mirror of
https://git.unistra.fr/aius/root/ldap-overleaf-sl.git
synced 2024-10-05 23:23:59 +02:00
sym
GitHub
commit
989a1bb236
131
README.md
131
README.md
@ -8,8 +8,8 @@ The inital idea for this implementation was taken from
|
||||
[worksasintended](https://github.com/worksasintended).
|
||||
|
||||
## BREAKING CHANGE
|
||||
be careful if you try to migrate from 3.3.2! Backup your machines and data.
|
||||
The migration paths should be:
|
||||
|
||||
Be careful if you try to migrate from 3.3.2! Backup your machines and data. The migration paths should be:
|
||||
- Backup your machines and data
|
||||
- Run latest 3.5 sharelatex image, make sure that you have enough free space and run the migration scripts:
|
||||
- (Details see https://github.com/overleaf/overleaf/wiki/Full-Project-History-Migration)
|
||||
@ -21,23 +21,31 @@ The migration paths should be:
|
||||
```
|
||||
- run this sharelatex image (4.1.1)
|
||||
|
||||
Be careful if you try to migrate from 3.3.2! Backup your machines and data. The migration paths should be:
|
||||
|
||||
- Backup Your machines and data
|
||||
- Run latest 3.5 sharelatex image and run the migration scripts
|
||||
- Run this sharelatex image (4.1.1) and run the migrations scripts
|
||||
|
||||
## Limitations
|
||||
|
||||
## Limitations:
|
||||
NEW: This version provides the possibility to use a separate ldap bind user. It does this just to find the proper BIND DN and record for the provided email, so it is possible that users from different groups / OUs can login.
|
||||
Afterwards it tries to bind to the ldap (using ldapts) with the user DN and credentials of the user which tries to login. No hassle of password hashing for LDAP pwds!
|
||||
|
||||
If you upgrade from an older commit:
|
||||
|
||||
**Note**:
|
||||
|
||||
- you have to add: uid=%u to your BIND_DN
|
||||
- LDAP_GROUP_FILTER is now named LDAP_USER_FILTER
|
||||
- Import of contacts from LDAP is now controlled by LDAP_CONTACT_FILTER
|
||||
|
||||
|
||||
Only valid LDAP users or email users registered by an admin can login.
|
||||
This module authenticates against the local DB if `ALLOW_EMAIL_LOGIN` is set to `true` if this fails
|
||||
it tries to authenticate against the specified LDAP server.
|
||||
|
||||
*Note:*
|
||||
**Note**:
|
||||
|
||||
- LDAP Users can not change their password for the ldap username login. They have to change it at the ldap server.
|
||||
- LDAP Users can reset their local db password. Then they can decide if they login with either their ldap user and password or with their email and local db password.
|
||||
- Users can not change their email. The email address is taken from the ldap server (mail) field. (or by invitation through an admin).
|
||||
@ -46,8 +54,7 @@ it tries to authenticate against the specified LDAP server.
|
||||
- Admins can invite non ldap users directly (via email). Additionally (``link sharing`` of projects is possible).
|
||||
|
||||
*Important:*
|
||||
Sharelatex/Overleaf uses the email address to identify users: If you change the email in the LDAP you have to update the corresponding field
|
||||
in the mongo db.
|
||||
Sharelatex/Overleaf uses the email address to identify users: If you change the email in the LDAP/OAuth you have to update the corresponding field in the mongo db.
|
||||
|
||||
```
|
||||
docker exec -it mongo /bin/bash
|
||||
@ -88,13 +95,10 @@ ADMIN_IS_SYSADMIN=false
|
||||
*COLLAB_TEXT* : displayed for email invitation (share.pug)<br/>
|
||||
*ADMIN_IS_SYSADMIN* : false or true (if ``false`` isAdmin group is allowed to add users to sharelatex and post messages. if ``true`` isAdmin group is allowed to logout other users / set maintenance mode)
|
||||
|
||||
|
||||
### LDAP Configuration
|
||||
|
||||
Edit [docker-compose.treafik.yml](docker-compose.traefik.yml) or [docker-compose.certbot.yml](docker-compose.certbot.yml) to fit your local setup.
|
||||
|
||||
|
||||
|
||||
```
|
||||
LDAP_SERVER: ldaps://LDAPSERVER:636
|
||||
LDAP_BASE: dc=DOMAIN,dc=TLD
|
||||
@ -128,17 +132,90 @@ LDAP_CONTACTS: 'false'
|
||||
If you enable LDAP_CONTACTS, then all users in LDAP_CONTACT_FILTER are loaded from the ldap server into the contacts.
|
||||
At the moment this happens every time you click on "Share" within a project.
|
||||
if you want to enable this function set:
|
||||
|
||||
```
|
||||
LDAP_CONTACT_FILTER: (objectClass=person)
|
||||
LDAP_CONTACTS: 'true'
|
||||
```
|
||||
|
||||
### OAuth2 Configuration
|
||||
|
||||
```
|
||||
# Enable OAuth2
|
||||
OAUTH2_ENABLED: "true"
|
||||
|
||||
# Provider name, optional
|
||||
OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
|
||||
|
||||
# OAuth2 client configuration,
|
||||
OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
|
||||
OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
|
||||
# Scope should at least include email
|
||||
OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
|
||||
|
||||
# OAuth2 APIs
|
||||
# Redirect to OAuth 2.0 url
|
||||
OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
|
||||
# Fetch access token api endpoint
|
||||
OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
|
||||
# Content type of token request
|
||||
# One of ["application/x-www-form-urlencoded", "application/json"]
|
||||
# Default "application/x-www-form-urlencoded"
|
||||
OAUTH2_TOKEN_CONTENT_TYPE: "application/x-www-form-urlencoded"
|
||||
# Fetch user profile api endpoint
|
||||
OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
|
||||
|
||||
# OAuth2 user attributes
|
||||
# User identity
|
||||
OAUTH2_USER_ATTR_EMAIL: email
|
||||
# User attributes, only used on the first login
|
||||
OAUTH2_USER_ATTR_UID: id
|
||||
OAUTH2_USER_ATTR_FIRSTNAME: name
|
||||
OAUTH2_USER_ATTR_LASTNAME:
|
||||
OAUTH2_USER_ATTR_IS_ADMIN: site_admin
|
||||
```
|
||||
|
||||
Example configuration for GitHub:
|
||||
|
||||
```
|
||||
OAUTH2_ENABLED: "true"
|
||||
OAUTH2_PROVIDER: GitHub
|
||||
OAUTH2_CLIENT_ID: YOUR_CLIENT_ID
|
||||
OAUTH2_CLIENT_SECRET: YOUR_CLIENT_SECRET
|
||||
OAUTH2_SCOPE: # the 'public' scope is sufficient for our needs, so we do not request any more
|
||||
OAUTH2_AUTHORIZATION_URL: https://github.com/login/oauth/authorize
|
||||
OAUTH2_TOKEN_URL: https://github.com/login/oauth/access_token
|
||||
OAUTH2_PROFILE_URL: https://api.github.com/user
|
||||
OAUTH2_USER_ATTR_EMAIL: email
|
||||
OAUTH2_USER_ATTR_UID: id
|
||||
OAUTH2_USER_ATTR_FIRSTNAME: name
|
||||
OAUTH2_USER_ATTR_LASTNAME:
|
||||
OAUTH2_USER_ATTR_IS_ADMIN: site_admin
|
||||
```
|
||||
|
||||
Example configuration for Authentik:
|
||||
|
||||
```
|
||||
OAUTH2_ENABLED: "true"
|
||||
OAUTH2_PROVIDER: GitHub
|
||||
OAUTH2_CLIENT_ID: "redacted"
|
||||
OAUTH2_CLIENT_SECRET: "redacted"
|
||||
OAUTH2_AUTHORIZATION_URL: https://auth.redacted.domain/application/o/authorize/
|
||||
OAUTH2_TOKEN_URL: https://auth.redacted.domain/application/o/token/
|
||||
OAUTH2_PROFILE_URL: https://auth.redacted.domain/application/o/userinfo/
|
||||
OAUTH2_USER_ATTR_EMAIL: email
|
||||
OAUTH2_USER_ATTR_UID: "email"
|
||||
OAUTH2_USER_ATTR_FIRSTNAME: name
|
||||
# To make it work one should create a custom scope first
|
||||
OAUTH2_USER_ATTR_IS_ADMIN: is_admin
|
||||
```
|
||||
|
||||
### Sharelatex Configuration
|
||||
|
||||
Edit SHARELATEX_ environment variables in [docker-compose.traefik.yml](docker-compose.traefik.yml) or [docker-compose.certbot.yml](docker-compose.certbot.yml) to fit your local setup
|
||||
(e.g. proper SMTP server, Header, Footer, App Name,...). See https://github.com/overleaf/overleaf/wiki/Quick-Start-Guide for more details.
