1// Copyright 2021 The Gitea Authors. All rights reserved. 2// Use of this source code is governed by a MIT-style 3// license that can be found in the LICENSE file. 4 5package ldap 6 7import ( 8 "fmt" 9 "strings" 10 11 asymkey_model "code.gitea.io/gitea/models/asymkey" 12 "code.gitea.io/gitea/models/auth" 13 "code.gitea.io/gitea/models/db" 14 user_model "code.gitea.io/gitea/models/user" 15 "code.gitea.io/gitea/services/mailer" 16 user_service "code.gitea.io/gitea/services/user" 17) 18 19// Authenticate queries if login/password is valid against the LDAP directory pool, 20// and create a local user if success when enabled. 21func (source *Source) Authenticate(user *user_model.User, userName, password string) (*user_model.User, error) { 22 loginName := userName 23 if user != nil { 24 loginName = user.LoginName 25 } 26 sr := source.SearchEntry(loginName, password, source.authSource.Type == auth.DLDAP) 27 if sr == nil { 28 // User not in LDAP, do nothing 29 return nil, user_model.ErrUserNotExist{Name: loginName} 30 } 31 32 isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0 33 34 // Update User admin flag if exist 35 if isExist, err := user_model.IsUserExist(0, sr.Username); err != nil { 36 return nil, err 37 } else if isExist { 38 if user == nil { 39 user, err = user_model.GetUserByName(sr.Username) 40 if err != nil { 41 return nil, err 42 } 43 } 44 if user != nil && !user.ProhibitLogin { 45 cols := make([]string, 0) 46 if len(source.AdminFilter) > 0 && user.IsAdmin != sr.IsAdmin { 47 // Change existing admin flag only if AdminFilter option is set 48 user.IsAdmin = sr.IsAdmin 49 cols = append(cols, "is_admin") 50 } 51 if !user.IsAdmin && len(source.RestrictedFilter) > 0 && user.IsRestricted != sr.IsRestricted { 52 // Change existing restricted flag only if RestrictedFilter option is set 53 user.IsRestricted = sr.IsRestricted 54 cols = append(cols, "is_restricted") 55 } 56 if len(cols) > 0 { 57 err = user_model.UpdateUserCols(db.DefaultContext, user, cols...) 58 if err != nil { 59 return nil, err 60 } 61 } 62 } 63 } 64 65 if user != nil { 66 if isAttributeSSHPublicKeySet && asymkey_model.SynchronizePublicKeys(user, source.authSource, sr.SSHPublicKey) { 67 return user, asymkey_model.RewriteAllPublicKeys() 68 } 69 70 return user, nil 71 } 72 73 // Fallback. 74 if len(sr.Username) == 0 { 75 sr.Username = userName 76 } 77 78 if len(sr.Mail) == 0 { 79 sr.Mail = fmt.Sprintf("%s@localhost", sr.Username) 80 } 81 82 user = &user_model.User{ 83 LowerName: strings.ToLower(sr.Username), 84 Name: sr.Username, 85 FullName: composeFullName(sr.Name, sr.Surname, sr.Username), 86 Email: sr.Mail, 87 LoginType: source.authSource.Type, 88 LoginSource: source.authSource.ID, 89 LoginName: userName, 90 IsActive: true, 91 IsAdmin: sr.IsAdmin, 92 IsRestricted: sr.IsRestricted, 93 } 94 95 err := user_model.CreateUser(user) 96 if err != nil { 97 return user, err 98 } 99 100 mailer.SendRegisterNotifyMail(user) 101 102 if isAttributeSSHPublicKeySet && asymkey_model.AddPublicKeysBySource(user, source.authSource, sr.SSHPublicKey) { 103 err = asymkey_model.RewriteAllPublicKeys() 104 } 105 106 if err == nil && len(source.AttributeAvatar) > 0 { 107 _ = user_service.UploadAvatar(user, sr.Avatar) 108 } 109 110 return user, err 111} 112 113// IsSkipLocalTwoFA returns if this source should skip local 2fa for password authentication 114func (source *Source) IsSkipLocalTwoFA() bool { 115 return source.SkipLocalTwoFA 116} 117