finall ldap support

src/auth/ldap.rs

@@ -0,0 +1,352 @@
+use chrono::Utc;
+use tracing::{debug, info};
+
+use crate::{queries, state::SharedState};
+
+use super::{
+    AuthError, MAX_NICKNAME, SessionResponse, User, create_session, find_user_by_email,
+    find_user_by_external_id, find_user_by_nickname, hash_password, normalize, random_token,
+    validate_email,
+};
+
+use std::time::Duration;
+
+use ldap3::{LdapConnAsync, LdapConnSettings, Scope, SearchEntry};
+use tokio::time::timeout;
+
+#[derive(Debug, Clone)]
+pub struct LdapConfig {
+    pub url: String,
+    pub starttls: bool,
+    pub bind_dn: String,
+    pub bind_password: String,
+    pub base_dn: String,
+    pub user_filter: String,
+    pub username_attribute: String,
+    pub email_attribute: String,
+    pub display_name_attribute: String,
+    pub external_id_attribute: String,
+    pub organization: String,
+    pub provider: String,
+    pub email_required: bool,
+    pub link_existing_by_email: bool,
+    pub tls_verify: bool,
+    pub connect_timeout_seconds: u64,
+    pub operation_timeout_seconds: u64,
+}
+
+#[derive(Debug, Clone)]
+pub struct LdapIdentity {
+    pub username: String,
+    pub email: String,
+    pub nickname: String,
+    pub provider: String,
+    pub external_id: String,
+    pub external_dn: String,
+}
+
+pub async fn authenticate(
+    config: &LdapConfig,
+    login: &str,
+    password: &str,
+) -> Result<Option<LdapIdentity>, String> {
+    if login.trim().is_empty() || password.is_empty() {
+        return Ok(None);
+    }
+
+    let settings = LdapConnSettings::new()
+        .set_starttls(config.starttls)
+        .set_no_tls_verify(!config.tls_verify);
+    let connect_timeout = Duration::from_secs(config.connect_timeout_seconds);
+    let operation_timeout = Duration::from_secs(config.operation_timeout_seconds);
+    let (connection, mut ldap) = timeout(
+        connect_timeout,
+        LdapConnAsync::with_settings(settings, &config.url),
+    )
+    .await
+    .map_err(|_| "LDAP connection timed out".to_owned())?
+    .map_err(|error| format!("LDAP connection failed: {error}"))?;
+    ldap3::drive!(connection);
+
+    if !config.bind_dn.trim().is_empty() {
+        let result = timeout(
+            operation_timeout,
+            ldap.simple_bind(&config.bind_dn, &config.bind_password),
+        )
+        .await
+        .map_err(|_| "LDAP service bind timed out".to_owned())?
+        .map_err(|error| format!("LDAP service bind failed: {error}"))?;
+        result
+            .success()
+            .map_err(|error| format!("LDAP service bind rejected: {error}"))?;
+    }
+
+    let escaped = escape_filter(login.trim());
+    let filter = config.user_filter.replace("{username}", &escaped);
+    let attributes = vec![
+        config.username_attribute.as_str(),
+        config.email_attribute.as_str(),
+        config.display_name_attribute.as_str(),
+        config.external_id_attribute.as_str(),
+    ];
+    let (mut entries, _) = timeout(
+        operation_timeout,
+        ldap.search(&config.base_dn, Scope::Subtree, &filter, attributes.clone()),
+    )
+    .await
+    .map_err(|_| "LDAP search timed out".to_owned())?
+    .map_err(|error| format!("LDAP search failed: {error}"))?
+    .success()
+    .map_err(|error| format!("LDAP search rejected: {error}"))?;
+
+    if entries.is_empty() && login.trim().contains('@') {
+        let email_filter = format!("({}={})", config.email_attribute, escaped);
+        let (email_entries, _) = timeout(
+            operation_timeout,
+            ldap.search(&config.base_dn, Scope::Subtree, &email_filter, attributes),
+        )
+        .await
+        .map_err(|_| "LDAP e-mail search timed out".to_owned())?
+        .map_err(|error| format!("LDAP e-mail search failed: {error}"))?
