Skip to content

Commit 123f0ae

Browse files
zeripathtechknowlogick
zeripath
and
techknowlogick
authored
Allow LDAP Sources to provide Avatars (#16851)
* Allow LDAP Sources to provide Avatars Add setting to LDAP source to allow it to provide an Avatar. Currently this is required to point to the image bytes. Fix #4144 Signed-off-by: Andrew Thornton <art27@cantab.net> * Rename as Avatar Attribute (drop JPEG) Signed-off-by: Andrew Thornton <art27@cantab.net> * Always synchronize avatar if there is change Signed-off-by: Andrew Thornton <art27@cantab.net> * Actually get the avatar from the ldap Signed-off-by: Andrew Thornton <art27@cantab.net> * clean-up Signed-off-by: Andrew Thornton <art27@cantab.net> * use len()>0 rather than != "" Signed-off-by: Andrew Thornton <art27@cantab.net> * slight shortcut in IsUploadAvatarChanged Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
1 parent 7e98cd5 commit 123f0ae

File tree

13 files changed

+80
-6
lines changed

13 files changed

+80
-6
lines changed

Diff for: ‎cmd/admin_auth_ldap.go

+7
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ var (
9393
Name: "skip-local-2fa",
9494
Usage: "Set to true to skip local 2fa for users authenticated by this source",
9595
},
96+
cli.StringFlag{
97+
Name: "avatar-attribute",
98+
Usage: "The attribute of the user’s LDAP record containing the user’s avatar.",
99+
},
96100
}
97101

98102
ldapBindDnCLIFlags = append(commonLdapCLIFlags,
@@ -234,6 +238,9 @@ func parseLdapConfig(c *cli.Context, config *ldap.Source) error {
234238
if c.IsSet("public-ssh-key-attribute") {
235239
config.AttributeSSHPublicKey = c.String("public-ssh-key-attribute")
236240
}
241+
if c.IsSet("avatar-attribute") {
242+
config.AttributeAvatar = c.String("avatar-attribute")
243+
}
237244
if c.IsSet("page-size") {
238245
config.SearchPageSize = uint32(c.Uint("page-size"))
239246
}

Diff for: ‎cmd/admin_auth_ldap_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ func TestAddLdapBindDn(t *testing.T) {
4545
"--surname-attribute", "sn-bind full",
4646
"--email-attribute", "mail-bind full",
4747
"--public-ssh-key-attribute", "publickey-bind full",
48+
"--avatar-attribute", "avatar-bind full",
4849
"--bind-dn", "cn=readonly,dc=full-domain-bind,dc=org",
4950
"--bind-password", "secret-bind-full",
5051
"--attributes-in-bind",
@@ -71,6 +72,7 @@ func TestAddLdapBindDn(t *testing.T) {
7172
AttributeMail: "mail-bind full",
7273
AttributesInBind: true,
7374
AttributeSSHPublicKey: "publickey-bind full",
75+
AttributeAvatar: "avatar-bind full",
7476
SearchPageSize: 99,
7577
Filter: "(memberOf=cn=user-group,ou=example,dc=full-domain-bind,dc=org)",
7678
AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=full-domain-bind,dc=org)",
@@ -269,6 +271,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
269271
"--surname-attribute", "sn-simple full",
270272
"--email-attribute", "mail-simple full",
271273
"--public-ssh-key-attribute", "publickey-simple full",
274+
"--avatar-attribute", "avatar-simple full",
272275
"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
273276
},
274277
loginSource: &login.Source{
@@ -288,6 +291,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
288291
AttributeSurname: "sn-simple full",
289292
AttributeMail: "mail-simple full",
290293
AttributeSSHPublicKey: "publickey-simple full",
294+
AttributeAvatar: "avatar-simple full",
291295
Filter: "(&(objectClass=posixAccount)(full-simple-cn=%s))",
292296
AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=full-domain-simple,dc=org)",
293297
RestrictedFilter: "(memberOf=cn=restricted-group,ou=example,dc=full-domain-simple,dc=org)",
@@ -501,6 +505,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
501505
"--surname-attribute", "sn-bind full",
502506
"--email-attribute", "mail-bind full",
503507
"--public-ssh-key-attribute", "publickey-bind full",
508+
"--avatar-attribute", "avatar-bind full",
504509
"--bind-dn", "cn=readonly,dc=full-domain-bind,dc=org",
505510
"--bind-password", "secret-bind-full",
506511
"--synchronize-users",
@@ -534,6 +539,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
534539
AttributeMail: "mail-bind full",
535540
AttributesInBind: false,
536541
AttributeSSHPublicKey: "publickey-bind full",
542+
AttributeAvatar: "avatar-bind full",
537543
SearchPageSize: 99,
538544
Filter: "(memberOf=cn=user-group,ou=example,dc=full-domain-bind,dc=org)",
539545
AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=full-domain-bind,dc=org)",
@@ -932,6 +938,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
932938
"--surname-attribute", "sn-simple full",
933939
"--email-attribute", "mail-simple full",
934940
"--public-ssh-key-attribute", "publickey-simple full",
941+
"--avatar-attribute", "avatar-simple full",
935942
"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
936943
},
937944
id: 7,
@@ -952,6 +959,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
952959
AttributeSurname: "sn-simple full",
953960
AttributeMail: "mail-simple full",
954961
AttributeSSHPublicKey: "publickey-simple full",
962+
AttributeAvatar: "avatar-simple full",
955963
Filter: "(&(objectClass=posixAccount)(full-simple-cn=%s))",
956964
AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=full-domain-simple,dc=org)",
957965
RestrictedFilter: "(memberOf=cn=restricted-group,ou=example,dc=full-domain-simple,dc=org)",