|
||||
|
||||
## Installation, Usage and Inital startup
|
||||
## Installation, Usage and Initial startup
|
||||
|
||||
Install the docker engine: https://docs.docker.com/engine/install/
|
||||
|
||||
@ -150,40 +227,62 @@ Install docker-compose:
|
||||
pip install docker-compose
|
||||
```
|
||||
|
||||
use the command:
|
||||
|
||||
use the command
|
||||
```
|
||||
make
|
||||
```
|
||||
|
||||
to generate the ldap-overleaf-sl docker image.
|
||||
|
||||
use the command
|
||||
use the command:
|
||||
|
||||
```
|
||||
docker network create web
|
||||
```
|
||||
|
||||
to create a network for the docker instances.
|
||||
|
||||
### Startup
|
||||
|
||||
## Startup
|
||||
#### Using without proxy
|
||||
|
||||
In most cases, you should use a gateway reverse proxy for your requests (see the next section), as they can offer many benefits such as enhanced security and easier SSL certificate updates. This simple startup method is used for 1. Development 2. When you know what you're doing, for example, when there is an additional gateway layer outside your server.
|
||||
|
||||
Start docker containers:
|
||||
|
||||
```
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
#### Using proxy
|
||||
|
||||
There are 2 different ways of starting either using Traefik or using Certbot. Adapt the one you want to use.
|
||||
|
||||
### Using Traefik
|
||||
##### Using Traefik
|
||||
|
||||
Then start docker containers (with loadbalancer):
|
||||
|
||||
```
|
||||
export NUMINSTANCES=1
|
||||
docker-compose -f docker-compose.traefik.yml up -d --scale sharelatex=$NUMINSTANCES
|
||||
```
|
||||
|
||||
### Using Certbot
|
||||
##### Using Certbot
|
||||
|
||||
Enable line 65/66 and 69/70 in ldapoverleaf-sl/Dockerfile and ``make`` again.
|
||||
|
||||
```
|
||||
docker-compose -f docker-compose.certbot.yml up -d
|
||||
```
|
||||
|
||||
## Debug
|
||||
|
||||
1. Set the env variable `LOG_LEVEL` to `debug` (default is info - you can do this in the docker-compose file)
|
||||
2. Check the logs in ShareLaTeX, particularly at `/var/log/sharelatex/web.log`. You can do this by using the command: `docker exec ldap-overleaf-sl cat /var/log/sharelatex/web.log`.
|
||||
|
||||
## Upgrading
|
||||
|
||||
*Be aware:* if you upgrade from a previous installation check your docker image version
|
||||
|
||||
E.g.: Mongodb: You cannot upgrade directly from mongo 4.2 to 5.0. You must first upgrade from 4.2 to 4.4.
|
||||
|
||||
@ -81,6 +81,22 @@ services:
|
||||
LDAP_CONTACT_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
|
||||
LDAP_CONTACTS: "false"
|
||||
|
||||
## OAuth2 Settings
|
||||
# OAUTH2_ENABLED: "true"
|
||||
# OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
|
||||
# OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
|
||||
# OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
|
||||
# OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
|
||||
# OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
|
||||
# OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
|
||||
# OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
|
||||
# OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
|
||||
# OAUTH2_USER_ATTR_EMAIL: email
|
||||
# OAUTH2_USER_ATTR_UID: id
|
||||
# OAUTH2_USER_ATTR_FIRSTNAME: name
|
||||
# OAUTH2_USER_ATTR_LASTNAME:
|
||||
# OAUTH2_USER_ATTR_IS_ADMIN: site_admin
|
||||
|
||||
# Same property, unfortunately with different names in
|
||||
# different locations
|
||||
SHARELATEX_REDIS_HOST: redis
|
||||
|
||||
@ -162,6 +162,22 @@ services:
|
||||
LDAP_CONTACT_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
|
||||
LDAP_CONTACTS: "false"
|
||||
|
||||
## OAuth2 Settings
|
||||
# OAUTH2_ENABLED: "true"
|
||||
# OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
|
||||
# OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
|
||||
# OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
|
||||
# OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
|
||||
# OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
|
||||
# OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
|
||||
# OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
|
||||
# OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
|
||||
# OAUTH2_USER_ATTR_EMAIL: email
|
||||
# OAUTH2_USER_ATTR_UID: id
|
||||
# OAUTH2_USER_ATTR_FIRSTNAME: name
|
||||
# OAUTH2_USER_ATTR_LASTNAME:
|
||||
# OAUTH2_USER_ATTR_IS_ADMIN: site_admin
|
||||
|
||||
# Same property, unfortunately with different names in
|
||||
# different locations
|
||||
SHARELATEX_REDIS_HOST: redis
|
||||
|
||||
153
docker-compose.yml
Normal file
153
docker-compose.yml
Normal file
@ -0,0 +1,153 @@
|
||||
version: "2.2"
|
||||
services:
|
||||
sharelatex:
|
||||
restart: always
|
||||
image: ldap-overleaf-sl
|
||||
container_name: ldap-overleaf-sl
|
||||
depends_on:
|
||||
mongo:
|
||||
condition: service_healthy
|
||||
redis:
|
||||
condition: service_healthy
|
||||
privileged: false
|
||||
ports:
|
||||
- 80:80
|
||||
links:
|
||||
- mongo
|
||||
- redis
|
||||
volumes:
|
||||
- ${MYDATA}/sharelatex:/var/lib/sharelatex
|
||||
- ${MYDATA}/letsencrypt:/etc/letsencrypt
|
||||
- ${MYDATA}/letsencrypt/live/${MYDOMAIN}/:/etc/letsencrypt/certs/domain
|
||||
environment:
|
||||
SHARELATEX_APP_NAME: Overleaf
|
||||
SHARELATEX_MONGO_URL: mongodb://mongo/sharelatex
|
||||
SHARELATEX_SITE_URL: https://${MYDOMAIN}
|
||||
SHARELATEX_NAV_TITLE: Overleaf - run by ${MYDOMAIN}
|
||||
#SHARELATEX_HEADER_IMAGE_URL: https://${MYDOMAIN}/logo.svg
|
||||
SHARELATEX_ADMIN_EMAIL: ${MYMAIL}
|
||||
SHARELATEX_LEFT_FOOTER: '[{"text": "Powered by <a href=\"https://www.sharelatex.com\">ShareLaTeX</a> 2016"} ]'
|
||||
SHARELATEX_RIGHT_FOOTER: '[{"text": "LDAP Overleaf (beta)"} ]'
|
||||
SHARELATEX_EMAIL_FROM_ADDRESS: "noreply@${MYDOMAIN}"
|
||||
# SHARELATEX_EMAIL_AWS_SES_ACCESS_KEY_ID:
|
||||
# SHARELATEX_EMAIL_AWS_SES_SECRET_KEY:
|
||||
SHARELATEX_EMAIL_SMTP_HOST: smtp.${MYDOMAIN}
|
||||
SHARELATEX_EMAIL_SMTP_PORT: 587
|
||||
SHARELATEX_EMAIL_SMTP_SECURE: "false"
|
||||
# SHARELATEX_EMAIL_SMTP_USER:
|
||||
# SHARELATEX_EMAIL_SMTP_PASS:
|
||||
# SHARELATEX_EMAIL_SMTP_TLS_REJECT_UNAUTH: true
|
||||
# SHARELATEX_EMAIL_SMTP_IGNORE_TLS: false
|
||||
SHARELATEX_CUSTOM_EMAIL_FOOTER: "This system is run by ${MYDOMAIN} - please contact ${MYMAIL} if you experience any issues."