+        .success()
+        .map_err(|error| format!("LDAP e-mail search rejected: {error}"))?;
+        entries = email_entries;
+    }
+
+    if entries.len() != 1 {
+        let _ = ldap.unbind().await;
+        return Ok(None);
+    }
+
+    let entry = SearchEntry::construct(entries.into_iter().next().unwrap());
+    let user_dn = entry.dn.clone();
+    let username =
+        first_attr(&entry, &config.username_attribute).unwrap_or_else(|| login.trim().to_owned());
+    let email = first_attr(&entry, &config.email_attribute)
+        .filter(|value| value.contains('@'))
+        .or_else(|| {
+            (!config.email_required && login.trim().contains('@')).then(|| login.trim().to_owned())
+        });
+    if email.is_none() {
+        let _ = ldap.unbind().await;
+        return Err(format!(
+            "LDAP user is missing required e-mail attribute {}",
+            config.email_attribute
+        ));
+    }
+    let email = email.unwrap_or_default();
+    let external_id = first_attr_or_binary(&entry, &config.external_id_attribute)
+        .filter(|value| !value.trim().is_empty())
+        .ok_or_else(|| {
+            format!(
+                "LDAP user is missing required external identifier attribute {}",
+                config.external_id_attribute
+            )
+        })?;
+    let display_name = first_attr(&entry, &config.display_name_attribute)
+        .filter(|value| !value.trim().is_empty())
+        .unwrap_or_else(|| username.clone());
+
+    let result = timeout(operation_timeout, ldap.simple_bind(&user_dn, password))
+        .await
+        .map_err(|_| "LDAP user bind timed out".to_owned())?
+        .map_err(|error| format!("LDAP user bind failed: {error}"))?;
+    if result.success().is_err() {
+        let _ = ldap.unbind().await;
+        return Ok(None);
+    }
+    let _ = ldap.unbind().await;
+
+    let organization = config.organization.trim();
+    let nickname = if organization.is_empty() {
+        display_name
+    } else {
+        format!("{organization}/{display_name}")
+    };
+
+    Ok(Some(LdapIdentity {
+        username,
+        email,
+        nickname,
+        provider: config.provider.clone(),
+        external_id,
+        external_dn: user_dn,
+    }))
+}
+
+fn first_attr(entry: &SearchEntry, name: &str) -> Option<String> {
+    entry
+        .attrs
+        .get(name)
+        .and_then(|values| values.first())
+        .cloned()
+}
+
+fn first_attr_or_binary(entry: &SearchEntry, name: &str) -> Option<String> {
+    first_attr(entry, name).or_else(|| {
+        entry
+            .bin_attrs
+            .get(name)
+            .and_then(|values| values.first())
+            .map(|value| {
+                let mut output = String::with_capacity(value.len() * 2);
+                for byte in value {
+                    use std::fmt::Write;
+                    let _ = write!(&mut output, "{byte:02x}");
+                }
+                output
+            })
+    })
+}
+
+fn escape_filter(value: &str) -> String {
+    let mut result = String::with_capacity(value.len());
+    for byte in value.bytes() {
+        match byte {
+            b'*' => result.push_str("\\2a"),
+            b'(' => result.push_str("\\28"),
+            b')' => result.push_str("\\29"),
+            b'\\' => result.push_str("\\5c"),
+            0 => result.push_str("\\00"),
+            value if value < 0x20 || value >= 0x7f => result.push_str(&format!("\\{value:02x}")),
+            value => result.push(value as char),
+        }
+    }
+    result
+}
+
+pub(super) async fn login(
+    state: &SharedState,
+    login: &str,
+    password: &str,
+) -> Result<SessionResponse, AuthError> {
+    let config = state
+        .ldap
+        .as_ref()
+        .ok_or_else(|| AuthError::internal("LDAP authentication is not configured."))?;
+    debug!(login = %login.trim(), "LDAP login requested");
+    let identity = authenticate(config, login, password)
+        .await
+        .map_err(|error| {
+            tracing::error!(error = %error, "LDAP authentication error");
+            AuthError::service_unavailable("The organization directory is currently unavailable.")
+        })?
+        .ok_or_else(|| AuthError::unauthorized("Invalid organization login or password."))?;
+    let user = provision_ldap_user(state, identity).await?;
+    let session = create_session(state, &user).await?;
+    info!(user_id = user.id, nickname = %user.nickname, "LDAP login successful");
+    Ok(session)
+}
+
+async fn provision_ldap_user(
+    state: &SharedState,
+    identity: LdapIdentity,
+) -> Result<User, AuthError> {
+    let email = validate_email(&identity.email)?;
+    if let Some(user) =
+        find_user_by_external_id(state, &identity.provider, &identity.external_id).await?
