Separate ldap boot/parent wrapper logic, move ldap services into docker compose profile, update ldap form logic to use zod

backend/src/db/migrations/20240305165532_ldap-config.ts

@@ -8,7 +8,7 @@ export async function up(knex: Knex): Promise<void> {
     await knex.schema.createTable(TableName.LdapConfig, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.uuid("orgId").notNullable().unique();
-      t.foreign("orgId").references("id").inTable(TableName.Organization);
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
       t.boolean("isActive").notNullable();
       t.string("url").notNullable();
       t.string("encryptedBindDN");

backend/src/db/seed-data.ts

@@ -21,7 +21,7 @@ export let userPublicKey: string | undefined;
 
 export const seedData1 = {
   id: "3dafd81d-4388-432b-a4c5-f735616868c1",
-  username: process.env.TEST_USER_USERNAME || "test@localhost.local",
+  username: process.env.TEST_USER_USERNAME || "test",
   email: process.env.TEST_USER_EMAIL || "[email protected]",
   password: process.env.TEST_USER_PASSWORD || "testInfisical@1",
   organization: {

backend/src/ee/routes/v1/ldap-router.ts

@@ -27,11 +27,27 @@ export const registerLdapRouter = async (server: FastifyZodProvider) => {
   await server.register(passport.initialize());
   await server.register(passport.secureSession());
 
+  const getLdapPassportOpts = (req: FastifyRequest, done: any) => {
+    const { organizationSlug } = req.body as {
+      organizationSlug: string;
+    };
+
+    process.nextTick(async () => {
+      try {
+        const { opts, ldapConfig } = await server.services.ldap.bootLdap(organizationSlug);
+        req.ldapConfig = ldapConfig;
+        done(null, opts);
+      } catch (err) {
+        done(err);
+      }
+    });
+  };
+
   passport.use(
     new LdapStrategy(
-      server.services.ldap.getLdapPassportOpts as any,
+      getLdapPassportOpts as any,
       // eslint-disable-next-line
-        async (req: IncomingMessage, user, cb) => {
+      async (req: IncomingMessage, user, cb) => {
         try {
           const { isUserCompleted, providerAuthToken } = await server.services.ldap.ldapLogin({
             externalId: user.uidNumber,

backend/src/ee/services/ldap-config/ldap-config-service.ts

@@ -1,5 +1,4 @@
 import { ForbiddenError } from "@casl/ability";
-import { FastifyRequest } from "fastify";
 import jwt from "jsonwebtoken";
 
 import { OrgMembershipRole, OrgMembershipStatus, SecretKeyEncoding, TLdapConfigsUpdate } from "@app/db/schemas";
@@ -13,7 +12,6 @@ import {
   infisicalSymmetricEncypt
 } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
-import { logger } from "@app/lib/logger";
 import { TOrgPermission } from "@app/lib/types";
 import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
 import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
@@ -284,54 +282,35 @@ export const ldapConfigServiceFactory = ({
     });
   };
 
-  // eslint-disable-next-line
-  const getLdapPassportOpts = (req: FastifyRequest, done: any) => {
-    const { organizationSlug } = req.body as {
-      organizationSlug: string;
-    };
+  const bootLdap = async (organizationSlug: string) => {
+    const organization = await orgDAL.findOne({ slug: organizationSlug });
+    if (!organization) throw new BadRequestError({ message: "Org not found" });
 
-    const boot = async () => {
-      try {
-        const organization = await orgDAL.findOne({ slug: organizationSlug });
-        if (!organization) throw new BadRequestError({ message: "Org not found" });
-
-        const ldapConfig = await getLdapCfg({
-          orgId: organization.id,
-          isActive: true
-        });
-        req.ldapConfig = ldapConfig;
-
-        const opts = {
-          server: {
-            url: ldapConfig.url,
-            bindDN: ldapConfig.bindDN,
-            bindCredentials: ldapConfig.bindPass,
-            searchBase: ldapConfig.searchBase,
-            searchFilter: "(uid={{username}})",
-            searchAttributes: ["uid", "uidNumber", "givenName", "sn", "mail"],
-            ...(ldapConfig.caCert !== ""
-              ? {
-                  tlsOptions: {
-                    ca: [ldapConfig.caCert]
-                  }
-                }
-              : {})
-          },
-          passReqToCallback: true
-        };
-
-        // eslint-disable-next-line
-          done(null, opts);
-      } catch (err) {
-        logger.error(err);
-        // eslint-disable-next-line
-          done(err);
-      }
-    };
-
-    process.nextTick(async () => {
-      await boot();
+    const ldapConfig = await getLdapCfg({
+      orgId: organization.id,
+      isActive: true
     });
+
+    const opts = {
+      server: {
+        url: ldapConfig.url,
+        bindDN: ldapConfig.bindDN,
+        bindCredentials: ldapConfig.bindPass,
+        searchBase: ldapConfig.searchBase,
+        searchFilter: "(uid={{username}})",
+        searchAttributes: ["uid", "uidNumber", "givenName", "sn", "mail"],
+        ...(ldapConfig.caCert !== ""
+          ? {
+              tlsOptions: {
+                ca: [ldapConfig.caCert]
+              }
+            }
+          : {})
+      },
+      passReqToCallback: true
+    };
+
+    return { opts, ldapConfig };
   };
 
   const ldapLogin = async ({ externalId, username, firstName, lastName, emails, orgId, relayState }: TLdapLoginDTO) => {
@@ -443,7 +422,8 @@ export const ldapConfigServiceFactory = ({
     updateLdapCfg,
     getLdapCfgWithPermissionCheck,
     getLdapCfg,
-    getLdapPassportOpts,
-    ldapLogin
+    // getLdapPassportOpts,
+    ldapLogin,
+    bootLdap
   };
 };