|
||||
|
||||
# make public links accessible w/o login (link sharing issue)
|
||||
# https://github.com/overleaf/docker-image/issues/66
|
||||
# https://github.com/overleaf/overleaf/issues/628
|
||||
# https://github.com/overleaf/web/issues/367
|
||||
# Fixed in 2.0.2 (Release date: 2019-11-26)
|
||||
SHARELATEX_ALLOW_PUBLIC_ACCESS: "true"
|
||||
SHARELATEX_ALLOW_ANONYMOUS_READ_AND_WRITE_SHARING: "true"
|
||||
|
||||
# Uncomment the following line to enable secure cookies if you are using SSL
|
||||
# SHARELATEX_SECURE_COOKIE: "true"
|
||||
# SHARELATEX_BEHIND_PROXY: "true"
|
||||
|
||||
LDAP_SERVER: ldaps://LDAPSERVER:636
|
||||
LDAP_BASE: ou=people,dc=DOMAIN,dc=TLD
|
||||
|
||||
### There are to ways get users from the ldap server
|
||||
|
||||
## NO LDAP BIND USER:
|
||||
# Tries directly to bind with the login user (as uid)
|
||||
# LDAP_BINDDN: uid=%u,ou=someunit,ou=people,dc=DOMAIN,dc=TLD
|
||||
|
||||
## Or you can use ai global LDAP_BIND_USER
|
||||
# LDAP_BIND_USER:
|
||||
# LDAP_BIND_PW:
|
||||
|
||||
# Only allow users matching LDAP_USER_FILTER
|
||||
LDAP_USER_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
|
||||
|
||||
# If user is in ADMIN_GROUP on user creation (first login) isAdmin is set to true.
|
||||
# Admin Users can invite external (non ldap) users. This feature makes only sense
|
||||
# when ALLOW_EMAIL_LOGIN is set to 'true'. Additionally admins can send
|
||||
# system wide messages.
|
||||
LDAP_ADMIN_GROUP_FILTER: "(memberof=cn=ADMINGROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
|
||||
ALLOW_EMAIL_LOGIN: "true"
|
||||
|
||||
# All users in the LDAP_CONTACT_FILTER are loaded from the ldap server into contacts.
|
||||
LDAP_CONTACT_FILTER: "(memberof=cn=GROUPNAME,ou=groups,dc=DOMAIN,dc=TLD)"
|
||||
LDAP_CONTACTS: "false"
|
||||
|
||||
## OAuth2 Settings
|
||||
# OAUTH2_ENABLED: "true"
|
||||
# OAUTH2_PROVIDER: YOUR_OAUTH2_PROVIDER
|
||||
# OAUTH2_CLIENT_ID: YOUR_OAUTH2_CLIENT_ID
|
||||
# OAUTH2_CLIENT_SECRET: YOUR_OAUTH2_CLIENT_SECRET
|
||||
# OAUTH2_SCOPE: YOUR_OAUTH2_SCOPE
|
||||
# OAUTH2_AUTHORIZATION_URL: YOUR_OAUTH2_AUTHORIZATION_URL
|
||||
# OAUTH2_TOKEN_URL: YOUR_OAUTH2_TOKEN_URL
|
||||
# OAUTH2_TOKEN_CONTENT_TYPE: # One of ['application/x-www-form-urlencoded', 'application/json']
|
||||
# OAUTH2_PROFILE_URL: YOUR_OAUTH2_PROFILE_URL
|
||||
# OAUTH2_USER_ATTR_EMAIL: email
|
||||
# OAUTH2_USER_ATTR_UID: id
|
||||
# OAUTH2_USER_ATTR_FIRSTNAME: name
|
||||
# OAUTH2_USER_ATTR_LASTNAME:
|
||||
# OAUTH2_USER_ATTR_IS_ADMIN: site_admin
|
||||
|
||||
# Same property, unfortunately with different names in
|
||||
# different locations
|
||||
SHARELATEX_REDIS_HOST: redis
|
||||
REDIS_HOST: redis
|
||||
REDIS_PORT: 6379
|
||||
|
||||
ENABLED_LINKED_FILE_TYPES: "url,project_file"
|
||||
|
||||
# Enables Thumbnail generation using ImageMagick
|
||||
ENABLE_CONVERSIONS: "true"
|
||||
|
||||
mongo:
|
||||
restart: always
|
||||
image: mongo:4.4
|
||||
container_name: mongo
|
||||
expose:
|
||||
- 27017
|
||||
volumes:
|
||||
- ${MYDATA}/mongo_data:/data/db
|
||||
healthcheck:
|
||||
test: echo 'db.stats().ok' | mongo localhost:27017/test --quiet
|
||||
interval: 10s
|
||||
timeout: 10s
|
||||
retries: 5
|
||||
command: "--replSet overleaf"
|
||||
|
||||
# See also: https://github.com/overleaf/overleaf/issues/1120
|
||||
mongoinit:
|
||||
image: mongo:4.4
|
||||
# this container will exit after executing the command
|
||||
restart: "no"
|
||||
depends_on:
|
||||
mongo:
|
||||
condition: service_healthy
|
||||
entrypoint:
|
||||
[
|
||||
"mongo",
|
||||
"--host",
|
||||
"mongo:27017",
|
||||
"--eval",
|
||||
'rs.initiate({ _id: "overleaf", members: [ { _id: 0, host: "mongo:27017" } ] })',
|
||||
]
|
||||
|
||||
redis:
|
||||
restart: always
|
||||
image: redis:6.2
|
||||
container_name: redis
|
||||
expose:
|
||||
- 6379
|
||||
volumes:
|
||||
- ${MYDATA}/redis_data:/data
|
||||
healthcheck:
|
||||
test: ["CMD", "redis-cli", "ping"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
@ -13,19 +13,7 @@ ARG admin_is_sysadmin
|
||||
# set workdir (might solve issue #2 - see https://stackoverflow.com/questions/57534295/)
|
||||
WORKDIR /overleaf/services/web
|
||||
|
||||
# overwrite some files
|
||||
COPY sharelatex/AuthenticationManager.js /overleaf/services/web/app/src/Features/Authentication/
|
||||
COPY sharelatex/ContactController.js /overleaf/services/web/app/src/Features/Contacts/
