WIP Add service accounts and ACIs

app/jobs/create_ldap_user_job.rb

@@ -1,7 +1,7 @@
 class CreateLdapUserJob < ApplicationJob
   queue_as :default
 
-  def perform(username:, domain:, email:, hashed_pw:, confirmed: false)
+  def perform(username, domain, email, hashed_pw)
     dn = "cn=#{username},ou=#{domain},cn=users,dc=kosmos,dc=org"
     attr = {
       objectclass: ["top", "account", "person", "extensibleObject"],
@@ -12,10 +12,6 @@ class CreateLdapUserJob < ApplicationJob
       userPassword: hashed_pw
     }
 
-    if confirmed
-      attr[:serviceEnabled] = Setting.default_services
-    end
-
     ldap_client.add(dn: dn, attributes: attr)
   end
 

app/models/setting.rb

@@ -206,9 +206,4 @@ class Setting < RailsSettings::Base
   #
   # field :email_imap_port, type: :string,
   #   default: ENV["EMAIL_IMAP_PORT"].presence || 993
-
-  def self.default_services
-    # TODO Make configurable from respective service settings page
-    %w[ discourse gitea mediawiki xmpp ]
-  end
 end

app/models/user.rb

@@ -93,7 +93,9 @@ class User < ApplicationRecord
       LdapManager::UpdateEmail.call(dn: self.dn, address: self.email)
     else
       # E-Mail from signup confirmed (i.e. account activation)
-      enable_default_services
+
+      # TODO Make configurable, only activate globally enabled services
+      enable_service %w[ discourse gitea mediawiki xmpp ]
 
       # TODO enable in development when we have easy setup of ejabberd etc.
       return if Rails.env.development? || !Setting.ejabberd_enabled?
@@ -139,10 +141,6 @@ class User < ApplicationRecord
     self.errors[attribute_name].blank?
   end
 
-  def enable_default_services
-    enable_service Setting.default_services
-  end
-
   def ln_create_invoice(payload)
     lndhub = Lndhub.new
     lndhub.authenticate self

app/services/create_account.rb

@@ -35,15 +35,11 @@ class CreateAccount < ApplicationService
     @invitation.update! invited_user_id: user_id, used_at: DateTime.now
   end
 
+  # TODO move to confirmation
+  # (and/or add email_confirmed to entry and use in login filter)
   def add_ldap_document
     hashed_pw = Devise.ldap_auth_password_builder.call(@password)
-    CreateLdapUserJob.perform_later(
+    CreateLdapUserJob.perform_later(@username, @domain, @email, hashed_pw)
-      username: @username,
-      domain: @domain,
-      email: @email,
-      hashed_pw: hashed_pw,
-      confirmed: @confirmed
-    )
   end
 
   def create_lndhub_account(user)

lib/tasks/ldap.rake

@@ -19,6 +19,18 @@ namespace :ldap do
     }, true
   end
 
+  # TODO
+  desc "Add application account to directory"
+  task add_application_account: :environment do |t, args|
+    # Add uid=service,ou=kosmos.org,cn=applications,dc=kosmos,dc=org with userPassword
+  end
+
+  # TODO
+  desc "Add application ACI/permissions for OU, i.e. read/search users"
+  task add_application_account: :environment do |t, args|
+    # (target="ldap:///cn=*,ou=#{ou},cn=users,#{ldap_suffix}")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "service-#{ou.gsub(".", "-")}-read-search"; allow (read,search) userdn="ldap:///uid=service,ou=#{ou},cn=applications,#{ldap_suffix}";)
+  end
+
   desc "Add custom attributes to schema"
   task add_custom_attributes: :environment do |t, args|
     %w[ admin service_enabled nostr_key ].each do |name|

schemas/ldap/aci.ldif

@@ -0,0 +1,4 @@
+dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
+changetype: modify
+add: aci
+aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || serviceEnabled || displayName || jpegPhoto || nsRole || objectClass") (version 3.0; acl "service-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=service,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)

schemas/ldap/delete-aci.ldif

@@ -0,0 +1,4 @@
+dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
+changetype: modify
+delete: aci
+aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "service-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=service,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)

spec/jobs/create_ldap_user_job_spec.rb

@@ -3,24 +3,12 @@ require 'rails_helper'
 RSpec.describe CreateLdapUserJob, type: :job do
   let(:ldap_client_mock) { instance_double(Net::LDAP) }
 
