mirror/lldap
1
0
Fork 0
mirror of https://github.com/nitnelave/lldap.git synced 2023-04-12 14:25:13 +00:00
Code Issues Projects Releases Wiki Activity

server: refactor group requests to use filters

Browse Source
This commit is contained in:
Valentin Tolmer 2022-02-12 11:00:02 +01:00 committed by nitnelave
parent a1fe703bf0
commit c850fa4273
5 changed files with 319 additions and 149 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
server/src/domain/handler.rs
View File

@ -54,6 +54,17 @@ pub enum UserRequestFilter {
MemberOfId(GroupId),
}
#[derive(PartialEq, Eq, Debug, Serialize, Deserialize, Clone)]
pub enum GroupRequestFilter {
And(Vec<GroupRequestFilter>),
Or(Vec<GroupRequestFilter>),
Not(Box<GroupRequestFilter>),
DisplayName(String),
GroupId(GroupId),
// Check if the group contains a user identified by uid.
Member(String),
}
#[derive(PartialEq, Eq, Debug, Serialize, Deserialize, Clone, Default)]
pub struct CreateUserRequest {
// Same fields as User, but no creation_date, and with password.
@ -94,7 +105,7 @@ pub struct GroupIdAndName(pub GroupId, pub String);
#[async_trait]
pub trait BackendHandler: Clone + Send {
async fn list_users(&self, filters: Option<UserRequestFilter>) -> Result<Vec<User>>;
async fn list_groups(&self) -> Result<Vec<Group>>;
async fn list_groups(&self, filters: Option<GroupRequestFilter>) -> Result<Vec<Group>>;
async fn get_user_details(&self, user_id: &str) -> Result<User>;
async fn get_group_details(&self, group_id: GroupId) -> Result<GroupIdAndName>;
async fn create_user(&self, request: CreateUserRequest) -> Result<()>;
@ -117,7 +128,7 @@ mockall::mock! {
#[async_trait]
impl BackendHandler for TestBackendHandler {
async fn list_users(&self, filters: Option<UserRequestFilter>) -> Result<Vec<User>>;
async fn list_groups(&self) -> Result<Vec<Group>>;
async fn list_groups(&self, filters: Option<GroupRequestFilter>) -> Result<Vec<Group>>;
async fn get_user_details(&self, user_id: &str) -> Result<User>;
async fn get_group_details(&self, group_id: GroupId) -> Result<GroupIdAndName>;
async fn create_user(&self, request: CreateUserRequest) -> Result<()>;

