Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extract common LDAP options and update mod_shared_roster_ldap config #3558

Merged
merged 11 commits into from
Mar 4, 2022
2 changes: 1 addition & 1 deletion big_tests/run_common_test.erl
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ run_test(Test, PresetsToRun, CoverOpts) ->
end, Presets)
end,
Length = length(Presets1),
Names = preset_names(Presets),
Names = preset_names(Presets1),
error_logger:info_msg("Starting test of ~p configurations: ~n~p~n",
[Length, Names]),
Zip = lists:zip(lists:seq(1, Length), Presets1),
Expand Down
4 changes: 2 additions & 2 deletions big_tests/test.config
Original file line number Diff line number Diff line change
Expand Up @@ -333,8 +333,8 @@
filter = \"(objectClass=inetOrgPerson)\""},
{mod_vcard, " backend = \"ldap\"
host = \"vjud.@HOST@\"
ldap_base = \"ou=Users,dc=esl,dc=com\"
ldap_filter = \"(objectClass=inetOrgPerson)\"\n"}]},
ldap.base = \"ou=Users,dc=esl,dc=com\"
ldap.filter = \"(objectClass=inetOrgPerson)\"\n"}]},
{riak_mnesia,
[{dbs, [redis, riak]},
{auth_method, "riak"},
Expand Down
2 changes: 1 addition & 1 deletion big_tests/tests/ldap_helper.erl
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ get_usp(Spec) ->
{Username, Server, Password}.

get_ldap_base(Server) ->
list_to_binary(rpc(mim(), gen_mod, get_module_opt, [Server, mod_vcard, ldap_base, ""])).
rpc(mim(), gen_mod, get_module_opt, [Server, mod_vcard, [ldap, base]]).

call_ldap(Server, F, Args) ->
rpc(mim(), mongoose_wpool, call, [ldap, Server, default, {F, Args}]).
30 changes: 15 additions & 15 deletions big_tests/tests/shared_roster_SUITE.erl
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
require_rpc_nodes/1,
rpc/4]).

-import(domain_helper, [domain/0]).
-import(domain_helper, [host_type/0]).

%%--------------------------------------------------------------------
%% Suite configuration
Expand All @@ -47,7 +47,7 @@ suite() ->
%%--------------------------------------------------------------------

init_per_suite(Config0) ->
Config = dynamic_modules:save_modules(domain(), Config0),
Config = dynamic_modules:save_modules(host_type(), Config0),
case get_auth_method() of
ldap ->
start_roster_module(ldap),
Expand Down Expand Up @@ -141,29 +141,29 @@ add_user(Config) ->
%%--------------------------------------------------------------------

start_roster_module(ldap) ->
dynamic_modules:ensure_modules(domain(), [{mod_shared_roster_ldap, get_ldap_args()}]);
dynamic_modules:ensure_modules(host_type(), [{mod_shared_roster_ldap, get_ldap_opts()}]);
start_roster_module(_) ->
ok.

get_auth_method() ->
XMPPDomain = domain(),
case rpc(mim(), mongoose_config, get_opt, [[{auth, XMPPDomain}, methods], []]) of
HT = host_type(),
case rpc(mim(), mongoose_config, get_opt, [[{auth, HT}, methods], []]) of
[Method|_] ->
Method;
_ ->
none
end.

get_ldap_args() ->
[
{ldap_base, "ou=Users,dc=esl,dc=com"},
{ldap_groupattr, "ou"},
{ldap_memberattr, "cn"},{ldap_userdesc, "cn"},
{ldap_filter, "(objectClass=inetOrgPerson)"},
{ldap_rfilter, "(objectClass=inetOrgPerson)"},
{ldap_group_cache_validity, 1},
{ldap_user_cache_validity, 1}
].
get_ldap_opts() ->
Opts = #{base => <<"ou=Users,dc=esl,dc=com">>,
groupattr => <<"ou">>,
memberattr => <<"cn">>,
userdesc => <<"cn">>,
filter => <<"(objectClass=inetOrgPerson)">>,
rfilter => <<"(objectClass=inetOrgPerson)">>,
group_cache_validity => 1,
user_cache_validity => 1},
maps:merge(config_parser_helper:default_mod_config(mod_shared_roster_ldap), Opts).

no_stanzas(Users) ->
lists:foreach(fun escalus_assert:has_no_stanzas/1, Users).
10 changes: 7 additions & 3 deletions big_tests/tests/vcard_SUITE.erl
Original file line number Diff line number Diff line change
Expand Up @@ -1189,11 +1189,15 @@ params_ldap_only(Config) ->
{<<"Organization Name">>, <<"ORGNAME">>},
{<<"Organization Unit">>, <<"ORGUNIT">>},
{<<"Photo">>, <<"PHOTO">>}],
add_backend_param(#{ldap_search_operator => 'or',
ldap_binary_search_fields => [<<"PHOTO">>],
ldap_search_reported => Reported},
add_backend_param(#{ldap => #{search_operator => 'or',
binary_search_fields => [<<"PHOTO">>],
search_reported => Reported}},
?config(mod_vcard_opts, Config)).

add_backend_param(Opts = #{ldap := LDAPOpts},
CurrentVCardConfig = #{backend := ldap, ldap := CurrentLDAPOpts}) ->
NewLDAPOpts = maps:merge(CurrentLDAPOpts, LDAPOpts),
maps:merge(CurrentVCardConfig, Opts#{ldap => NewLDAPOpts});
add_backend_param(Opts, CurrentVCardConfig) ->
maps:merge(CurrentVCardConfig, Opts).