|
||||
|
||||
# Too much changes to do inline (>10 Lines).
|
||||
COPY sharelatex/settings.pug /overleaf/services/web/app/views/user/
|
||||
COPY sharelatex/navbar.pug /overleaf/services/web/app/views/layout/
|
||||
|
||||
# Non LDAP User Registration for Admins
|
||||
COPY sharelatex/admin-index.pug /overleaf/services/web/app/views/admin/index.pug
|
||||
COPY sharelatex/admin-sysadmin.pug /tmp/admin-sysadmin.pug
|
||||
|
||||
# install latest npm
|
||||
# install latest npm
|
||||
RUN npm install -g npm && \
|
||||
## clean cache (might solve issue #2)
|
||||
# npm cache clean --force && \
|
||||
@ -37,12 +25,27 @@ RUN npm install -g npm && \
|
||||
apt-get update && \
|
||||
apt-get -y install python-pygments && \
|
||||
apt-get -y install texlive texlive-lang-german texlive-latex-extra texlive-full texlive-science && \
|
||||
## instead of copying the login.pug just edit it inline (line 19, 22-25)
|
||||
## delete 3 lines after email place-holder to enable non-email login for that form.
|
||||
sed -iE '/type=.*email.*/d' /overleaf/services/web/app/views/user/login.pug && \
|
||||
apt-get clean && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# overwrite some files
|
||||
COPY sharelatex/AuthenticationManager.js /overleaf/services/web/app/src/Features/Authentication/
|
||||
COPY sharelatex/AuthenticationController.js /overleaf/services/web/app/src/Features/Authentication/
|
||||
COPY sharelatex/ContactController.js /overleaf/services/web/app/src/Features/Contacts/
|
||||
COPY sharelatex/router.js /overleaf/services/web/app/src/router.js
|
||||
|
||||
# Too much changes to do inline (>10 Lines).
|
||||
COPY sharelatex/settings.pug /overleaf/services/web/app/views/user/
|
||||
COPY sharelatex/login.pug /overleaf/services/web/app/views/user/
|
||||
COPY sharelatex/navbar.pug /overleaf/services/web/app/views/layout/
|
||||
|
||||
# Non LDAP User Registration for Admins
|
||||
COPY sharelatex/admin-index.pug /overleaf/services/web/app/views/admin/index.pug
|
||||
COPY sharelatex/admin-sysadmin.pug /tmp/admin-sysadmin.pug
|
||||
|
||||
## comment out this line to prevent sed accidently remove the brackets of the email(username) field
|
||||
# sed -iE '/email@example.com/{n;N;N;d}' /overleaf/services/web/app/views/user/login.pug && \
|
||||
sed -iE "s/email@example.com/${login_text:-user}/g" /overleaf/services/web/app/views/user/login.pug && \
|
||||
RUN sed -iE "s/email@example.com/${login_text:-user}/g" /overleaf/services/web/app/views/user/login.pug && \
|
||||
## Collaboration settings display (share project placeholder) | edit line 146
|
||||
## share.pug file was removed in later versions
|
||||
# sed -iE "s%placeholder=.*$%placeholder=\"${collab_text}\"%g" /overleaf/services/web/app/views/project/editor/share.pug && \
|
||||
@ -57,9 +60,8 @@ RUN npm install -g npm && \
|
||||
rm /overleaf/services/web/modules/user-activate/app/views/user/register.pug && \
|
||||
### To remove comments entirly (bug https://github.com/overleaf/overleaf/issues/678)
|
||||
rm /overleaf/services/web/app/views/project/editor/review-panel.pug && \
|
||||
touch /overleaf/services/web/app/views/project/editor/review-panel.pug && \
|
||||
apt-get clean && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
touch /overleaf/services/web/app/views/project/editor/review-panel.pug
|
||||
|
||||
|
||||
### Nginx and Certificates
|
||||
# enable https via letsencrypt
|
||||
|
||||
741
ldap-overleaf-sl/sharelatex/AuthenticationController.js
Normal file
741
ldap-overleaf-sl/sharelatex/AuthenticationController.js
Normal file
@ -0,0 +1,741 @@
|
||||
/**
|
||||
* >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
* Modified from 1e4dcc8
|
||||
* <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||||
*/
|
||||
|
||||
const AuthenticationManager = require('./AuthenticationManager')
|
||||
const SessionManager = require('./SessionManager')
|
||||
const OError = require('@overleaf/o-error')
|
||||
const LoginRateLimiter = require('../Security/LoginRateLimiter')
|
||||
const UserUpdater = require('../User/UserUpdater')
|
||||
const Metrics = require('@overleaf/metrics')
|
||||
const logger = require('@overleaf/logger')
|
||||
const querystring = require('querystring')
|
||||
const Settings = require('@overleaf/settings')
|
||||
const basicAuth = require('basic-auth')
|
||||
const tsscmp = require('tsscmp')
|
||||
const UserHandler = require('../User/UserHandler')
|
||||
const UserSessionsManager = require('../User/UserSessionsManager')
|
||||
const SessionStoreManager = require('../../infrastructure/SessionStoreManager')
|
||||
const Analytics = require('../Analytics/AnalyticsManager')
|
||||
const passport = require('passport')
|
||||
const NotificationsBuilder = require('../Notifications/NotificationsBuilder')
|
||||
const UrlHelper = require('../Helpers/UrlHelper')
|
||||
const AsyncFormHelper = require('../Helpers/AsyncFormHelper')
|
||||
const _ = require('lodash')
|
||||
const UserAuditLogHandler = require('../User/UserAuditLogHandler')
|
||||
const AnalyticsRegistrationSourceHelper = require('../Analytics/AnalyticsRegistrationSourceHelper')
|
||||
const {
|
||||
acceptsJson,
|
||||
} = require('../../infrastructure/RequestContentTypeDetection')
|
||||
const { ParallelLoginError } = require('./AuthenticationErrors')
|
||||
const { hasAdminAccess } = require('../Helpers/AdminAuthorizationHelper')
|
||||
const Modules = require('../../infrastructure/Modules')
|
||||
|
||||
function send401WithChallenge(res) {
|
||||
res.setHeader('WWW-Authenticate', 'OverleafLogin')
|
||||
res.sendStatus(401)
|
||||
}
|
||||
|
||||
function checkCredentials(userDetailsMap, user, password) {
|
||||
const expectedPassword = userDetailsMap.get(user)
|
||||
const userExists = userDetailsMap.has(user) && expectedPassword // user exists with a non-null password
|
||||
const isValid = userExists && tsscmp(expectedPassword, password)
|
||||
if (!isValid) {
|
||||
logger.err({ user }, 'invalid login details')
|
||||
}
|
||||
Metrics.inc('security.http-auth.check-credentials', 1, {
|
||||
path: userExists ? 'known-user' : 'unknown-user',
|
||||
status: isValid ? 'pass' : 'fail',
|
||||
})
|
||||
return isValid
|
||||
}
|
||||
|
||||
const AuthenticationController = {
|
||||