115
server/src/domain/sql_backend_handler.rs
View File

@ -21,7 +21,7 @@ impl SqlBackendHandler {
struct RequiresGroup(bool);
// Returns the condition for the SQL query, and whether it requires joining with the groups table.
fn get_filter_expr(filter: UserRequestFilter) -> (RequiresGroup, SimpleExpr) {
fn get_user_filter_expr(filter: UserRequestFilter) -> (RequiresGroup, SimpleExpr) {
use UserRequestFilter::*;
fn get_repeated_filter(
fs: Vec<UserRequestFilter>,
@ -32,13 +32,13 @@ fn get_filter_expr(filter: UserRequestFilter) -> (RequiresGroup, SimpleExpr) {
let first_expr = match it.next() {
None => return (RequiresGroup(false), Expr::value(true)),
Some(f) => {
let (group, filter) = get_filter_expr(f);
let (group, filter) = get_user_filter_expr(f);
requires_group |= group.0;
filter
}
};
let filter = it.fold(first_expr, |e, f| {
let (group, filters) = get_filter_expr(f);
let (group, filters) = get_user_filter_expr(f);
requires_group |= group.0;
field(e, filters)
});
@ -48,7 +48,7 @@ fn get_filter_expr(filter: UserRequestFilter) -> (RequiresGroup, SimpleExpr) {
And(fs) => get_repeated_filter(fs, &SimpleExpr::and),
Or(fs) => get_repeated_filter(fs, &SimpleExpr::or),
Not(f) => {
let (requires_group, filters) = get_filter_expr(*f);
let (requires_group, filters) = get_user_filter_expr(*f);
(requires_group, Expr::not(Expr::expr(filters)))
}
Equality(s1, s2) => (
@ -72,6 +72,37 @@ fn get_filter_expr(filter: UserRequestFilter) -> (RequiresGroup, SimpleExpr) {
}
}
// Returns the condition for the SQL query, and whether it requires joining with the groups table.
fn get_group_filter_expr(filter: GroupRequestFilter) -> SimpleExpr {
use GroupRequestFilter::*;
fn get_repeated_filter(
fs: Vec<GroupRequestFilter>,
field: &dyn Fn(SimpleExpr, SimpleExpr) -> SimpleExpr,
) -> SimpleExpr {
let mut it = fs.into_iter();
let first_expr = match it.next() {
None => return Expr::value(true),
Some(f) => get_group_filter_expr(f),
};
it.fold(first_expr, |e, f| field(e, get_group_filter_expr(f)))
}
match filter {
And(fs) => get_repeated_filter(fs, &SimpleExpr::and),
Or(fs) => get_repeated_filter(fs, &SimpleExpr::or),
Not(f) => Expr::not(Expr::expr(get_group_filter_expr(*f))),
DisplayName(name) => Expr::col((Groups::Table, Groups::DisplayName)).eq(name),
GroupId(id) => Expr::col((Groups::Table, Groups::GroupId)).eq(id.0),
// WHERE (group_id in (SELECT group_id FROM memberships WHERE user_id = user))
Member(user) => Expr::col((Memberships::Table, Memberships::GroupId)).in_subquery(
Query::select()
.column(Memberships::GroupId)
.from(Memberships::Table)
.and_where(Expr::col(Memberships::UserId).eq(user))
.take(),
),
}
}
#[async_trait]
impl BackendHandler for SqlBackendHandler {
async fn list_users(&self, filters: Option<UserRequestFilter>) -> Result<Vec<User>> {
@ -88,17 +119,13 @@ impl BackendHandler for SqlBackendHandler {
.order_by((Users::Table, Users::UserId), Order::Asc)
.to_owned();
if let Some(filter) = filters {
if filter
