jrojas
342 lines
12 KiB
C#
342 lines
12 KiB
C#
using adas_core.Authentication.Interfaces;
|
|
using adas_core.Domain.Enums;
|
|
using adas_core.Domain.Exceptions;
|
|
using adas_core.Domain.Models.MongoModels;
|
|
using adas_core.LdapLogin.Configuration;
|
|
using FluentValidation;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.AspNetCore.Http.HttpResults;
|
|
using Microsoft.Extensions.Logging;
|
|
using Microsoft.Extensions.Options;
|
|
using MongoDB.Bson;
|
|
using Novell.Directory.Ldap;
|
|
|
|
namespace adas_core.LdapLogin;
|
|
|
|
public class LdapLoginService : ILoginService
|
|
{
|
|
private readonly IAuthorityService _authorityService;
|
|
private readonly LdapConfig _ldapConfig;
|
|
private readonly ILogger<LdapLoginService> _logger;
|
|
private readonly Lazy<IUserService> _userService;
|
|
|
|
public LdapLoginService(
|
|
IOptions<LdapConfig> ldapConfig,
|
|
IValidator<LdapConfig> validator,
|
|
Lazy<IUserService> userService,
|
|
IAuthorityService authorityService,
|
|
ILogger<LdapLoginService> logger)
|
|
{
|
|
_userService = userService;
|
|
_authorityService = authorityService;
|
|
_logger = logger;
|
|
_ldapConfig = ldapConfig.Value;
|
|
validator.Validate(_ldapConfig, options => options.ThrowOnFailures());
|
|
}
|
|
|
|
public bool AllowPassword => true;
|
|
public UserEnum.LoginMethod Method => UserEnum.LoginMethod.Ldap;
|
|
|
|
public async Task<User> Login(string username, string password)
|
|
{
|
|
// Check for LDAP config
|
|
if (_ldapConfig.Server == null) throw new LoginServicesException("LDAP Config not found");
|
|
var conn = new LdapConnection();
|
|
try
|
|
{
|
|
await conn.ConnectAsync(_ldapConfig.Server, _ldapConfig.Port ?? 389);
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError("[LDAP] Error connecting to {server}, port {port}, Exception: {e}", _ldapConfig.Server,
|
|
_ldapConfig.Port, e.Message);
|
|
throw;
|
|
}
|
|
|
|
if (_ldapConfig.LdapUser != null)
|
|
{
|
|
_logger.LogInformation("[LDAP] _ldapConfig.LdapUser is enabled with {LdapUser}", _ldapConfig.LdapUser);
|
|
await conn.BindAsync(_ldapConfig.LdapUser, _ldapConfig.LdapPassword);
|
|
}
|
|
else
|
|
{
|
|
var ldapUser = (!string.IsNullOrEmpty(_ldapConfig.UserDomainName)
|
|
? _ldapConfig.UserDomainName + @"\"
|
|
: "") + username;
|
|
|
|
try
|
|
{
|
|
await conn.BindAsync(ldapUser, password);
|
|
}
|
|
catch (LdapException e)
|
|
{
|
|
_logger.LogError("[LDAP] Error binding ldapUser: {LdapUser} and password", ldapUser);
|
|
|
|
throw new UserNotFoundException(username, e);
|
|
}
|
|
}
|
|
|
|
var results = await conn.SearchAsync(
|
|
_ldapConfig.SearchBase,
|
|
LdapConnection.ScopeSub,
|
|
$"({_ldapConfig.UserNameProperty}={username})",
|
|
null,
|
|
false);
|
|
|
|
|
|
LdapEntry? entry = null;
|
|
|
|
while (await results.HasMoreAsync())
|
|
{
|
|
LdapEntry? current = null;
|
|
|
|
try
|
|
{
|
|
current = await results.NextAsync();
|
|
}
|
|
catch (LdapException ex)
|
|
{
|
|
_logger.LogWarning("[LDAP] Skipping invalid entry: {error}", ex.Message);
|
|
continue;
|
|
}
|
|
|
|
if (current != null)
|
|
{
|
|
entry = current;
|
|
break;
|
|
}
|
|
}
|
|
|
|
|
|
if (entry == null) throw new LoginServicesException("LDAP User not found");
|
|
var userEntryLdap = GetUser(entry);
|
|
var user = await GetOrCreateUser(userEntryLdap, entry);
|
|
_logger.LogInformation("[LDAP] entry is {entry} and user {user}", entry, user);
|
|
// user.Authorization.AddRange(GetAuthorities(entry));
|
|
conn.Disconnect();
|
|
return user ?? throw new LoginServicesException("LDAP User not found");
|
|
}
|
|
|
|
public Task<User> Login(HttpContext context)
|
|
{
|
|
throw new LoginServicesException("Not implemented");
|
|
}
|
|
|
|
public Task<User> Authenticate(string username, string password)
|
|
{
|
|
throw new LoginServicesException("Not implemented");
|
|
}
|
|
|
|
public Task<User?> GetById(ObjectId id)
|
|
{
|
|
throw new LoginServicesException("Not implemented");
|
|
}
|
|
|
|
public Task<User?> GetByEmail(string email)
|
|
{
|
|
throw new LoginServicesException("Not implemented");
|
|
}
|
|
|
|
public Task<User?> GetByUsername(string username)
|
|
{
|
|
throw new LoginServicesException("Not implemented");
|
|
}
|
|
|
|
public Task<List<User>> GetAllUsers()
|
|
{
|
|
throw new LoginServicesException("Not implemented");
|
|
}
|
|
|
|
private async Task<User?> GetOrCreateUser(User userEntryLdap, LdapEntry entry)
|
|
{
|
|
var userToReturn = (await _userService.Value.GetUserByUserName(userEntryLdap.UserName) ??