serializeUser(user, callback) {
|
||||
if (!user._id || !user.email) {
|
||||
const err = new Error('serializeUser called with non-user object')
|
||||
logger.warn({ user }, err.message)
|
||||
return callback(err)
|
||||
}
|
||||
const lightUser = {
|
||||
_id: user._id,
|
||||
first_name: user.first_name,
|
||||
last_name: user.last_name,
|
||||
isAdmin: user.isAdmin,
|
||||
staffAccess: user.staffAccess,
|
||||
email: user.email,
|
||||
referal_id: user.referal_id,
|
||||
session_created: new Date().toISOString(),
|
||||
ip_address: user._login_req_ip,
|
||||
must_reconfirm: user.must_reconfirm,
|
||||
v1_id: user.overleaf != null ? user.overleaf.id : undefined,
|
||||
analyticsId: user.analyticsId || user._id,
|
||||
alphaProgram: user.alphaProgram || undefined, // only store if set
|
||||
betaProgram: user.betaProgram || undefined, // only store if set
|
||||
}
|
||||
callback(null, lightUser)
|
||||
},
|
||||
|
||||
deserializeUser(user, cb) {
|
||||
cb(null, user)
|
||||
},
|
||||
|
||||
passportLogin(req, res, next) {
|
||||
// This function is middleware which wraps the passport.authenticate middleware,
|
||||
// so we can send back our custom `{message: {text: "", type: ""}}` responses on failure,
|
||||
// and send a `{redir: ""}` response on success
|
||||
passport.authenticate('local', function (err, user, info) {
|
||||
if (err) {
|
||||
return next(err)
|
||||
}
|
||||
if (user) {
|
||||
// `user` is either a user object or false
|
||||
AuthenticationController.setAuditInfo(req, { method: 'Password login' })
|
||||
return AuthenticationController.finishLogin(user, req, res, next)
|
||||
} else {
|
||||
if (info.redir != null) {
|
||||
return res.json({ redir: info.redir })
|
||||
} else {
|
||||
res.status(info.status || 200)
|
||||
delete info.status
|
||||
const body = { message: info }
|
||||
const { errorReason } = info
|
||||
if (errorReason) {
|
||||
body.errorReason = errorReason
|
||||
delete info.errorReason
|
||||
}
|
||||
return res.json(body)
|
||||
}
|
||||
}
|
||||
})(req, res, next)
|
||||
},
|
||||
|
||||
finishLogin(user, req, res, next) {
|
||||
if (user === false) {
|
||||
return AsyncFormHelper.redirect(req, res, '/login')
|
||||
} // OAuth2 'state' mismatch
|
||||
|
||||
if (Settings.adminOnlyLogin && !hasAdminAccess(user)) {
|
||||
return res.status(403).json({
|
||||
message: { type: 'error', text: 'Admin only panel' },
|
||||
})
|
||||
}
|
||||
|
||||
const auditInfo = AuthenticationController.getAuditInfo(req)
|
||||
|
||||
const anonymousAnalyticsId = req.session.analyticsId
|
||||
const isNewUser = req.session.justRegistered || false
|
||||
|
||||
Modules.hooks.fire(
|
||||
'preFinishLogin',
|
||||
req,
|
||||
res,
|
||||
user,
|
||||
function (error, results) {
|
||||
if (error) {
|
||||
return next(error)
|
||||
}
|
||||
if (results.some(result => result && result.doNotFinish)) {
|
||||
return
|
||||
}
|
||||
|
||||
if (user.must_reconfirm) {
|
||||
return AuthenticationController._redirectToReconfirmPage(
|
||||
req,
|
||||
res,
|
||||
user
|
||||
)
|
||||
}
|
||||
|
||||
const redir =
|
||||
AuthenticationController._getRedirectFromSession(req) || '/project'
|
||||
_loginAsyncHandlers(req, user, anonymousAnalyticsId, isNewUser)
|
||||
const userId = user._id
|
||||
UserAuditLogHandler.addEntry(
|
||||
userId,
|
||||
'login',
|
||||
userId,
|
||||
req.ip,
|
||||
auditInfo,
|
||||
err => {
|
||||
if (err) {
|
||||
return next(err)
|
||||
}
|
||||
_afterLoginSessionSetup(req, user, function (err) {
|
||||
if (err) {
|
||||
return next(err)
|
||||
}
|
||||
AuthenticationController._clearRedirectFromSession(req)
|
||||
AnalyticsRegistrationSourceHelper.clearSource(req.session)
|
||||
AnalyticsRegistrationSourceHelper.clearInbound(req.session)
|
||||
AsyncFormHelper.redirect(req, res, redir)
|
||||
})
|
||||
}
|
||||
)
|
||||
}
|
||||
)
|
||||
},
|
||||
|
||||
doPassportLogin(req, username, password, done) {
|
||||
const email = username.toLowerCase()
|
||||
Modules.hooks.fire(
|
||||
'preDoPassportLogin',
|
||||
req,
|
||||
email,
|
||||
function (err, infoList) {
|
||||
if (err) {
|
||||
return done(err)
|
||||
}
|
||||
const info = infoList.find(i => i != null)
|
||||
if (info != null) {
|
||||
return done(null, false, info)
|
||||
}
|
||||
LoginRateLimiter.processLoginRequest(email, function (err, isAllowed) {
|
||||
if (err) {
|
||||
return done(err)
|
||||
}
|
||||
if (!isAllowed) {
|
||||
logger.debug({ email }, 'too many login requests')
|
||||
return done(null, null, {
|
||||
text: req.i18n.translate('to_many_login_requests_2_mins'),
|
||||
type: 'error',
|
||||
status: 429,
|
||||
})
|
||||
}
|
||||
const auditLog = {
|
||||
ipAddress: req.ip,
|
||||
info: { method: 'Password login' },
|
||||
}
|
||||
AuthenticationManager.authenticate(
|
||||
{ email },
|
||||
password,
|
||||
auditLog,
|
||||
function (error, user) {
|
||||
if (error != null) {
|
||||
if (error instanceof ParallelLoginError) {
|
||||
return done(null, false, { status: 429 })
|
||||
}
|
||||
return done(error)
|
||||
}
|
||||
if (
|
||||
user &&
|
||||
AuthenticationController.captchaRequiredForLogin(req, user)
|
||||
) {
|
||||
done(null, false, {
|
||||
text: req.i18n.translate('cannot_verify_user_not_robot'),
|
||||
type: 'error',
|
||||
errorReason: 'cannot_verify_user_not_robot',
|
||||
status: 400,
|
||||
})
|
||||
} else if (user) {
|
||||
// async actions
|
||||
done(null, user)
|
||||
} else {
|
||||
AuthenticationController._recordFailedLogin()
|
||||
logger.debug({ email }, 'failed log in')
|
||||
done(null, false, {
|
||||
text: req.i18n.translate('email_or_password_wrong_try_again'),
|
||||
type: 'error',
|
||||
status: 401,
|
||||
})
|
||||
}
|
||||
}
|
||||
)
|
||||
})
|
||||
}
|
||||
)
|
||||
},
|
||||
|
||||
captchaRequiredForLogin(req, user) {
|
||||
switch (AuthenticationController.getAuditInfo(req).captcha) {
|
||||
case 'disabled':
|
||||
return false
|
||||
case 'solved':
|
||||
return false
|
||||
case 'skipped': {
|
||||
let required = false
|
||||
if (user.lastFailedLogin) {
|
||||
const requireCaptchaUntil =
|
||||
user.lastFailedLogin.getTime() +
|
||||
Settings.elevateAccountSecurityAfterFailedLogin
|
||||
required = requireCaptchaUntil >= Date.now()
|
||||
}
|
||||
Metrics.inc('force_captcha_on_login', 1, {