== UserRequestFilter::Not(Box::new(
UserRequestFilter::And(Vec::new()),
))
{
if filter == UserRequestFilter::Not(Box::new(UserRequestFilter::And(Vec::new()))) {
return Ok(Vec::new());
}
if filter != UserRequestFilter::And(Vec::new())
&& filter != UserRequestFilter::Or(Vec::new())
{
let (RequiresGroup(requires_group), condition) = get_filter_expr(filter);
let (RequiresGroup(requires_group), condition) = get_user_filter_expr(filter);
query_builder.and_where(condition);
if requires_group {
query_builder
@ -127,8 +154,9 @@ impl BackendHandler for SqlBackendHandler {
Ok(results.into_iter().collect::<sqlx::Result<Vec<User>>>()?)
}
async fn list_groups(&self) -> Result<Vec<Group>> {
let query: String = Query::select()
async fn list_groups(&self, filters: Option<GroupRequestFilter>) -> Result<Vec<Group>> {
let query: String = {
let mut query_builder = Query::select()
.column((Groups::Table, Groups::GroupId))
.column(Groups::DisplayName)
.column(Memberships::UserId)
@ -140,7 +168,22 @@ impl BackendHandler for SqlBackendHandler {
)
.order_by(Groups::DisplayName, Order::Asc)
.order_by(Memberships::UserId, Order::Asc)
.to_string(DbQueryBuilder {});
.to_owned();
if let Some(filter) = filters {
if filter == GroupRequestFilter::Not(Box::new(GroupRequestFilter::And(Vec::new())))
{
return Ok(Vec::new());
}
if filter != GroupRequestFilter::And(Vec::new())
&& filter != GroupRequestFilter::Or(Vec::new())
{
query_builder.and_where(get_group_filter_expr(filter));
}
}
query_builder.to_string(DbQueryBuilder {})
};
// For group_by.
use itertools::Itertools;
@ -546,10 +589,9 @@ mod tests {
}
{
let users = handler
.list_users(Some(UserRequestFilter::Not(Box::new(UserRequestFilter::Equality(
"user_id".to_string(),
"bob".to_string(),
)))))
.list_users(Some(UserRequestFilter::Not(Box::new(
UserRequestFilter::Equality("user_id".to_string(), "bob".to_string()),
))))
.await
.unwrap()
.into_iter()
@ -575,7 +617,7 @@ mod tests {
insert_membership(&handler, group_2, "patrick").await;
insert_membership(&handler, group_2, "John").await;
assert_eq!(
handler.list_groups().await.unwrap(),
handler.list_groups(None).await.unwrap(),
vec![
Group {
id: group_1,
@ -594,6 +636,43 @@ mod tests {
},
]
);
assert_eq!(
handler
.list_groups(Some(GroupRequestFilter::Or(vec![
GroupRequestFilter::DisplayName("Empty Group".to_string()),
GroupRequestFilter::Member("bob".to_string()),
])))
.await
.unwrap(),
vec![
Group {
id: group_1,
display_name: "Best Group".to_string(),
users: vec!["bob".to_string(), "patrick".to_string()]
},
Group {
id: group_3,
display_name: "Empty Group".to_string(),
users: vec![]
},
]
);
assert_eq!(
handler
.list_groups(Some(GroupRequestFilter::And(vec![
GroupRequestFilter::Not(Box::new(GroupRequestFilter::DisplayName(
"value".to_string()
))),
GroupRequestFilter::GroupId(group_1),
])))
.await
.unwrap(),
vec![Group {
id: group_1,
display_name: "Best Group".to_string(),
users: vec!["bob".to_string(), "patrick".to_string()]
}]
);
}
#[tokio::test]

