using BoardApp.Config;
|
using Novell.Directory.Ldap;
|
|
namespace BoardApp.Services;
|
|
public sealed class LdapAuthService
|
{
|
private readonly BoardConfigLoader _cfg;
|
|
public LdapAuthService(BoardConfigLoader cfg)
|
{
|
_cfg = cfg;
|
}
|
|
public enum LdapVerifyFailReason
|
{
|
InvalidCredentials,
|
UserNotFound,
|
ConnectionError,
|
NotInAllowedGroup
|
}
|
|
public sealed record LdapVerifyResult(bool Ok, LdapVerifyFailReason? Reason);
|
|
private static string EscapeLdapFilterValue(string value)
|
{
|
// RFC4515 subset used by Node implementation.
|
return (value ?? "").Replace(@"\", @"\5c")
|
.Replace("*", @"\2a")
|
.Replace("(", @"\28")
|
.Replace(")", @"\29")
|
.Replace("\0", @"\00");
|
}
|
|
private static LdapConnection CreateConnection(LdapConfig cfg)
|
{
|
var uri = new Uri(cfg.Url);
|
var conn = new LdapConnection { SecureSocketLayer = uri.Scheme.Equals("ldaps", StringComparison.OrdinalIgnoreCase) };
|
conn.Connect(uri.Host, uri.Port > 0 ? uri.Port : (conn.SecureSocketLayer ? 636 : 389));
|
|
if (conn.SecureSocketLayer && cfg.TlsOptions?.RejectUnauthorized == false)
|
{
|
conn.UserDefinedServerCertValidationDelegate += (_, _, _, _) => true;
|
}
|
|
return conn;
|
}
|
|
private static string? SearchUserDn(LdapConnection conn, string searchBase, string filter)
|
{
|
var lc = conn.Search(
|
searchBase,
|
LdapConnection.ScopeSub,
|
filter,
|
new[] { "dn" },
|
false
|
);
|
|
while (lc.HasMore())
|
{
|
try
|
{
|
var entry = lc.Next();
|
return entry.Dn;
|
}
|
catch (LdapException)
|
{
|
return null;
|
}
|
}
|
return null;
|
}
|
|
private static string[] GetAllowedGroupDns(LdapConfig cfg)
|
{
|
var list = new List<string>();
|
if (!string.IsNullOrWhiteSpace(cfg.AllowedGroupDN))
|
{
|
list.Add(cfg.AllowedGroupDN.Trim());
|
}
|
if (cfg.AllowedGroupDNs is not null)
|
{
|
list.AddRange(cfg.AllowedGroupDNs.Where(x => !string.IsNullOrWhiteSpace(x)).Select(x => x.Trim()));
|
}
|
return list.Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
|
}
|
|
private static bool IsMemberOfAllowedGroups(LdapConnection conn, string userDn, string searchBase, string[] allowedGroupDns)
|
{
|
if (allowedGroupDns.Length == 0) return true;
|
|
// Read memberOf from the user entry (fast path).
|
var filter = "(distinguishedName=" + EscapeLdapFilterValue(userDn) + ")";
|
var res = conn.Search(searchBase, LdapConnection.ScopeSub, filter, new[] { "memberOf" }, false);
|
while (res.HasMore())
|
{
|
try
|
{
|
var entry = res.Next();
|
var memberOf = entry.GetAttribute("memberOf")?.StringValueArray ?? Array.Empty<string>();
|
foreach (var g in memberOf)
|
{
|
if (allowedGroupDns.Any(agd => string.Equals(agd, g, StringComparison.OrdinalIgnoreCase)))
|
{
|
return true;
|
}
|
}
|
return false;
|
}
|
catch (LdapException)
|
{
|
return false;
|
}
|
}
|
|
// If user entry not found or no memberOf, treat as not allowed when restriction exists.
|
return false;
|
}
|
|
public async Task<LdapVerifyResult> VerifyCredentials(string username, string password)
|
{
|
var user = (username ?? "").Trim();
|
if (user.Length == 0 || string.IsNullOrEmpty(password))
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.InvalidCredentials);
|
}
|
|
var cfg = _cfg.LoadLdapConfig();
|
var filter = (cfg.SearchFilter ?? "").Replace("{{username}}", EscapeLdapFilterValue(user));
|
var allowedGroupDns = GetAllowedGroupDns(cfg);
|
|
return await Task.Run(() =>
|
{
|
try
|
{
|
using var searchConn = CreateConnection(cfg);
|
searchConn.Bind(cfg.BindDN, cfg.BindPassword);
|
|
var userDn = SearchUserDn(searchConn, cfg.SearchBase, filter);
|
if (string.IsNullOrWhiteSpace(userDn))
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.UserNotFound);
|
}
|
if (!IsMemberOfAllowedGroups(searchConn, userDn, cfg.SearchBase, allowedGroupDns))
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.NotInAllowedGroup);
|
}
|
|
using var verifyConn = CreateConnection(cfg);
|
try
|
{
|
verifyConn.Bind(userDn, password);
|
return new LdapVerifyResult(true, null);
|
}
|
catch
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.InvalidCredentials);
|
}
|
}
|
catch
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.ConnectionError);
|
}
|
});
|
}
|
|
/// <summary>
|
/// 用于 Windows 集成登录：不验证密码，只校验“用户是否存在 + 是否属于允许组（若配置）”。
|
/// </summary>
|
public async Task<LdapVerifyResult> VerifyUserForIntegratedLogin(string username)
|
{
|
var user = (username ?? "").Trim();
|
if (user.Length == 0)
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.InvalidCredentials);
|
}
|
|
var cfg = _cfg.LoadLdapConfig();
|
var filter = (cfg.SearchFilter ?? "").Replace("{{username}}", EscapeLdapFilterValue(user));
|
var allowedGroupDns = GetAllowedGroupDns(cfg);
|
|
return await Task.Run(() =>
|
{
|
try
|
{
|
using var searchConn = CreateConnection(cfg);
|
searchConn.Bind(cfg.BindDN, cfg.BindPassword);
|
var userDn = SearchUserDn(searchConn, cfg.SearchBase, filter);
|
if (string.IsNullOrWhiteSpace(userDn))
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.UserNotFound);
|
}
|
if (!IsMemberOfAllowedGroups(searchConn, userDn, cfg.SearchBase, allowedGroupDns))
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.NotInAllowedGroup);
|
}
|
return new LdapVerifyResult(true, null);
|
}
|
catch
|
{
|
return new LdapVerifyResult(false, LdapVerifyFailReason.ConnectionError);
|
}
|
});
|
}
|
}
|
|