|
||||
status: required ? 'yes' : 'no',
|
||||
})
|
||||
return required
|
||||
}
|
||||
default:
|
||||
throw new Error('captcha middleware missing in handler chain')
|
||||
}
|
||||
},
|
||||
|
||||
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
oauth2Redirect(req, res, next) {
|
||||
// random state
|
||||
const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
|
||||
const state = new Array(6).fill(0).map(() => characters.charAt(Math.floor(Math.random() * characters.length))).join("")
|
||||
req.session.oauth2State = state
|
||||
|
||||
const redirectURI = encodeURIComponent(`${process.env.SHARELATEX_SITE_URL}/oauth/callback`)
|
||||
const authURL = (
|
||||
process.env.OAUTH2_AUTHORIZATION_URL
|
||||
+ `?response_type=code`
|
||||
+ `&client_id=${process.env.OAUTH2_CLIENT_ID}`
|
||||
+ `&redirect_uri=${redirectURI}`
|
||||
+ `&scope=${process.env.OAUTH2_SCOPE ?? ""} `
|
||||
+ `&state=${state}`
|
||||
)
|
||||
res.redirect(authURL)
|
||||
},
|
||||
|
||||
async oauth2Callback(req, res, next) {
|
||||
console.log(`OAuth, receive code ${req.query.code} and state ${req.query.state}`)
|
||||
const saveState = req.session.oauth2State
|
||||
delete req.session.oauth2State
|
||||
if (saveState !== req.query.state) {
|
||||
return AuthenticationController.finishLogin(false, req, res, next)
|
||||
}
|
||||
|
||||
try {
|
||||
const contentType = process.env.OAUTH2_TOKEN_CONTENT_TYPE || 'application/x-www-form-urlencoded'
|
||||
const bodyParams = {
|
||||
grant_type: "authorization_code",
|
||||
client_id: process.env.OAUTH2_CLIENT_ID,
|
||||
client_secret: process.env.OAUTH2_CLIENT_SECRET,
|
||||
code: req.query.code,
|
||||
redirect_uri: `${process.env.SHARELATEX_SITE_URL}/oauth/callback`,
|
||||
}
|
||||
const body = contentType === 'application/json'
|
||||
? JSON.stringify(bodyParams)
|
||||
: new URLSearchParams(bodyParams).toString()
|
||||
|
||||
const tokenResponse = await fetch(process.env.OAUTH2_TOKEN_URL, {
|
||||
method: 'POST',
|
||||
headers: {
|
||||
"Accept": "application/json",
|
||||
"Content-Type": contentType,
|
||||
},
|
||||
body
|
||||
})
|
||||
|
||||
const tokenData = await tokenResponse.json()
|
||||
console.log("OAuth2 respond", JSON.stringify(tokenData))
|
||||
|
||||
const profileResponse = await fetch(process.env.OAUTH2_PROFILE_URL, {
|
||||
method: 'GET',
|
||||
headers: {
|
||||
"Accept": "application/json",
|
||||
"Authorization": `Bearer ${tokenData.access_token}`,
|
||||
}
|
||||
});
|
||||
const profile = await profileResponse.json()
|
||||
console.log("OAuth2 user profile", JSON.stringify(profile))
|
||||
|
||||
const email = profile[process.env.OAUTH2_USER_ATTR_EMAIL ?? "email"]
|
||||
const uid = profile[process.env.OAUTH2_USER_ATTR_UID ?? "uid"]
|
||||
const firstname = profile?.[process.env.OAUTH2_USER_ATTR_FIRSTNAME] ?? email
|
||||
const lastname = process.env.OAUTH2_USER_ATTR_LASTNAME
|
||||
? profile?.[process.env.OAUTH2_USER_ATTR_LASTNAME] ?? ""
|
||||
: ""
|
||||
const isAdmin = process.env.OAUTH2_USER_ATTR_IS_ADMIN
|
||||
? !!profile?.[process.env.OAUTH2_USER_ATTR_IS_ADMIN] ?? false
|
||||
: false
|
||||
|
||||
const query = { email }
|
||||
const callback = (error, user) => {
|
||||
if (error) {
|
||||
res.json({message: error});
|
||||
} else {
|
||||
console.log("OAuth user", JSON.stringify(user));
|
||||
AuthenticationController.finishLogin(user, req, res, next);
|
||||
}
|
||||
}
|
||||
AuthenticationManager.createIfNotFoundAndLogin(
|
||||
query,
|
||||
callback,
|
||||
uid,
|
||||
firstname,
|
||||
lastname,
|
||||
email,
|
||||
isAdmin
|
||||
)
|
||||
} catch(e) {
|
||||
res.redirect("/login")
|
||||
console.error("Fails to access by OAuth2: " + String(e))
|
||||
}
|
||||
},
|
||||
// <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||||
|
||||
ipMatchCheck(req, user) {
|
||||
if (req.ip !== user.lastLoginIp) {
|
||||
NotificationsBuilder.ipMatcherAffiliation(user._id).create(
|
||||
req.ip,
|
||||
() => {}
|
||||
)
|
||||
}
|
||||
return UserUpdater.updateUser(
|
||||
user._id.toString(),
|
||||
{
|
||||
$set: { lastLoginIp: req.ip },
|
||||
},
|
||||
() => {}
|
||||
)
|
||||
},
|
||||
|
||||
requireLogin() {
|
||||
const doRequest = function (req, res, next) {
|
||||
if (next == null) {
|
||||
next = function () {}
|
||||
}
|
||||
if (!SessionManager.isUserLoggedIn(req.session)) {
|
||||
if (acceptsJson(req)) return send401WithChallenge(res)
|
||||
return AuthenticationController._redirectToLoginOrRegisterPage(req, res)
|
||||
} else {
|
||||
req.user = SessionManager.getSessionUser(req.session)
|
||||
return next()
|
||||
}
|
||||
}
|
||||
|
||||
return doRequest
|
||||
},
|
||||
|
||||
requireOauth() {
|
||||
// require this here because module may not be included in some versions
|
||||
const Oauth2Server = require('../../../../modules/oauth2-server/app/src/Oauth2Server')
|
||||
return function (req, res, next) {
|
||||
if (next == null) {
|
||||
next = function () {}
|
||||
}
|
||||
const request = new Oauth2Server.Request(req)
|
||||
const response = new Oauth2Server.Response(res)
|
||||
return Oauth2Server.server.authenticate(
|
||||
request,
|
||||
response,
|
||||
{},
|
||||
function (err, token) {
|
||||
if (err) {
|
||||
// use a 401 status code for malformed header for git-bridge
|
||||
if (
|
||||
err.code === 400 &&
|
||||
err.message === 'Invalid request: malformed authorization header'
|
||||
) {
|
||||
err.code = 401
|
||||
}
|
||||
// send all other errors
|
||||
return res
|
||||
.status(err.code)
|
||||
.json({ error: err.name, error_description: err.message })
|
||||
}
|
||||
req.oauth = { access_token: token.accessToken }
|
||||
req.oauth_token = token
|
||||
req.oauth_user = token.user
|
||||
return next()
|
||||
}
|
||||
)
|
||||
}
|
||||
},
|
||||
|
||||
validateUserSession: function () {
|
||||
// Middleware to check that the user's session is still good on key actions,
|
||||
// such as opening a a project. Could be used to check that session has not
|
||||
// exceeded a maximum lifetime (req.session.session_created), or for session
|
||||
// hijacking checks (e.g. change of ip address, req.session.ip_address). For
|
||||
// now, just check that the session has been loaded from the session store
|
||||
// correctly.