Diff for: ‎docs/content/doc/usage/command-line.en-us.md

+4
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ Admin operations:
152152
- `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
153153
- `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address. Required.
154154
- `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
155+
- `--avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
155156
- `--bind-dn value`: The DN to bind to the LDAP server with when searching for the user.
156157
- `--bind-password value`: The password for the Bind DN, if any.
157158
- `--attributes-in-bind`: Fetch attributes in bind DN context.
@@ -177,6 +178,7 @@ Admin operations:
177178
- `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
178179
- `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address.
179180
- `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
181+
- `--avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
180182
- `--bind-dn value`: The DN to bind to the LDAP server with when searching for the user.
181183
- `--bind-password value`: The password for the Bind DN, if any.
182184
- `--attributes-in-bind`: Fetch attributes in bind DN context.
@@ -202,6 +204,7 @@ Admin operations:
202204
- `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
203205
- `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address. Required.
204206
- `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
207+
- `--avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
205208
- `--user-dn value`: The user’s DN. Required.
206209
- Examples:
207210
- `gitea admin auth add-ldap-simple --name ldap --security-protocol unencrypted --host mydomain.org --port 389 --user-dn "cn=%s,ou=Users,dc=mydomain,dc=org" --user-filter "(&(objectClass=posixAccount)(cn=%s))" --email-attribute mail`
@@ -223,6 +226,7 @@ Admin operations:
223226
- `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
224227
- `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address.
225228
- `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
229+
- `--avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
226230
- `--user-dn value`: The user’s DN.
227231
- Examples:
228232
- `gitea admin auth update-ldap-simple --id 1 --name "my ldap auth source"`

Diff for: ‎models/user_avatar.go

+9
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,15 @@ func (u *User) UploadAvatar(data []byte) error {
153153
return sess.Commit()
154154
}
155155

156+
// IsUploadAvatarChanged returns true if the current user's avatar would be changed with the provided data
157+
func (u *User) IsUploadAvatarChanged(data []byte) bool {
158+
if !u.UseCustomAvatar || len(u.Avatar) == 0 {
159+
return true
160+
}
161+
avatarID := fmt.Sprintf("%x", md5.Sum([]byte(fmt.Sprintf("%d-%x", u.ID, md5.Sum(data)))))
162+
return u.Avatar != avatarID
163+
}
164+
156165
// DeleteAvatar deletes the user's custom avatar.
157166
func (u *User) DeleteAvatar() error {
158167
aPath := u.CustomAvatarRelativePath()

Diff for: ‎options/locale/locale_en-US.ini

+1
Original file line numberDiff line numberDiff line change
@@ -2421,6 +2421,7 @@ auths.attribute_name = First Name Attribute
24212421
auths.attribute_surname = Surname Attribute
24222422
auths.attribute_mail = Email Attribute
24232423
auths.attribute_ssh_public_key = Public SSH Key Attribute
2424+
auths.attribute_avatar = Avatar Attribute
24242425
auths.attributes_in_bind = Fetch Attributes in Bind DN Context
24252426
auths.allow_deactivate_all = Allow an empty search result to deactivate all users
24262427
auths.use_paged_search = Use Paged Search

Diff for: ‎routers/web/admin/auths.go

+1
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ func parseLDAPConfig(form forms.AuthenticationForm) *ldap.Source {
136136
AttributeMail: form.AttributeMail,
137137
AttributesInBind: form.AttributesInBind,
138138
AttributeSSHPublicKey: form.AttributeSSHPublicKey,
139+
AttributeAvatar: form.AttributeAvatar,
139140
SearchPageSize: pageSize,
140141
Filter: form.Filter,
141142
GroupsEnabled: form.GroupsEnabled,

