node-expose-sspi-strict
Version:
Expose the Microsoft Windows SSPI interface in order to do NTLM and Kerberos authentication.
195 lines (194 loc) • 10.1 kB
JavaScript
"use strict";
var __assign = (this && this.__assign) || function () {
__assign = Object.assign || function(t) {
for (var s, i = 1, n = arguments.length; i < n; i++) {
s = arguments[i];
for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
t[p] = s[p];
}
return t;
};
return __assign.apply(this, arguments);
};
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var __generator = (this && this.__generator) || function (thisArg, body) {
var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
function verb(n) { return function (v) { return step([n, v]); }; }
function step(op) {
if (f) throw new TypeError("Generator is already executing.");
while (_) try {
if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
if (y = 0, t) op = [op[0] & 2, t.value];
switch (op[0]) {
case 0: case 1: t = op; break;
case 4: _.label++; return { value: op[1], done: false };
case 5: _.label++; y = op[1]; op = [0]; continue;
case 7: op = _.ops.pop(); _.trys.pop(); continue;
default:
if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
if (t[2]) _.ops.pop();
_.trys.pop(); continue;
}
op = body.call(thisArg, _);
} catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
}
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
exports.__esModule = true;
exports.SSO = void 0;
var api_1 = require("../../lib/api");
var userdb_1 = require("./userdb");
var debug_1 = __importDefault(require("debug"));
var _1 = require(".");
var os = __importStar(require("os"));
var debug = debug_1["default"]('node-expose-sspi:SSO');
var SSO = /** @class */ (function () {
function SSO(serverContextHandle, method) {
this.serverContextHandle = serverContextHandle;
this.method = method;
this.options = {
useActiveDirectory: true,
useGroups: true,
useOwner: true,
groupFilterRegex: '.*'
};
}
SSO.prototype.load = function () {
return __awaiter(this, void 0, void 0, function () {
var names, _a, domain, name, userToken, groups, sid, adUser, e_1, owner, processToken, ownerGroups, o;
return __generator(this, function (_b) {
switch (_b.label) {
case 0:
names = api_1.sspi.QueryContextAttributes(this.serverContextHandle, 'SECPKG_ATTR_NAMES');
_a = names.sUserName.split('\\'), domain = _a[0], name = _a[1];
this.user = { domain: domain, name: name };
// impersonate to retrieve the userToken.
api_1.sspi.ImpersonateSecurityContext(this.serverContextHandle);
debug('impersonate security context ok');
userToken = api_1.sspi.OpenThreadToken();
debug('userToken: ', userToken);
try {
this.user.displayName = api_1.sspi.GetUserNameEx('NameDisplay');
}
catch (e) {
// exemple of error scenario: local user without displayname.
this.user.displayName = this.user.name;
}
api_1.sspi.RevertSecurityContext(this.serverContextHandle);
if (this.options.useGroups) {
groups = api_1.sspi.GetTokenInformation({
accessToken: userToken,
tokenInformationClass: 'TokenGroups',
filter: this.options.groupFilterRegex
});
groups.sort();
debug('groups: ', groups);
this.user.groups = groups;
}
// free the userToken
api_1.sspi.CloseHandle(userToken);
sid = api_1.sspi.LookupAccountName(names.sUserName).sid;
this.user.sid = sid;
_b.label = 1;
case 1:
_b.trys.push([1, 4, , 5]);
if (!(_1.sso.isOnDomain() &&
_1.sso.isActiveDirectoryReachable() &&
os.hostname() !== domain &&
this.options.useActiveDirectory)) return [3 /*break*/, 3];
return [4 /*yield*/, userdb_1.getUser("(sAMAccountName=" + name + ")")];
case 2:
adUser = _b.sent();
this.user.adUser = adUser;
_b.label = 3;
case 3: return [3 /*break*/, 5];
case 4:
e_1 = _b.sent();
debug('cannot getUser from AD. e: ', e_1);
return [3 /*break*/, 5];
case 5:
// owner info.
if (this.options.useOwner) {
owner = api_1.sspi.GetUserName();
debug('owner: ', owner);
this.owner = { name: owner };
try {
this.owner.displayName = api_1.sspi.GetUserNameEx('NameDisplay');
}
catch (e) {
// exemple of error scenario: local user without displayname.
this.owner.displayName = this.owner.name;
}
if (this.options.useGroups) {
processToken = api_1.sspi.OpenProcessToken([
'TOKEN_QUERY',
'TOKEN_QUERY_SOURCE',
]);
ownerGroups = api_1.sspi.GetTokenInformation({
accessToken: processToken,
tokenInformationClass: 'TokenGroups',
filter: this.options.groupFilterRegex
});
ownerGroups.sort();
debug('ownerGroups: ', ownerGroups);
this.owner.groups = ownerGroups;
api_1.sspi.CloseHandle(processToken);
}
try {
o = api_1.sspi.LookupAccountName(owner);
this.owner.sid = o.sid;
this.owner.domain = o.domain;
}
catch (e) { }
}
return [2 /*return*/];
}
});
});
};
SSO.prototype.getJSON = function () {
var json = __assign({}, this);
delete json.options;
delete json.serverContextHandle;
return json;
};
SSO.prototype.setOptions = function (options) {
Object.assign(this.options, options);
};
return SSO;
}());
exports.SSO = SSO;