|
|
await _userService.Value.GetUserByName(userEntryLdap.Name)) ??
|
|
await _userService.Value.CreateUser(userEntryLdap);
|
|
|
|
if (userToReturn == null) return userToReturn;
|
|
userToReturn.Authorization = [];
|
|
|
|
var authorities = await CheckAuthorities(userToReturn, entry);
|
|
|
|
userToReturn.Authorization.AddRange(authorities);
|
|
//foreach (var authorization in userToReturn.Authorization)
|
|
//{
|
|
// Enum.TryParse<RolesType>(authorization.Rol, out var compareRole);
|
|
// if (compareRole == RolesType.Admin) userToReturn.Rol = RolesType.Admin;
|
|
//}
|
|
return userToReturn;
|
|
}
|
|
|
|
private async Task<List<Authorization>> CheckAuthorities(User user, LdapEntry entry)
|
|
{
|
|
try
|
|
{
|
|
var authorizationMap = GetAuthoritiesMap(entry, user);
|
|
var authorizationWhiteList = GetAuthoritiesWhiteList(entry, user);
|
|
_logger.LogInformation(
|
|
"[LDAP] user {user} authorizationMap count is {authorizationMap}, authorizationWhiteList count is {authorizationWhiteList}",
|
|
user.UserName, authorizationMap.Count, authorizationWhiteList.Count);
|
|
|
|
// Primero, creamos un HashSet con los DisplayID de la lista blanca para búsqueda eficiente
|
|
var whiteListDisplayIds = new HashSet<string?>(authorizationWhiteList.Select(a => a.DisplayId));
|
|
|
|
// Filtramos los elementos de authorizationMap que no están en la lista blanca, basándonos en DisplayID
|
|
var uniqueMapAuthorizations = authorizationMap.Where(a => !whiteListDisplayIds.Contains(a.DisplayId));
|
|
|
|
// Finalmente, combinamos los elementos únicos de authorizationMap con los de authorizationWhiteList
|
|
var combinedList = authorizationWhiteList.Concat(uniqueMapAuthorizations).ToList();
|
|
|
|
var userAuthorities = await _authorityService.GetUserAuthorities(user.Id);
|
|
foreach (var auth in combinedList)
|
|
{
|
|
var authFound = userAuthorities.Find(c => c.DisplayId == auth.DisplayId);
|
|
if (authFound is { CanUpdate: true })
|
|
{
|
|
authFound.Rol = auth.Rol;
|
|
await _authorityService.updateOne(authFound);
|
|
}
|
|
else
|
|
{
|
|
await _authorityService.InsertOne(auth);
|
|
}
|
|
}
|
|
|
|
return await _authorityService.GetUserAuthorities(user.Id);
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError("[LDAP] CheckAuthorities for user {user} has exception {ex}", user.UserName, e.Message);
|
|
|
|
return [];
|
|
}
|
|
}
|
|
|
|
private List<Authorization> GetAuthoritiesWhiteList(LdapEntry entry, User user)
|
|
{
|
|
try
|
|
{
|
|
var userWhiteList = new List<Authorization>();
|
|
var userNameProperty = _ldapConfig.UserNameProperty;
|
|
|
|
var whiteList = _ldapConfig.WhiteList.FindAll(u =>
|
|
(u.Name != null && entry.Dn.Contains(u.Name, StringComparison.CurrentCultureIgnoreCase)) ||
|
|
(u.Username != null &&
|
|
userNameProperty != null &&
|
|
entry.GetAttributeSet().TryGetValue(userNameProperty, out var attr) &&
|
|
attr.StringValue != null &&
|
|
attr.StringValue.Equals(u.Username, StringComparison.CurrentCultureIgnoreCase))
