loopback-component-passport 不适用于 ldap/ 活动目录

Question

我无法让 loopback-component-passport 使用 ldap 对活动目录进行身份验证。

我的 provider.json 文件如下所示（显然已删除凭据）

   {
     "ldap": {
        "provider": "ldap",
        "authScheme":"ldap",
        "module": "passport-ldapauth",
    "authPath": "/auth/ldap",
    "successRedirect": "/auth/account",
    "failureRedirect": "/msad",
    "json":true,
    "failureFlash": false,
    "session": false,
    "setToken":true,
    "LdapAttributeForLogin": "mail",
    "LdapAttributeForUsername": "sAMAccountName",
    "LdapAttributeForMail": "mail",
    "server":{
      "url": "ldaps://servername.domain:636",
      "bindDn": "CN=Username,CN=Users,DC=ad,DC=Customer,DC=org",
      "bindCredentials": "password for bind user",
      "searchBase": "dc=ad,dc=Customer,dc=org",
      "searchAttributes": ["cn", "mail", "givenname"],
      "searchFilter": "(&(mail={{username}}))"
    }
  }
}

我的 server.js 代码如下所示。

'use strict';

var loopback = require('loopback');
var boot = require('loopback-boot');

//required for https config
var https = require('https');
var fs = require('fs');

var app = module.exports = loopback();

//custom addition to see if it works

var graphqlHTTP = require('express-graphql');
var graphqlvar = require('graphql');

var schema =require('./middleware/schema');

// configure view handler
var path = require('path');
app.set('view engine', 'ejs');
app.set('views', path.join(__dirname, 'views'));
app.use(loopback.token());

// Passport configurators..
var loopbackPassport = require('loopback-component-passport');
var PassportConfigurator = loopbackPassport.PassportConfigurator;
var passportConfigurator = new PassportConfigurator(app);

var config = {};
try {
 config = require('./providers.json');
} catch(err) {
 console.error('Please configure your passport strategy in `providers.json`.');
 console.error('Copy `providers.json.template` to `providers.json` and replace the clientID/clientSecret values with your own.');
 process.exit(1);
}
// Initialize passport
passportConfigurator.init(true);
app.use('/graphql', graphqlHTTP({
  schema: schema,
  graphiql: true
}));

//https config

var options = {
    pfx: fs.readFileSync('path to pfx file'),
    passphrase: 'passphrase'
};
var options_ldap = {
    ca: fs.readFileSync('path to cert file')
};




app.start = function() {
    // create ssl server
    var server = null;
    server = https.createServer(options, app);
  // start the web server

  /*return app.listen(function() {
    app.emit('started');
    var baseUrl = app.get('url').replace(/\/$/, '');
    console.log('Web server listening at: %s', baseUrl);
    if (app.get('loopback-component-explorer')) {
      var explorerPath = app.get('loopback-component-explorer').mountPath;
      console.log('Browse your REST API at %s%s', baseUrl, explorerPath);
    }
  });*/
  server.listen(app.get('port'), function() {
    var baseUrl = 'https://' + app.get('host') + ':' + app.get('port');
    //var baseUrl = 'https://' + app.get('host');
    //app.emit('started', baseUrl);
    app.emit('started');
    console.log('Web server listening at: %s', baseUrl);
    console.log('LoopBack server listening @ %s%s', baseUrl, '/');
    if (app.get('loopback-component-explorer')) {
      var explorerPath = app.get('loopback-component-explorer').mountPath;
      console.log('Browse your REST API at %s%s', baseUrl, explorerPath);
    }
  });
  return server;
};

// Bootstrap the application, configure models, datasources and middleware.
// Sub-apps like REST API are mounted via boot scripts.
boot(app, __dirname, function(err) {
  if (err) throw err;

  // start the server if `$ node server.js`
  if (require.main === module)
    app.start();
});

// Set up related models
passportConfigurator.setupModels({
 userModel: app.models.AppUser,
 userIdentityModel: app.models.userIdentity,
 userCredentialModel: app.models.userCredential
});
// Configure passport strategies for third party auth providers
for(var s in config) {
 var c = config[s];
 c.session = c.session !== false;
 /*c.createAccessToken=function(user,cb){
        user.accessTokens.create({
            created: new Date(),
            ttl: ttl
        },cb);
 }*/
//adjust ldap config to add tls options
 if (c.authScheme=="ldap"){
    if (c.server!=null){

     //harcode now and make generic later
     c.server.tlsOptions=options_ldap;
    }
 }
 passportConfigurator.configureProvider(s, c);
}

当我尝试使用 curl 登录 https://server.domain/auth/ldap 时，我收到了身份验证错误。有人可以建议我如何调试此错误。我是否使用了正确的 providers.json 文件？此外，关于 ldap 映射的文档也不清楚 - 有人可以解释这些映射的含义吗？是否有适用于 loopback 3.x 的良好示例/示例应用程序，我可以使用参考来帮助我解决这个问题？

我能够确认 ldapsearch 可以与 providers.json 文件中的 ldap 服务器设置一起正常工作。

Answer 1

您似乎正在尝试使用电子邮件地址（mail 属性）对 AD 进行身份验证。 AD 不允许这样做。您可以使用userPrincipalName，格式为username@domain.com。这可能与电子邮件地址相同，但不一定。否则，你需要使用sAMAccountName，也就是通常所说的“用户名”。

这些是我指的行：

"LdapAttributeForLogin": "mail"

"searchFilter": "(&(mail={{username}}))"

将这两种情况下的mail 替换为userPrincipalName 或sAMAccountName。