Commit Graph

150 Commits

Author SHA1 Message Date
Ralf Haferkamp
ce663c3a3a fix(graph): treat LDAP attribute names case-insensitive everywhere
There were a couple of places where we were using the case-sensitive
GetAttributeValue method instead of the case-insensitive variant.

Fixes: #10200
2024-10-02 10:48:33 +02:00
Ralf Haferkamp
34cc7b2e56 feat(graph): Add $filter support for lastSuccessfulSignInDateTime
It is now possible to filter users based on the lastSuccessfulSignInDateTime attribute
using query filter like:
 '$filter=signInActivity/lastSuccessfulSignInDateTime le 2021-09-01T00:00:00Z'

Note: This does only work with LDAP servers actually supporting '<=' filters.
The built-in LDAP server (idm) does not support this feature.
2024-09-23 10:49:49 +02:00
Ralf Haferkamp
231128950f feat(graph): expose 'signinactivity' for users 2024-09-23 10:49:49 +02:00
Ralf Haferkamp
724755426e graph: remove some code duplication 2024-09-23 10:49:49 +02:00
Ralf Haferkamp
0bd4b90d7f fix: Make linter happy 2024-09-17 16:02:47 +02:00
Ralf Haferkamp
8e158d52bb graph(oidc): Consume UserSignedIn events in graph service
Pass them to the identity backend to update the last sign-in date of the user.
2024-09-17 16:02:47 +02:00
Jörn Friedrich Dreyer
5ab53b2474 bump reva to 9878984ce702
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2024-09-05 15:03:05 +02:00
Jörn Friedrich Dreyer
a3c7bd3182 bump libre graph api
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2024-08-19 14:20:20 +02:00
Ralf Haferkamp
80e8a2ec1a (fix)graph: Always set UserType in /users responses
LDAP users without a UserType attribute get the UserType "Member"
by default. Federated users get the UserType "Federated".

Related #9702
2024-08-12 12:16:16 +02:00
Christian Richter
b529eb8335 add missing errorcheck
Signed-off-by: Christian Richter <crichter@owncloud.com>
2024-06-24 12:07:26 +02:00
Jörn Friedrich Dreyer
ab338884c6 rudimentary OCM support in graph
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2024-06-24 12:07:21 +02:00
Ralf Haferkamp
eace09ca05 graph: Allow to set the identities property on users
Previously we only allowed setting the "identities" property on education users.
This changes move the related code to the main user object.
2024-05-13 17:22:37 +02:00
Jörn Friedrich Dreyer
e41472234f log and trace fixes
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2024-04-26 17:03:49 +02:00
Thomas Müller
07f0cd5574 fix: typos, naming clashes, error messages and deprecations 2024-04-03 15:34:36 +02:00
Ralf Haferkamp
3d3f8949f5 Bump mockery to 2.40.2
to address issues when building with go1.22:
https://github.com/vektra/mockery/pull/753
2024-02-09 11:48:45 +01:00
Ralf Haferkamp
07860ef8e7 Fix some fallout of recent mockery changes (#8341)
* Fix mockery setup for graph service

Add missing interfaces to .mockery.yaml. Use existing mocks from protogen
where possible. Remove remaining //go:generate call.

* Add mockery config for settings service

* Add mockery config for proxy service
2024-02-01 21:09:01 +01:00
Jörn Friedrich Dreyer
fad94d2038 bump mockery, add test stub for oidc_auth.go, align mock generation (#8321)
* bump mockery, add test stub for oidc_auth.go

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* use .mockery.yaml for all mocks

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* drop legacy go:generate mockery

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

* align mock placement

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

---------

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2024-02-01 10:07:44 +01:00
Ralf Haferkamp
a1ed2ce2e5 graph/groups: Handle quoted search terms in GetGroups
Fixes: #7990
2023-12-21 13:57:26 +01:00
Ralf Haferkamp
8489170715 graph/users: More test coverage for GetUsers search 2023-12-21 13:57:26 +01:00
Juan Pablo Villafáñez
1bcc559ed8 fix: adjust min search length if double quotes are used 2023-12-20 17:24:44 +01:00
Juan Pablo Villafáñez
34bb4f80ed fix: double quotes will be trimmed from the search token 2023-12-20 17:24:44 +01:00
Ralf Haferkamp
1ace257064 graph/groups: Allow unprivileged users to search for groups 2023-12-07 10:21:45 +01:00
Ralf Haferkamp
795989e0aa graph/users: Use a full substring filter of user search
Previously we only did a prefix match.
2023-12-07 10:21:45 +01:00
Florian Schade
ad06a192d8 enhancement: add graph beta listPermissions endpoint (#7753)
* enhancement: add graph beta listPermissions endpoint

besides the new api endpoint it includes several utilities to simplify the graph api development.