2
server/src/infra/graphql/query.rs
View File

@ -134,7 +134,7 @@ impl<Handler: BackendHandler + Sync> Query<Handler> {
}
Ok(context
.handler
.list_groups()
.list_groups(None)
.await
.map(|v| v.into_iter().map(Into::into).collect())?)
}

242
server/src/infra/ldap_handler.rs
View File

@ -1,12 +1,11 @@
use crate::domain::{
handler::{
BackendHandler, BindRequest, Group, GroupIdAndName, LoginHandler, UserRequestFilter, User,
BackendHandler, BindRequest, Group, GroupRequestFilter, LoginHandler, User,
UserRequestFilter,
},
opaque_handler::OpaqueHandler,
};
use anyhow::{bail, Context, Result};
use futures::stream::StreamExt;
use futures_util::TryStreamExt;
use ldap3_server::proto::{
LdapBindCred, LdapBindRequest, LdapBindResponse, LdapExtendedRequest, LdapExtendedResponse,
LdapFilter, LdapOp, LdapPartialAttribute, LdapPasswordModifyRequest, LdapResult,
@ -479,8 +478,8 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
}
async fn get_groups_list(&self, request: &LdapSearchRequest) -> Vec<LdapOp> {
let for_user = match self.get_group_filter(&request.filter) {
Ok(u) => u,
let filter = match self.convert_group_filter(&request.filter) {
Ok(f) => f,
Err(e) => {
return vec![make_search_error(
LdapResultCode::UnwillingToPerform,
@ -489,48 +488,7 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
}
};
async fn get_users_for_group<Backend: BackendHandler>(
backend_handler: &Backend,
g: &GroupIdAndName,
) -> Result<Group> {
let users = backend_handler
.list_users(Some(UserRequestFilter::MemberOfId(g.0)))
.await?;
Ok(Group {
id: g.0,
display_name: g.1.clone(),
users: users.into_iter().map(|u| u.user_id).collect(),
})
}
let groups: Vec<Group> = if let Some(user) = for_user {
let groups_without_users = match self.backend_handler.get_user_groups(&user).await {
Ok(groups) => groups,
Err(e) => {
return vec![make_search_error(
LdapResultCode::Other,
format!(
r#"Error while listing user groups: "{}": {:#}"#,
request.base, e
),
)]
}
};
match tokio_stream::iter(groups_without_users.iter())
.then(|g| async move { get_users_for_group::<Backend>(&self.backend_handler, g).await })
.try_collect::<Vec<Group>>()
.await
{
Ok(groups) => groups,
Err(e) => {
return vec![make_search_error(
LdapResultCode::Other,
format!(r#"Error while listing user groups: "{}": {:#}"#, request.base, e),
)]
}
}
} else {
match self.backend_handler.list_groups().await {
let groups = match self.backend_handler.list_groups(Some(filter)).await {
Ok(groups) => groups,
Err(e) => {
return vec![make_search_error(
@ -538,7 +496,6 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
format!(r#"Error while listing groups "{}": {:#}"#, request.base, e),
)]
}
}
};
groups
@ -582,7 +539,7 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
})
}
fn get_group_filter(&self, filter: &LdapFilter) -> Result<Option<String>> {
fn convert_group_filter(&self, filter: &LdapFilter) -> Result<GroupRequestFilter> {
match filter {
LdapFilter::Equality(field, value) => {
if field == "member" || field.to_lowercase() == "uniquemember" {
@ -591,16 +548,33 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
&self.base_dn,
&self.base_dn_str,
)?;
Ok(Some(user_name))
Ok(GroupRequestFilter::Member(user_name))
} else if field.to_lowercase() == "objectclass" && value == "groupOfUniqueNames" {
Ok(None)
Ok(GroupRequestFilter::And(vec![]))
} else {
bail!("Unsupported group filter: {:?}", filter)
let field = map_field(field)?;
if field == "display_name" {
Ok(GroupRequestFilter::DisplayName(value.clone()))
} else {
bail!("Unsupported group attribute: {:?}", field)
}
}
LdapFilter::And(v) => v
}
LdapFilter::And(filters) => Ok(GroupRequestFilter::And(
filters
.iter()
.fold(Ok(None), |o, f| Ok(o?.xor(self.get_group_filter(f)?))),
.map(|f| self.convert_group_filter(f))
.collect::<Result<_>>()?,
)),