Diff for: ‎services/auth/source/ldap/source.go

+1
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ type Source struct {
4242
AttributeMail string // E-mail attribute
4343
AttributesInBind bool // fetch attributes in bind context (not user)
4444
AttributeSSHPublicKey string // LDAP SSH Public Key attribute
45+
AttributeAvatar string
4546
SearchPageSize uint32 // Search with paging page size
4647
Filter string // Query filter to validate entry
4748
AdminFilter string // Query filter to check if user is admin

Diff for: ‎services/auth/source/ldap/source_authenticate.go

+4
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,10 @@ func (source *Source) Authenticate(user *models.User, userName, password string)
9696
err = models.RewriteAllPublicKeys()
9797
}
9898

99+
if err == nil && len(source.AttributeAvatar) > 0 {
100+
_ = user.UploadAvatar(sr.Avatar)
101+
}
102+
99103
return user, err
100104
}
101105

Diff for: ‎services/auth/source/ldap/source_search.go

+22-5
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ type SearchResult struct {
2727
IsAdmin bool // if user is administrator
2828
IsRestricted bool // if user is restricted
2929
LowerName string // Lowername
30+
Avatar []byte
3031
}
3132

3233
func (ls *Source) sanitizedUserQuery(username string) (string, bool) {
@@ -266,7 +267,8 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
266267
return nil
267268
}
268269

269-
var isAttributeSSHPublicKeySet = len(strings.TrimSpace(ls.AttributeSSHPublicKey)) > 0
270+
isAttributeSSHPublicKeySet := len(strings.TrimSpace(ls.AttributeSSHPublicKey)) > 0
271+
isAtributeAvatarSet := len(strings.TrimSpace(ls.AttributeAvatar)) > 0
270272

271273
attribs := []string{ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail}
272274
if len(strings.TrimSpace(ls.UserUID)) > 0 {
@@ -275,8 +277,11 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
275277
if isAttributeSSHPublicKeySet {
276278
attribs = append(attribs, ls.AttributeSSHPublicKey)
277279
}
280+
if isAtributeAvatarSet {
281+
attribs = append(attribs, ls.AttributeAvatar)
282+
}
278283

279-
log.Trace("Fetching attributes '%v', '%v', '%v', '%v', '%v', '%v' with filter '%s' and base '%s'", ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail, ls.AttributeSSHPublicKey, ls.UserUID, userFilter, userDN)
284+
log.Trace("Fetching attributes '%v', '%v', '%v', '%v', '%v', '%v', '%v' with filter '%s' and base '%s'", ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail, ls.AttributeSSHPublicKey, ls.AttributeAvatar, ls.UserUID, userFilter, userDN)
280285
search := ldap.NewSearchRequest(
281286
userDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, userFilter,
282287
attribs, nil)
@@ -296,6 +301,7 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
296301
}
297302

298303
var sshPublicKey []string
304+
var Avatar []byte
299305

300306
username := sr.Entries[0].GetAttributeValue(ls.AttributeUsername)
301307
firstname := sr.Entries[0].GetAttributeValue(ls.AttributeName)
@@ -363,6 +369,10 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
363369
}
364370
}
365371

372+
if isAtributeAvatarSet {
373+
Avatar = sr.Entries[0].GetRawAttributeValue(ls.AttributeAvatar)
374+
}
375+
366376
return &SearchResult{
367377
LowerName: strings.ToLower(username),
368378
Username: username,
@@ -372,6 +382,7 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
372382
SSHPublicKey: sshPublicKey,
373383
IsAdmin: isAdmin,
374384
IsRestricted: isRestricted,
385+
Avatar: Avatar,
375386
}
376387
}
377388

@@ -403,14 +414,18 @@ func (ls *Source) SearchEntries() ([]*SearchResult, error) {
403414

404415
userFilter := fmt.Sprintf(ls.Filter, "*")
405416

406-
var isAttributeSSHPublicKeySet = len(strings.TrimSpace(ls.AttributeSSHPublicKey)) > 0
417+
isAttributeSSHPublicKeySet := len(strings.TrimSpace(ls.AttributeSSHPublicKey)) > 0
418+
isAtributeAvatarSet := len(strings.TrimSpace(ls.AttributeAvatar)) > 0
407419

408420
attribs := []string{ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail}
409421
if isAttributeSSHPublicKeySet {
410422
attribs = append(attribs, ls.AttributeSSHPublicKey)
411423
}
424+
if isAtributeAvatarSet {
425+
attribs = append(attribs, ls.AttributeAvatar)
426+
}
412427