|
||||
return function (req, res, next) {
|
||||
// check that the session store is returning valid results
|
||||
if (req.session && !SessionStoreManager.hasValidationToken(req)) {
|
||||
// force user to update session
|
||||
req.session.regenerate(() => {
|
||||
// need to destroy the existing session and generate a new one
|
||||
// otherwise they will already be logged in when they are redirected
|
||||
// to the login page
|
||||
if (acceptsJson(req)) return send401WithChallenge(res)
|
||||
AuthenticationController._redirectToLoginOrRegisterPage(req, res)
|
||||
})
|
||||
} else {
|
||||
next()
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
_globalLoginWhitelist: [],
|
||||
addEndpointToLoginWhitelist(endpoint) {
|
||||
return AuthenticationController._globalLoginWhitelist.push(endpoint)
|
||||
},
|
||||
|
||||
requireGlobalLogin(req, res, next) {
|
||||
if (
|
||||
AuthenticationController._globalLoginWhitelist.includes(
|
||||
req._parsedUrl.pathname
|
||||
)
|
||||
) {
|
||||
return next()
|
||||
}
|
||||
|
||||
if (req.headers.authorization != null) {
|
||||
AuthenticationController.requirePrivateApiAuth()(req, res, next)
|
||||
} else if (SessionManager.isUserLoggedIn(req.session)) {
|
||||
next()
|
||||
} else {
|
||||
logger.debug(
|
||||
{ url: req.url },
|
||||
'user trying to access endpoint not in global whitelist'
|
||||
)
|
||||
if (acceptsJson(req)) return send401WithChallenge(res)
|
||||
AuthenticationController.setRedirectInSession(req)
|
||||
res.redirect('/login')
|
||||
}
|
||||
},
|
||||
|
||||
validateAdmin(req, res, next) {
|
||||
const adminDomains = Settings.adminDomains
|
||||
if (
|
||||
!adminDomains ||
|
||||
!(Array.isArray(adminDomains) && adminDomains.length)
|
||||
) {
|
||||
return next()
|
||||
}
|
||||
const user = SessionManager.getSessionUser(req.session)
|
||||
if (!hasAdminAccess(user)) {
|
||||
return next()
|
||||
}
|
||||
const email = user.email
|
||||
if (email == null) {
|
||||
return next(
|
||||
new OError('[ValidateAdmin] Admin user without email address', {
|
||||
userId: user._id,
|
||||
})
|
||||
)
|
||||
}
|
||||
if (!adminDomains.find(domain => email.endsWith(`@${domain}`))) {
|
||||
return next(
|
||||
new OError('[ValidateAdmin] Admin user with invalid email domain', {
|
||||
email,
|
||||
userId: user._id,
|
||||
})
|
||||
)
|
||||
}
|
||||
return next()
|
||||
},
|
||||
|
||||
checkCredentials,
|
||||
|
||||
requireBasicAuth: function (userDetails) {
|
||||
const userDetailsMap = new Map(Object.entries(userDetails))
|
||||
return function (req, res, next) {
|
||||
const credentials = basicAuth(req)
|
||||
if (
|
||||
!credentials ||
|
||||
!checkCredentials(userDetailsMap, credentials.name, credentials.pass)
|
||||
) {
|
||||
send401WithChallenge(res)
|
||||
Metrics.inc('security.http-auth', 1, { status: 'reject' })
|
||||
} else {
|
||||
Metrics.inc('security.http-auth', 1, { status: 'accept' })
|
||||
next()
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
requirePrivateApiAuth() {
|
||||
return AuthenticationController.requireBasicAuth(Settings.httpAuthUsers)
|
||||
},
|
||||
|
||||
setAuditInfo(req, info) {
|
||||
if (!req.__authAuditInfo) {
|
||||
req.__authAuditInfo = {}
|
||||
}
|
||||
Object.assign(req.__authAuditInfo, info)
|
||||
},
|
||||
|
||||
getAuditInfo(req) {
|
||||
return req.__authAuditInfo || {}
|
||||
},
|
||||
|
||||
setRedirectInSession(req, value) {
|
||||
if (value == null) {
|
||||
value =
|
||||
Object.keys(req.query).length > 0
|
||||
? `${req.path}?${querystring.stringify(req.query)}`
|
||||
: `${req.path}`
|
||||
}
|
||||
if (
|
||||
req.session != null &&
|
||||
!/^\/(socket.io|js|stylesheets|img)\/.*$/.test(value) &&
|
||||
!/^.*\.(png|jpeg|svg)$/.test(value)
|
||||
) {
|
||||
const safePath = UrlHelper.getSafeRedirectPath(value)
|
||||
return (req.session.postLoginRedirect = safePath)
|
||||
}
|
||||
},
|
||||
|
||||
_redirectToLoginOrRegisterPage(req, res) {
|
||||
if (
|
||||
req.query.zipUrl != null ||
|
||||
req.query.project_name != null ||
|
||||
req.path === '/user/subscription/new'
|
||||
) {
|
||||
AuthenticationController._redirectToRegisterPage(req, res)
|
||||
} else {
|
||||
AuthenticationController._redirectToLoginPage(req, res)
|
||||
}
|
||||
},
|
||||
|
||||
_redirectToLoginPage(req, res) {
|
||||
logger.debug(
|
||||
{ url: req.url },
|
||||
'user not logged in so redirecting to login page'
|
||||
)
|
||||
AuthenticationController.setRedirectInSession(req)
|
||||
const url = `/login?${querystring.stringify(req.query)}`
|
||||
res.redirect(url)
|
||||
Metrics.inc('security.login-redirect')
|
||||
},
|
||||
|
||||
_redirectToReconfirmPage(req, res, user) {
|
||||
logger.debug(
|
||||
{ url: req.url },
|
||||
'user needs to reconfirm so redirecting to reconfirm page'
|
||||
)
|
||||
req.session.reconfirm_email = user != null ? user.email : undefined
|
||||
const redir = '/user/reconfirm'
|
||||
AsyncFormHelper.redirect(req, res, redir)
|
||||
},
|
||||
|
||||
_redirectToRegisterPage(req, res) {
|
||||
logger.debug(
|
||||
{ url: req.url },
|
||||
'user not logged in so redirecting to register page'
|
||||
)
|
||||
AuthenticationController.setRedirectInSession(req)
|
||||
const url = `/register?${querystring.stringify(req.query)}`
|
||||
res.redirect(url)
|
||||
Metrics.inc('security.login-redirect')
|
||||
},
|
||||
|
||||
_recordSuccessfulLogin(userId, callback) {
|
||||
if (callback == null) {
|
||||
callback = function () {}
|
||||
}
|
||||
UserUpdater.updateUser(
|
||||
userId.toString(),
|
||||
{
|
||||
$set: { lastLoggedIn: new Date() },
|
||||
$inc: { loginCount: 1 },
|
||||
},
|
||||
function (error) {
|
||||
if (error != null) {
|
||||
callback(error)
|
||||
}
|
||||
Metrics.inc('user.login.success')
|
||||
callback()
|
||||
}
|
||||
)
|
||||
},
|
||||
|
||||
_recordFailedLogin(callback) {
|
||||
Metrics.inc('user.login.failed')
|
||||
if (callback) callback()
|
||||
},
|
||||
|
||||
_getRedirectFromSession(req) {
|
||||
let safePath
|
||||
const value = _.get(req, ['session', 'postLoginRedirect'])
|
||||
if (value) {
|
||||
safePath = UrlHelper.getSafeRedirectPath(value)
|
||||
}
|
||||
return safePath || null
|
||||
},
|
||||
|
||||
_clearRedirectFromSession(req) {
|
||||
if (req.session != null) {
|
||||
delete req.session.postLoginRedirect
|
||||
}
|
||||
},
|
||||
}
|
||||
|
||||
function _afterLoginSessionSetup(req, user, callback) {
|
||||
if (callback == null) {
|
||||
callback = function () {}
|
||||
}
|
||||
req.login(user, function (err) {
|
||||
if (err) {
|
||||
OError.tag(err, 'error from req.login', {
|
||||
user_id: user._id,
|
||||
})
|
||||
return callback(err)
|
||||
}
|
||||
// Regenerate the session to get a new sessionID (cookie value) to
|
||||
// protect against session fixation attacks
|
||||
const oldSession = req.session
|
||||
req.session.destroy(function (err) {
|
||||
if (err) {
|
||||
OError.tag(err, 'error when trying to destroy old session', {
|
||||
user_id: user._id,
|
||||
})
|
||||
return callback(err)
|
||||
}
|
||||
req.sessionStore.generate(req)
|
||||
// Note: the validation token is not writable, so it does not get
|
||||
// transferred to the new session below.