LdapFilter::Or(filters) => Ok(GroupRequestFilter::Or(
filters
.iter()
.map(|f| self.convert_group_filter(f))
.collect::<Result<_>>()?,
)),
LdapFilter::Not(filter) => Ok(GroupRequestFilter::Not(Box::new(
self.convert_group_filter(&*filter)?,
))),
_ => bail!("Unsupported group filter: {:?}", filter),
}
}
@ -638,10 +612,15 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
{
Ok(UserRequestFilter::And(vec![]))
} else {
Ok(UserRequestFilter::Not(Box::new(UserRequestFilter::And(vec![]))))
Ok(UserRequestFilter::Not(Box::new(UserRequestFilter::And(
vec![],
))))
}
} else {
Ok(UserRequestFilter::Equality(map_field(field)?, value.clone()))
Ok(UserRequestFilter::Equality(
map_field(field)?,
value.clone(),
))
}
}
LdapFilter::Present(field) => {
@ -649,7 +628,9 @@ impl<Backend: BackendHandler + LoginHandler + OpaqueHandler> LdapHandler<Backend
if field.to_lowercase() == "objectclass" || map_field(field).is_ok() {
Ok(UserRequestFilter::And(vec![]))
} else {
Ok(UserRequestFilter::Not(Box::new(UserRequestFilter::And(vec![]))))
Ok(UserRequestFilter::Not(Box::new(UserRequestFilter::And(
vec![],
))))
}
}
_ => bail!("Unsupported user filter: {:?}", filter),
@ -679,7 +660,7 @@ mod tests {
#[async_trait]
impl BackendHandler for TestBackendHandler {
async fn list_users(&self, filters: Option<UserRequestFilter>) -> Result<Vec<User>>;
async fn list_groups(&self) -> Result<Vec<Group>>;
async fn list_groups(&self, filters: Option<GroupRequestFilter>) -> Result<Vec<Group>>;
async fn get_user_details(&self, user_id: &str) -> Result<User>;
async fn get_group_details(&self, group_id: GroupId) -> Result<GroupIdAndName>;
async fn get_user_groups(&self, user: &str) -> Result<HashSet<GroupIdAndName>>;
@ -1048,7 +1029,10 @@ mod tests {
#[tokio::test]
async fn test_search_groups() {
let mut mock = MockTestBackendHandler::new();
mock.expect_list_groups().times(1).return_once(|| {
mock.expect_list_groups()
.with(eq(Some(GroupRequestFilter::And(vec![]))))
.times(1)
.return_once(|_| {
Ok(vec![
Group {
id: GroupId(1),
@ -1124,27 +1108,25 @@ mod tests {
#[tokio::test]
async fn test_search_groups_filter() {
let mut mock = MockTestBackendHandler::new();
mock.expect_get_user_groups()
.with(eq("bob"))
mock.expect_list_groups()
.with(eq(Some(GroupRequestFilter::And(vec![
GroupRequestFilter::DisplayName("group_1".to_string()),
GroupRequestFilter::Member("bob".to_string()),
GroupRequestFilter::And(vec![]),
]))))
.times(1)
.return_once(|_| {
let mut set = HashSet::new();
set.insert(GroupIdAndName(GroupId(1), "group_1".to_string()));
Ok(set)
});
mock.expect_list_users()
.with(eq(Some(UserRequestFilter::MemberOfId(GroupId(1)))))
.times(1)
.return_once(|_| {
Ok(vec![User {
user_id: "bob".to_string(),
..Default::default()
Ok(vec![Group {
display_name: "group_1".to_string(),
id: GroupId(1),
users: vec![],
}])
});
let mut ldap_handler = setup_bound_handler(mock).await;
let request = make_search_request(
"ou=groups,dc=example,dc=com",
LdapFilter::And(vec![
LdapFilter::Equality("cn".to_string(), "group_1".to_string()),
LdapFilter::Equality(
"uniqueMember".to_string(),
"cn=bob,ou=people,dc=example,dc=com".to_string(),
@ -1168,11 +1150,106 @@ mod tests {
);
}
#[tokio::test]
async fn test_search_groups_filter_2() {
let mut mock = MockTestBackendHandler::new();
mock.expect_list_groups()
.with(eq(Some(GroupRequestFilter::Or(vec![
GroupRequestFilter::Not(Box::new(GroupRequestFilter::DisplayName(
"group_2".to_string(),
))),
]))))
.times(1)
.return_once(|_| {
Ok(vec![Group {
display_name: "group_1".to_string(),
id: GroupId(1),
users: vec![],
}])
});
let mut ldap_handler = setup_bound_handler(mock).await;
let request = make_search_request(
"ou=groups,dc=example,dc=com",
LdapFilter::Or(vec![LdapFilter::Not(Box::new(LdapFilter::Equality(
"displayname".to_string(),
"group_2".to_string(),
)))]),
vec!["cn"],
