sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

graph: Use userType property to distinguish between Member and Guest accounts

Browse Source 
Fixes 5603

- Calling POST /graph/v1.0/users with userType not set will create a user as "Member"
- Calling POST /graph/v1.0/users with userType set as "Member" or "Guest" will create a user as "Member" or "Guest"
- Calling POST /graph/v1.0/users with userType set as anything but "Member" or "Guest" returns error
- Calling POST /graph/v1.0/education/users with userType not set will create a user as "Member"
- Calling POST /graph/v1.0/education/users with userType set as "Member" will create a user as "Member" and primary role as parameter specifies
- Calling POST /graph/v1.0/education/users with userType set as "Guest" will create a user as "Guest" and primary role as parameter specifies
- Calling POST /graph/v1.0/education/users with userType not set as anything but "Member" or "Guest" returns error
- Calling PATCH on /users or /education/users will update attribute in the same way as for POST
This commit is contained in:
Daniel Swärd
2023-03-15 12:05:29 +01:00
committed by Ralf Haferkamp
parent 36d0c8c939
commit 23ba180e8a
13 changed files with 410 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/graph/pkg/identity/ldap.go
+14
View File
@@ -77,6 +77,7 @@ type userAttributeMap struct {
givenName string
surname string
accountEnabled string
userType string
}
type ldapAttributeValues map[string][]string
@@ -105,6 +106,7 @@ func NewLDAPBackend(lc ldap.Client, config config.LDAP, logger *log.Logger) (*LD
accountEnabled: config.UserEnabledAttribute,
givenName: _givenNameAttribute,
surname: _surNameAttribute,
userType: config.UserTypeAttribute,
}
if config.GroupNameAttribute == "" || config.GroupIDAttribute == "" {
@@ -296,6 +298,12 @@ func (i *LDAP) UpdateUser(ctx context.Context, nameOrID string, user libregraph.
updateNeeded = true
}
}
if user.GetUserType() != "" {
if e.GetEqualFoldAttributeValue(i.userAttributeMap.userType) != user.GetUserType() {
mr.Replace(i.userAttributeMap.userType, []string{user.GetUserType()})
updateNeeded = true
}
}
if user.PasswordProfile != nil && user.PasswordProfile.GetPassword() != "" {
if i.usePwModifyExOp {
if err := i.updateUserPassowrd(ctx, e.DN, user.PasswordProfile.GetPassword()); err != nil {
@@ -372,6 +380,7 @@ func (i *LDAP) getUserByDN(dn string) (*ldap.Entry, error) {
i.userAttributeMap.surname,
i.userAttributeMap.givenName,
i.userAttributeMap.accountEnabled,
i.userAttributeMap.userType,
}
filter := fmt.Sprintf("(objectClass=%s)", i.userObjectClass)
@@ -469,6 +478,7 @@ func (i *LDAP) getLDAPUserByFilter(filter string) (*ldap.Entry, error) {
i.userAttributeMap.surname,
i.userAttributeMap.givenName,
i.userAttributeMap.accountEnabled,
i.userAttributeMap.userType,
}
return i.searchLDAPEntryByFilter(i.userBaseDN, attrs, filter)
}
@@ -707,6 +717,7 @@ func (i *LDAP) createUserModelFromLDAP(e *ldap.Entry) *libregraph.User {
id := e.GetEqualFoldAttributeValue(i.userAttributeMap.id)
givenName := e.GetEqualFoldAttributeValue(i.userAttributeMap.givenName)
surname := e.GetEqualFoldAttributeValue(i.userAttributeMap.surname)
userType := e.GetEqualFoldAttributeValue(i.userAttributeMap.userType)
if id != "" && opsan != "" {
return &libregraph.User{
@@ -716,6 +727,7 @@ func (i *LDAP) createUserModelFromLDAP(e *ldap.Entry) *libregraph.User {
Id: &id,
GivenName: &givenName,
Surname: &surname,
UserType: &userType,
AccountEnabled: booleanOrNil(e.GetEqualFoldAttributeValue(i.userAttributeMap.accountEnabled)),
}
}
@@ -730,6 +742,7 @@ func (i *LDAP) userToLDAPAttrValues(user libregraph.User) (map[string][]string,
i.userAttributeMap.mail: {user.GetMail()},
"objectClass": {"inetOrgPerson", "organizationalPerson", "person", "top", "ownCloudUser"},
"cn": {user.GetOnPremisesSamAccountName()},
i.userAttributeMap.userType: {user.GetUserType()},
}
if !i.useServerUUID {
@@ -778,6 +791,7 @@ func (i *LDAP) getUserAttrTypes() []string {
"owncloudUUID",
"userPassword",
i.userAttributeMap.accountEnabled,
i.userAttributeMap.userType,
}
}