-  before do
-    allow_any_instance_of(described_class).to receive(:ldap_client).and_return(ldap_client_mock)
-  end
-
   subject(:job) {
-    described_class.perform_later(
+    allow_any_instance_of(described_class).to receive(:ldap_client).and_return(ldap_client_mock)
-      username: 'halfinney', domain: 'kosmos.org',
-      email: 'halfinney@example.com',
-      hashed_pw: 'remember-remember-the-5th-of-november'
-    )
-  }
 
-  subject(:job_for_preconfirmed_account) {
     described_class.perform_later(
-      username: 'halfinney', domain: 'kosmos.org',
+      'halfinney', 'kosmos.org', 'halfinney@example.com',
-      email: 'halfinney@example.com',
+      'remember-remember-the-5th-of-november'
-      hashed_pw: 'remember-remember-the-5th-of-november',
-      confirmed: true
     )
   }
 
@@ -42,26 +30,6 @@ RSpec.describe CreateLdapUserJob, type: :job do
     )
   end
 
-  it "adds default services for pre-confirmed accounts" do
-    allow(ldap_client_mock).to receive(:add) # spy on mock
-    allow(Setting).to receive(:default_services).and_return(["xmpp", "discourse"])
-
-    perform_enqueued_jobs { job_for_preconfirmed_account }
-
-    expect(ldap_client_mock).to have_received(:add).with(
-      dn: "cn=halfinney,ou=kosmos.org,cn=users,dc=kosmos,dc=org",
-      attributes: {
-        objectclass: ["top", "account", "person", "extensibleObject"],
-        cn: "halfinney",
-        sn: "halfinney",
-        uid: "halfinney",
-        mail: "halfinney@example.com",
-        serviceEnabled: ["xmpp", "discourse"],
-        userPassword: "remember-remember-the-5th-of-november"
-      }
-    )
-  end
-
   after do
     clear_enqueued_jobs
     clear_performed_jobs

spec/services/create_account_spec.rb

@@ -53,32 +53,11 @@ RSpec.describe CreateAccount, type: :model do
 
       expect(enqueued_jobs.size).to eq(1)
 
-      args = enqueued_jobs.first['arguments'][0]
+      args = enqueued_jobs.first['arguments']
-      expect(args["username"]).to eq('halfinney')
+      expect(args[0]).to eq('halfinney')
-      expect(args["domain"]).to eq('kosmos.org')
+      expect(args[1]).to eq('kosmos.org')
-      expect(args["email"]).to eq('halfinney@example.com')
+      expect(args[2]).to eq('halfinney@example.com')
-      expect(args["hashed_pw"]).to match(/^{SSHA512}.{171}=/)
+      expect(args[3]).to match(/^{SSHA512}.{171}=/)
-    end
-
-    after do
-      clear_enqueued_jobs
-    end
-  end
-
-  describe "#add_ldap_document for pre-confirmed account" do
-    include ActiveJob::TestHelper
-
-    let(:service) { CreateAccount.new(account: {
-      username: 'halfinney',
-      email: 'halfinney@example.com',
-      password: 'remember-remember-the-5th-of-november',
-      confirmed: true
-    })}
-
-    it "enqueues a job to create the LDAP user document" do
-      service.send(:add_ldap_document)
-      args = enqueued_jobs.first['arguments'][0]
-      expect(args["confirmed"]).to be(true)
     end
 
     after do