);
assert_eq!(
ldap_handler.do_search(&request).await,
vec![
LdapOp::SearchResultEntry(LdapSearchResultEntry {
dn: "cn=group_1,ou=groups,dc=example,dc=com".to_string(),
attributes: vec![LdapPartialAttribute {
atype: "cn".to_string(),
vals: vec!["group_1".to_string()]
},],
}),
make_search_success(),
]
);
}
#[tokio::test]
async fn test_search_groups_error() {
let mut mock = MockTestBackendHandler::new();
mock.expect_list_groups()
.with(eq(Some(GroupRequestFilter::Or(vec![
GroupRequestFilter::Not(Box::new(GroupRequestFilter::DisplayName(
"group_2".to_string(),
))),
]))))
.times(1)
.return_once(|_| {
Err(crate::domain::error::DomainError::InternalError(
"Error getting groups".to_string(),
))
});
let mut ldap_handler = setup_bound_handler(mock).await;
let request = make_search_request(
"ou=groups,dc=example,dc=com",
LdapFilter::Or(vec![LdapFilter::Not(Box::new(LdapFilter::Equality(
"displayname".to_string(),
"group_2".to_string(),
)))]),
vec!["cn"],
);
assert_eq!(
ldap_handler.do_search(&request).await,
vec![make_search_error(
LdapResultCode::Other,
r#"Error while listing groups "ou=groups,dc=example,dc=com": Internal error: `Error getting groups`"#.to_string()
)]
);
}
#[tokio::test]
async fn test_search_groups_filter_error() {
let mut ldap_handler = setup_bound_handler(MockTestBackendHandler::new()).await;
let request = make_search_request(
"ou=groups,dc=example,dc=com",
LdapFilter::And(vec![LdapFilter::Equality(
"whatever".to_string(),
"group_1".to_string(),
)]),
vec!["cn"],
);
assert_eq!(
ldap_handler.do_search(&request).await,
vec![make_search_error(
LdapResultCode::UnwillingToPerform,
"Unsupported group filter: Unknown field: whatever".to_string()
)]
);
}
#[tokio::test]
async fn test_search_filters() {
let mut mock = MockTestBackendHandler::new();
mock.expect_list_users()
.with(eq(Some(UserRequestFilter::And(vec![UserRequestFilter::Or(vec![
.with(eq(Some(UserRequestFilter::And(vec![
UserRequestFilter::Or(vec![
UserRequestFilter::Not(Box::new(UserRequestFilter::Equality(
"user_id".to_string(),
"bob".to_string(),
@ -1182,7 +1259,8 @@ mod tests {
UserRequestFilter::And(vec![]),
UserRequestFilter::And(vec![]),
UserRequestFilter::Not(Box::new(UserRequestFilter::And(vec![]))),
])]))))
]),
]))))
.times(1)
.return_once(|_| Ok(vec![]));
let mut ldap_handler = setup_bound_handler(mock).await;
@ -1256,12 +1334,11 @@ mod tests {
async fn test_search_filters_lowercase() {
let mut mock = MockTestBackendHandler::new();
mock.expect_list_users()
.with(eq(Some(UserRequestFilter::And(vec![UserRequestFilter::Or(vec![
UserRequestFilter::Not(Box::new(UserRequestFilter::Equality(
"first_name".to_string(),
"bob".to_string(),
))),
])]))))
.with(eq(Some(UserRequestFilter::And(vec![
UserRequestFilter::Or(vec![UserRequestFilter::Not(Box::new(
UserRequestFilter::Equality("first_name".to_string(), "bob".to_string()),
))]),
]))))
.times(1)
.return_once(|_| {
Ok(vec![User {
@ -1309,7 +1386,10 @@ mod tests {
..Default::default()
}])
});
mock.expect_list_groups().times(1).return_once(|| {
mock.expect_list_groups()
.with(eq(Some(GroupRequestFilter::And(vec![]))))
.times(1)
.return_once(|_| {
Ok(vec![Group {
id: GroupId(1),
display_name: "group_1".to_string(),

2
server/src/infra/tcp_backend_handler.rs
View File

@ -36,7 +36,7 @@ mockall::mock! {
#[async_trait]
impl BackendHandler for TestTcpBackendHandler {
async fn list_users(&self, filters: Option<UserRequestFilter>) -> Result<Vec<User>>;
async fn list_groups(&self) -> Result<Vec<Group>>;
async fn list_groups(&self, filters: Option<GroupRequestFilter>) -> Result<Vec<Group>>;
async fn get_user_details(&self, user_id: &str) -> Result<User>;
async fn get_group_details(&self, group_id: GroupId) -> Result<GroupIdAndName>;
async fn get_user_groups(&self, user: &str) -> Result<HashSet<GroupIdAndName>>;