413-
log.Trace("Fetching attributes '%v', '%v', '%v', '%v', '%v' with filter %s and base %s", ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail, ls.AttributeSSHPublicKey, userFilter, ls.UserBase)
428+
log.Trace("Fetching attributes '%v', '%v', '%v', '%v', '%v', '%v' with filter %s and base %s", ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail, ls.AttributeSSHPublicKey, ls.AttributeAvatar, userFilter, ls.UserBase)
414429
search := ldap.NewSearchRequest(
415430
ls.UserBase, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, userFilter,
416431
attribs, nil)
@@ -442,8 +457,10 @@ func (ls *Source) SearchEntries() ([]*SearchResult, error) {
442457
if isAttributeSSHPublicKeySet {
443458
result[i].SSHPublicKey = v.GetAttributeValues(ls.AttributeSSHPublicKey)
444459
}
460+
if isAtributeAvatarSet {
461+
result[i].Avatar = v.GetRawAttributeValue(ls.AttributeAvatar)
462+
}
445463
result[i].LowerName = strings.ToLower(result[i].Username)
446-
447464
}
448465

449466
return result, nil

Diff for: ‎services/auth/source/ldap/source_sync.go

+14-1
Original file line numberDiff line numberDiff line change
@@ -112,12 +112,18 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
112112

113113
if err != nil {
114114
log.Error("SyncExternalUsers[%s]: Error creating user %s: %v", source.loginSource.Name, su.Username, err)
115-
} else if isAttributeSSHPublicKeySet {
115+
}
116+
117+
if err == nil && isAttributeSSHPublicKeySet {
116118
log.Trace("SyncExternalUsers[%s]: Adding LDAP Public SSH Keys for user %s", source.loginSource.Name, usr.Name)
117119
if models.AddPublicKeysBySource(usr, source.loginSource, su.SSHPublicKey) {
118120
sshKeysNeedUpdate = true
119121
}
120122
}
123+
124+
if err == nil && len(source.AttributeAvatar) > 0 {
125+
_ = usr.UploadAvatar(su.Avatar)
126+
}
121127
} else if updateExisting {
122128
// Synchronize SSH Public Key if that attribute is set
123129
if isAttributeSSHPublicKeySet && models.SynchronizePublicKeys(usr, source.loginSource, su.SSHPublicKey) {
@@ -150,6 +156,13 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
150156
log.Error("SyncExternalUsers[%s]: Error updating user %s: %v", source.loginSource.Name, usr.Name, err)
151157
}
152158
}
159+
160+
if usr.IsUploadAvatarChanged(su.Avatar) {
161+
if err == nil && len(source.AttributeAvatar) > 0 {
162+
_ = usr.UploadAvatar(su.Avatar)
163+
}
164+
165+
}
153166
}
154167
}
155168

Diff for: ‎services/forms/auth_form.go

+1
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ type AuthenticationForm struct {
2929
AttributeSurname string
3030
AttributeMail string
3131
AttributeSSHPublicKey string
32+
AttributeAvatar string
3233
AttributesInBind bool
3334
UsePagedSearch bool
3435
SearchPageSize int

Diff for: ‎templates/admin/auth/edit.tmpl

+4
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,10 @@
104104
<label for="attribute_ssh_public_key">{{.i18n.Tr "admin.auths.attribute_ssh_public_key"}}</label>
105105
<input id="attribute_ssh_public_key" name="attribute_ssh_public_key" value="{{$cfg.AttributeSSHPublicKey}}" placeholder="e.g. SshPublicKey">
106106
</div>
107+
<div class="field">
108+
<label for="attribute_avatar">{{.i18n.Tr "admin.auths.attribute_avatar"}}</label>
109+
<input id="attribute_avatar" name="attribute_avatar" value="{{$cfg.AttributeAvatar}}" placeholder="e.g. jpegPhoto">
110+
</div>
107111
<div class="inline field">
108112
<div class="ui checkbox">
109113
<label for="groups_enabled"><strong>{{.i18n.Tr "admin.auths.verify_group_membership"}}</strong></label>

Diff for: ‎templates/admin/auth/source/ldap.tmpl

+4
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,10 @@
7676
<label for="attribute_ssh_public_key">{{.i18n.Tr "admin.auths.attribute_ssh_public_key"}}</label>
7777
<input id="attribute_ssh_public_key" name="attribute_ssh_public_key" value="{{.attribute_ssh_public_key}}" placeholder="e.g. SshPublicKey">
7878
</div>
79+
<div class="field">
80+
<label for="attribute_avatar">{{.i18n.Tr "admin.auths.attribute_avatar"}}</label>
81+
<input id="attribute_avatar" name="attribute_avatar" value="{{.attribute_avatar}}" placeholder="e.g. jpegPhoto">
82+
</div>
7983
<div class="inline field">
8084
<div class="ui checkbox">
8185
<label for="groups_enabled"><strong>{{.i18n.Tr "admin.auths.verify_group_membership"}}</strong></label>

0 commit comments

Comments
 (0)