|
||||
for (const key in oldSession) {
|
||||
const value = oldSession[key]
|
||||
if (key !== '__tmp' && key !== 'csrfSecret') {
|
||||
req.session[key] = value
|
||||
}
|
||||
}
|
||||
req.session.save(function (err) {
|
||||
if (err) {
|
||||
OError.tag(err, 'error saving regenerated session after login', {
|
||||
user_id: user._id,
|
||||
})
|
||||
return callback(err)
|
||||
}
|
||||
UserSessionsManager.trackSession(user, req.sessionID, function () {})
|
||||
if (!req.deviceHistory) {
|
||||
// Captcha disabled or SSO-based login.
|
||||
return callback()
|
||||
}
|
||||
req.deviceHistory.add(user.email)
|
||||
req.deviceHistory
|
||||
.serialize(req.res)
|
||||
.catch(err => {
|
||||
logger.err({ err }, 'cannot serialize deviceHistory')
|
||||
})
|
||||
.finally(() => callback())
|
||||
})
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
function _loginAsyncHandlers(req, user, anonymousAnalyticsId, isNewUser) {
|
||||
UserHandler.setupLoginData(user, err => {
|
||||
if (err != null) {
|
||||
logger.warn({ err }, 'error setting up login data')
|
||||
}
|
||||
})
|
||||
LoginRateLimiter.recordSuccessfulLogin(user.email, () => {})
|
||||
AuthenticationController._recordSuccessfulLogin(user._id, () => {})
|
||||
AuthenticationController.ipMatchCheck(req, user)
|
||||
Analytics.recordEventForUser(user._id, 'user-logged-in', {
|
||||
source: req.session.saml
|
||||
? 'saml'
|
||||
: req.user_info?.auth_provider || 'email-password',
|
||||
})
|
||||
Analytics.identifyUser(user._id, anonymousAnalyticsId, isNewUser)
|
||||
|
||||
logger.debug(
|
||||
{ email: user.email, userId: user._id.toString() },
|
||||
'successful log in'
|
||||
)
|
||||
|
||||
req.session.justLoggedIn = true
|
||||
// capture the request ip for use when creating the session
|
||||
return (user._login_req_ip = req.ip)
|
||||
}
|
||||
|
||||
module.exports = AuthenticationController
|
||||
@ -184,6 +184,33 @@ const AuthenticationManager = {
|
||||
callback(null, user, true)
|
||||
},
|
||||
|
||||
createIfNotFoundAndLogin(
|
||||
query,
|
||||
callback,
|
||||
uid,
|
||||
firstname,
|
||||
lastname,
|
||||
mail,
|
||||
isAdmin
|
||||
) {
|
||||
User.findOne(query, (error, user) => {
|
||||
if (error) {
|
||||
console.log(error)
|
||||
}
|
||||
|
||||
AuthenticationManager.createIfNotExistAndLogin(
|
||||
query,
|
||||
user,
|
||||
callback,
|
||||
uid,
|
||||
firstname,
|
||||
lastname,
|
||||
mail,
|
||||
isAdmin
|
||||
)
|
||||
})
|
||||
},
|
||||
|
||||
createIfNotExistAndLogin(
|
||||
query,
|
||||
user,
|
||||
@ -195,10 +222,9 @@ const AuthenticationManager = {
|
||||
isAdmin
|
||||
) {
|
||||
if (!user) {
|
||||
//console.log('Creating User:' + JSON.stringify(query))
|
||||
//create random pass for local userdb, does not get checked for ldap users during login
|
||||
let pass = require("crypto").randomBytes(32).toString("hex")
|
||||
//console.log('Creating User:' + JSON.stringify(query) + 'Random Pass' + pass)
|
||||
const pass = require("crypto").randomBytes(32).toString("hex")
|
||||
console.log('Creating User', { mail, uid, firstname, lastname, isAdmin, pass })
|
||||
|
||||
const userRegHand = require("../User/UserRegistrationHandler.js")
|
||||
userRegHand.registerNewUser(
|
||||
@ -228,6 +254,7 @@ const AuthenticationManager = {
|
||||
}
|
||||
) // end register user
|
||||
} else {
|
||||
console.log('User exists', { mail })
|
||||
AuthenticationManager.login(user, "randomPass", callback)
|
||||
}
|
||||
},
|
||||
|
||||
54
ldap-overleaf-sl/sharelatex/login.pug
Normal file
54
ldap-overleaf-sl/sharelatex/login.pug
Normal file
@ -0,0 +1,54 @@
|
||||
//- >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
//- Modified from ee00ff3
|
||||
//- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||||
|
||||
extends ../layout-marketing
|
||||
|
||||
block content
|
||||
main.content.content-alt#main-content
|
||||
.container
|
||||
.row
|
||||
.col-md-6.col-md-offset-3.col-lg-4.col-lg-offset-4
|
||||
.card
|
||||
.page-header
|
||||
h1 #{translate("log_in")}
|
||||
form(data-ol-async-form, name="loginForm", action='/login', method="POST")
|
||||
input(name='_csrf', type='hidden', value=csrfToken)
|
||||
+formMessages()
|
||||
.form-group
|
||||
//- >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
//- input.form-control(
|
||||
//- type='email',
|
||||
//- name='email',
|
||||
//- required,
|
||||
//- placeholder='email@example.com',
|
||||
//- autofocus="true"
|
||||
//- )
|
||||
input.form-control(
|
||||
name='email',
|
||||
required,
|
||||
placeholder='email@example.com',
|
||||
autofocus="true"
|
||||
)
|
||||
//- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||||
.form-group
|
||||
input.form-control(
|
||||
type='password',
|
||||
name='password',
|
||||
required,
|
||||
placeholder='********',
|
||||
)
|
||||
.actions
|
||||
button.btn-primary.btn(
|
||||
type='submit',
|
||||
data-ol-disabled-inflight
|
||||
)
|
||||
span(data-ol-inflight="idle") #{translate("login")}
|
||||
span(hidden data-ol-inflight="pending") #{translate("logging_in")}…
|
||||
a.pull-right(href='/user/password/reset') #{translate("forgot_your_password")}?
|
||||
//- >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
|
||||
if process.env.OAUTH2_ENABLED === 'true'
|
||||
.form-group.text-center(style="padding-top: 10px")
|
||||
a.btn-block.login-btn(href="/oauth/redirect" style='padding-left: 0px')
|
||||
| Log in via #{process.env.OAUTH2_PROVIDER || 'OAuth'}
|
||||
//- <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
|
||||
1380
ldap-overleaf-sl/sharelatex/router.js
Normal file
1380
ldap-overleaf-sl/sharelatex/router.js
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user