haraka/haraka-plugin-ldap

'use strict';

const util      = require('util');
const constants = require('haraka-constants');

exports._verify_address = function (uid, address, callback, connection) {
    const pool = connection.server.notes.ldappool;
    const onError = (err) => {
        connection.logerror(`Could not verify address ${address}  for UID ${uid}`)
        connection.logdebug(`${util.inspect(err)}`);
        callback(err, false);
    }

    if (!pool) return onError('LDAP Pool not found!');

    pool.get((err, client) => {
        if (err) return onError(err);

        const config = this._get_search_conf(uid, address, connection);
        connection.logdebug(`Verifying address: ${  util.inspect(config)}`);
        try {
            client.search(config.basedn, config, (search_error, res) => {
                if (search_error) { onError(search_error); }
                let entries = 0;
                res.on('searchEntry', (entry) => {
                    entries++;
                });
                res.on('error', onError);
                res.on('end', () => {
                    callback(null, entries > 0);
                });
            });
        }
        catch (e) {
            return onError(e);
        }
    });
}

exports._get_search_conf = (user, address, connection) => {
    const pool = connection.server.notes.ldappool;
    let filter = pool.config.authz.searchfilter || '(&(objectclass=*)(uid=%u)(mail=%a))';
    filter = filter.replace(/%u/g, user).replace(/%a/g, address);
    return {
        basedn: pool.config.authz.basedn || pool.config.basedn,
        filter,
        scope: pool.config.authz.scope || pool.config.scope,
        attributes: [ 'dn' ]
    };
}

exports.check_authz = function (next, connection, params) {
    if (!connection.notes || !connection.notes.auth_user || !params || !params[0] || !params[0].address) {
        connection.logerror(`${'Ignoring invalid call. Given params are ' +
                            ' connection.notes:'}${util.inspect(connection.notes)
        } and params:${util.inspect(params)}`);
        return next();
    }
    const uid = connection.notes.auth_user;
    const address = params[0].address();
    this._verify_address(uid, address, (err, verified) => {
        if (err) {
            connection.logerror(`Could not use LDAP to match address to uid: ${err.message}`);
            next(constants.denysoft);
        }
        else if (verified) {
            next();
        }
        else {
            next(constants.deny, `User ${  util.inspect(uid)  } not allowed to send from address ${  util.inspect(address)  }.`);
        }
    }, connection);
}