* resolve drive and item id from the request path
* generic pointer and value utilities
* space root detection

* update GetDriveAndItemIDParam signature to return a error

* move errorcode package

* enhancement: add generic error code handling

* fix: rebase
2023-11-28 17:06:04 +01:00
Florian Schade
170021a38e chore: go version bump to 1.21 2023-11-23 14:52:01 +01:00
Ralf Haferkamp
6ac5ac534d Update wrapper and mocks for go-ldap 3.4.6 2023-11-22 15:12:39 +01:00
Ralf Haferkamp
c9df9f5f31 graph: Make user and group lookup cache re-usable
drives.go implemented a local user/group cache (ttl based) to speed up repeated
user and group lookups. This commit moves the implementation to the 'identity' module
to make it usable outside of drives.go.
2023-11-08 14:45:44 +01:00
Ralf Haferkamp
f2599dfa76 graph: Make createGroupModelFromCS3() function public
This is useful outside the identity module so make it available
2023-11-08 14:45:44 +01:00
Ralf Haferkamp
4465c9385d graph/education: Fix issues reported by sonarcloud 2023-09-27 15:39:00 +02:00
Ralf Haferkamp
a34d467285 graph/education: slightly improve error handling and logging
- Use var for common errors
- Add the addition error message to the Error() output of errorcode.Error
- in PatchEducationSchool() use errorcode.RenderError() to turn the errorcode
  in to the right HTTP Status (instead of return 500 always)
2023-09-27 15:39:00 +02:00
Ralf Haferkamp
4f59de9c52 graph/education: Check school number for duplicates before adding a school 2023-09-27 15:39:00 +02:00
Ralf Haferkamp
e2849bf19d graph/education: Add getSchoolByNumber helper
Sometimes we explicit need to lookup by number and not numberOrID
2023-09-27 15:39:00 +02:00
Ralf Haferkamp
ce808eaa17 graph/education: Remove unreachable code
An LDAP Modify operation never returns LDAPResultEntryAlreadyExists errors.
That error can only happen for LDAPAdd or LDAPModifyDN.
2023-09-27 15:39:00 +02:00
Ralf Haferkamp
16debe6fa5 graph/education: Use helper for creating attribute list 2023-09-27 15:39:00 +02:00
Ralf Haferkamp
164edd16c0 graph/education: Don't leak LDAP errors into the graph error message 2023-09-27 15:39:00 +02:00
Jörn Friedrich Dreyer
c083f598b7 fix group id claim (#7352)
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
2023-09-26 15:13:15 +02:00
Ralf Haferkamp
ace1d70ba8 Fix wrong log-level for debug output 2023-09-06 08:32:34 +02:00
Ralf Haferkamp
c0181f8144 graph: honor the OCIS_LDAP_GROUP_SCHEMA_MEMBER setting
Fixes: #7032
2023-08-17 11:06:34 +02:00
Ralf Haferkamp
5304184bd6 graph: Add 'terminationDate' property to educationSchool
Schools can now have a terminationDate set. Schools can only be deleted if the
terminationDate is in the past. Schools without a terminationDate cannot be deleted.
2023-07-12 08:48:19 +02:00
Ralf Haferkamp
b74eeed359 ldap: Implement missing methods for 3.4.5 go-ldap in ldap reconnect wrapper 2023-07-11 16:05:32 +02:00
Ralf Haferkamp
c9a9fddef1 Consitently switch to stretchr/testify
We were using stretchr/testify and test-go/testify inconsitently and
sometimes mixed in the same tests. This can cause very strange issue,
e.g when using things like mock.MatchedBy().

This moves all our code to stretchr/testify, which seems to be far
more active and maintained then test-go/testify.
2023-06-29 13:44:49 +02:00
jkoberg
eb9d2bc373 dont connect ldap on startup
Signed-off-by: jkoberg <jkoberg@owncloud.com>
2023-06-21 11:53:52 +02:00
Roman Perekhod
6b3c1327d0 fixed the ability to create a group with an empty name #5050 2023-06-12 09:19:54 +02:00
Florian Schade
4f26424db6 [full-ci] enhancement: use reva client pool selectors (#6452)
* enhancement: use reva client pool selectors

register mock service to registry and pass tests

* enhancement: bump reva

* Fix a couple of linter issues

---------

Co-authored-by: Ralf Haferkamp <rhaferkamp@owncloud.com>
2023-06-08 12:41:04 +02:00
Roman Perekhod
1ac49dfd64 Fix the username validation when an admin update the user 2023-06-06 17:15:38 +02:00
Michael Barz
58d8c1aa8a fix disable users by group 2023-06-02 17:42:51 +02:00
Roman Perekhod
11e51b9812 Omitempty givenName attribute when creating user #5431 2023-05-09 16:40:23 +02:00
Ralf Haferkamp
906189462c graph: Always allow updates to "local" groups when LDAP
When GRAPH_LDAP_SERVER_WRITE_ENABLED=false still allow updates of groups
if a distinct GRAPH_LDAP_GROUP_CREATE_BASE_DN is configured.

Partial-Fix: #6219
2023-05-08 16:17:25 +02:00
Ralf Haferkamp
046895a831 graph: Allow disabling users via groupmember ship on "read-only" server
When GRAPH_LDAP_SERVER_WRITE_ENABLED is set to false we still allow updates
of the accountEnabled property when OCIS_LDAP_DISABLE_USER_MECHANISM is set
to "group"

Partial-Fix: #6219
2023-05-08 16:17:25 +02:00
Ralf Haferkamp
4b501e93a4 graph/users: Avoid to leak LDAP error messages to the client 2023-05-08 16:17:25 +02:00