+    {
+        return sync_directory_user(state, user, &identity, &email).await;
+    }
+
+    if let Some(existing) = find_user_by_email(state, &email).await? {
+        let link_by_email = state
+            .ldap
+            .as_ref()
+            .map(|config| config.link_existing_by_email)
+            .unwrap_or(false);
+        if !link_by_email {
+            return Err(AuthError::conflict(
+                "This e-mail address already belongs to another account. Ask an administrator to link it or enable LDAP_LINK_EXISTING_BY_EMAIL.",
+            ));
+        }
+        return sync_directory_user(state, existing, &identity, &email).await;
+    }
+
+    let nickname = available_directory_nickname(state, &identity.nickname, None).await?;
+    let password_hash = hash_password(&random_token())?;
+    let confirmed_at = Utc::now().to_rfc3339();
+    sqlx::query(queries::get(
+        state.db.kind(),
+        queries::AUTH_INSERT_DIRECTORY_USER,
+    ))
+    .bind(&nickname)
+    .bind(normalize(&nickname))
+    .bind(&email)
+    .bind(normalize(&email))
+    .bind(password_hash)
+    .bind(Some(confirmed_at))
+    .bind(&identity.provider)
+    .bind(&identity.external_id)
+    .bind(&identity.external_dn)
+    .execute(state.db.pool())
+    .await
+    .map_err(AuthError::database)?;
+    info!(ldap_username = %identity.username, nickname = %nickname, provider = %identity.provider, "provisioned directory user");
+    find_user_by_external_id(state, &identity.provider, &identity.external_id)
+        .await?
+        .ok_or_else(|| AuthError::internal("Failed to provision the organization account."))
+}
+
+async fn sync_directory_user(
+    state: &SharedState,
+    user: User,
+    identity: &LdapIdentity,
+    email: &str,
+) -> Result<User, AuthError> {
+    let nickname = available_directory_nickname(state, &identity.nickname, Some(user.id)).await?;
+    sqlx::query(queries::get(
+        state.db.kind(),
+        queries::AUTH_UPDATE_DIRECTORY_USER,
+    ))
+    .bind(&nickname)
+    .bind(normalize(&nickname))
+    .bind(email)
+    .bind(normalize(email))
+    .bind(&identity.provider)
+    .bind(&identity.external_id)
+    .bind(&identity.external_dn)
+    .bind(Utc::now().to_rfc3339())
+    .bind(user.id)
+    .execute(state.db.pool())
+    .await
+    .map_err(AuthError::database)?;
+    find_user_by_external_id(state, &identity.provider, &identity.external_id)
+        .await?
+        .ok_or_else(|| AuthError::internal("Failed to synchronize the organization account."))
+}
+
+async fn available_directory_nickname(
+    state: &SharedState,
+    requested: &str,
+    current_user_id: Option<i64>,
+) -> Result<String, AuthError> {
+    let base = truncate_nickname(requested);
+    let mut nickname = base.clone();
+    let mut suffix = 1usize;
+    loop {
+        match find_user_by_nickname(state, &nickname).await? {
+            None => return Ok(nickname),
+            Some(user) if Some(user.id) == current_user_id => return Ok(nickname),
+            Some(_) => {
+                suffix += 1;
+                let marker = format!("-{suffix}");
+                nickname = format!(
+                    "{}{}",
+                    truncate_to_chars(&base, MAX_NICKNAME - marker.chars().count()),
+                    marker
+                );
+            }
+        }
+    }
+}
+
+fn truncate_nickname(value: &str) -> String {
+    let value = value.trim();
+    let value = if value.is_empty() { "ldap-user" } else { value };
+    truncate_to_chars(value, MAX_NICKNAME)
+}
+
+fn truncate_to_chars(value: &str, max: usize) -> String {
+    value.chars().take(max).collect()
+}

src/auth/local.rs

@@ -0,0 +1,34 @@
+use tracing::{debug, info, warn};
+
+use crate::state::SharedState;
+
+use super::{
+    AuthError, SessionResponse, create_session, email_domain, find_user_by_email, validate_email,
+    verify_password,
+};
+
+pub(super) async fn login(
+    state: &SharedState,
+    login: &str,
+    password: &str,
+) -> Result<SessionResponse, AuthError> {
+    let email = validate_email(login)?;
+    debug!(email_domain = %email_domain(&email), "login requested");
+    let user = find_user_by_email(state, &email)
+        .await?
+        .ok_or_else(|| AuthError::unauthorized("Invalid e-mail address or password."))?;
+    if !verify_password(&user.password_hash, password) {
+        warn!(user_id = user.id, "login rejected: invalid password");
+        return Err(AuthError::unauthorized(
+            "Invalid e-mail address or password.",
+        ));
+    }
+    if state.account_confirmation_required && user.confirmed_at.is_none() {
+        return Err(AuthError::forbidden(
+            "Confirm the account using the link sent by e-mail before logging in.",
+        ));
+    }
+    let session = create_session(state, &user).await?;
+    info!(user_id = user.id, nickname = %user.nickname, "login successful");
+    Ok(session)
+}