|
|
);
|
|
|
|
if (whiteList.Count == 0) return userWhiteList;
|
|
|
|
foreach (var authorityMap in whiteList)
|
|
{
|
|
if (!Enum.TryParse<PermissionEnum.RolesType>(authorityMap.Rol, out _))
|
|
continue;
|
|
|
|
userWhiteList.Add(new Authorization
|
|
{
|
|
UserId = user.Id,
|
|
DisplayId = authorityMap.DisplayId,
|
|
Rol = authorityMap.Rol
|
|
});
|
|
}
|
|
|
|
return userWhiteList;
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError("[LDAP] GetAuthoritiesWhiteList for user {user} has exception {ex}", user.UserName,
|
|
e.Message);
|
|
|
|
return [];
|
|
}
|
|
}
|
|
|
|
private User GetUser(LdapEntry ldapEntry)
|
|
{
|
|
var attributes = ldapEntry.GetAttributeSet();
|
|
|
|
var user = new User();
|
|
|
|
// UserName
|
|
if (!string.IsNullOrWhiteSpace(_ldapConfig.UserNameProperty) &&
|
|
attributes.TryGetValue(_ldapConfig.UserNameProperty, out var userAttr) &&
|
|
userAttr?.StringValue != null)
|
|
{
|
|
user.UserName = userAttr.StringValue;
|
|
}
|
|
else
|
|
{
|
|
user.UserName = "";
|
|
}
|
|
|
|
_logger.LogInformation("[LDAP] GetUser UserName is {UserName} ", user.UserName);
|
|
|
|
// First name
|
|
if (!string.IsNullOrWhiteSpace(_ldapConfig.FirstNameProperty) &&
|
|
attributes.TryGetValue(_ldapConfig.FirstNameProperty, out var firstNameAttr) &&
|
|
firstNameAttr?.StringValue != null)
|
|
{
|
|
user.Name = firstNameAttr.StringValue;
|
|
}
|
|
|
|
// Last name
|
|
if (!string.IsNullOrWhiteSpace(_ldapConfig.LastNameProperty) &&
|
|
attributes.TryGetValue(_ldapConfig.LastNameProperty, out var lastNameAttr) &&
|
|
lastNameAttr?.StringValue != null)
|
|
{
|
|
user.Name = string.IsNullOrEmpty(user.Name)
|
|
? lastNameAttr.StringValue
|
|
: $"{user.Name} {lastNameAttr.StringValue}";
|
|
}
|
|
|
|
return user;
|
|
}
|
|
|
|
private List<Authorization> GetAuthoritiesMap(LdapEntry ldapEntry, User user)
|
|
{
|
|
try
|
|
{
|
|
var authorities = new List<Authorization>();
|
|
|
|
if (!_ldapConfig.AuthoritiesMap.Any())
|
|
return authorities;
|
|
|
|
var attributes = ldapEntry.GetAttributeSet();
|
|
|
|
if (!string.IsNullOrWhiteSpace(_ldapConfig.GroupsProperty) ||
|
|
!attributes.TryGetValue(_ldapConfig.GroupsProperty!, out var groupsAttr) ||
|
|
groupsAttr?.StringValueArray == null)
|
|
{
|
|
return authorities;
|
|
}
|
|
|
|
var groups = groupsAttr.StringValueArray.ToList();
|
|
|
|
foreach (var authorityMap in _ldapConfig.AuthoritiesMap)
|
|
{
|
|
if (groups.Exists(g =>
|
|
string.Equals(g, authorityMap.Group, StringComparison.CurrentCultureIgnoreCase)))
|
|
{
|
|
if (!Enum.TryParse<PermissionEnum.RolesType>(authorityMap.Rol, out _))
|
|
continue;
|
|
|
|
authorities.Add(new Authorization
|
|
{
|
|
UserId = user.Id,
|
|
DisplayId = authorityMap.DisplayId,
|
|
Rol = authorityMap.Rol
|
|
});
|
|
}
|
|
}
|
|
|
|
return authorities;
|
|
}
|
|
catch (Exception e)
|
|
{
|
|
_logger.LogError("Error getting Authorities Map. Return new empty list. Exception: {e}", e);
|
|
return [];
|
|
}
|
|
}
|
|
} |