Expand Down
14 changes: 6 additions & 8 deletions big_tests/tests/vcard_simple_SUITE.erl
Original file line number Diff line number Diff line change
Expand Up @@ -454,14 +454,12 @@ configure_mod_vcard(Config) ->
end.

ldap_opts() ->
VCardOpts = #{backend => ldap,
host => subhost_pattern("vjud.@HOST@"),
ldap_uids => [{<<"uid">>}], %% equivalent to {<<"uid">>, <<"%u">>}
ldap_filter => <<"(objectClass=inetOrgPerson)">>,
ldap_base => "ou=Users,dc=esl,dc=com",
ldap_search_fields => [{"Full Name", "cn"}, {"User", "uid"}],
ldap_vcard_map => [{"FN", "%s", ["cn"]}]},
config_parser_helper:mod_config(mod_vcard, VCardOpts).
LDAPOpts = #{filter => <<"(objectClass=inetOrgPerson)">>,
base => <<"ou=Users,dc=esl,dc=com">>,
search_fields => [{"Full Name", "cn"}, {"User", "uid"}],
vcard_map => [{"FN", "%s", ["cn"]}]},
LDAPOptsWithDefaults = config_parser_helper:config([modules, mod_vcard, ldap], LDAPOpts),
config_parser_helper:mod_config(mod_vcard, #{backend => ldap, ldap => LDAPOptsWithDefaults}).

ensure_started(HostType, Opts) ->
dynamic_modules:stop(HostType, mod_vcard),
Expand Down
2 changes: 2 additions & 0 deletions doc/migrations/5.0.0_5.1.0.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ The rules for overriding global options in the `host_config` section have been s

* `mod_auth_token` has a new configuration format - if you are using this module, amend the [`validity_period`](../modules/mod_auth_token.md#modulesmod_auth_tokenvalidity_period) option.
* `mod_mam_meta` does not have the `rdbms_message_format` and `simple` options anymore. Use [`db_jid_format`](../modules/mod_mam.md#modulesmod_mam_metadb_jid_format) and [`db_message_format`](../modules/mod_mam.md#modulesmod_mam_metadb_message_format) instead.
* `mod_vcard` LDAP options are moved into an LDAP subsection.
* `mod_shared_roster_ldap` all options have their `ldap_` prefix dropped.

## Async workers

Expand Down
111 changes: 54 additions & 57 deletions doc/modules/mod_shared_roster_ldap.md
Original file line number Diff line number Diff line change
@@ -1,150 +1,147 @@
## Module Description

This module, when enabled, will inject roster entries fetched from LDAP.
It might get quite complicated to configure it properly, so fasten your seatbelts and prepare for a ride.

When a default value for an option is defined with "top-level/XXX", it means that the default value is equal to a top-level parameter in `mongooseim.toml` of the same name.
If it is not defined, XXX becomes the default value.
This module injects roster entries fetched from LDAP.
It might get quite complicated to configure it properly, so proceed with caution.

!!! warning
This module does not support [dynamic domains](../configuration/general.md#generalhost_types).

## Options: general

### `modules.mod_shared_roster_ldap.ldap_pool_tag`
### `modules.mod_shared_roster_ldap.ldap_base`
### `modules.mod_shared_roster_ldap.ldap_deref`
### `modules.mod_shared_roster_ldap.pool_tag`
### `modules.mod_shared_roster_ldap.base`
### `modules.mod_shared_roster_ldap.deref`

These 3 options are the same as for the [LDAP authentication module](../authentication-methods/ldap.md#configuration-options).

## Options: attributes

### `modules.mod_shared_roster_ldap.ldap_groupattr`
### `modules.mod_shared_roster_ldap.groupattr`
* **Syntax:** string
* **Default:** `"cn"`
* **Example:** `ldap_groupattr = "cn"`
* **Example:** `groupattr = "cn"`

Provides a group name.

### `modules.mod_shared_roster_ldap.ldap_groupdesc`
### `modules.mod_shared_roster_ldap.groupdesc`
* **Syntax:** string
* **Default:** the value of `ldap_groupattr`
* **Example:** `ldap_groupdesc = "cn"`
* **Default:** the value of `groupattr`
* **Example:** `groupdesc = "cn"`

Provides a group description.

### `modules.mod_shared_roster_ldap.ldap_userdesc`
### `modules.mod_shared_roster_ldap.userdesc`
* **Syntax:** string
* **Default:** `"cn"`
* **Example:** `ldap_userdesc = "cn"`
* **Example:** `userdesc = "cn"`

Provides a human-readable user name.

### `modules.mod_shared_roster_ldap.ldap_useruid`
### `modules.mod_shared_roster_ldap.useruid`
* **Syntax:** string
* **Default:** `"cn"`
* **Example:** `ldap_useruid = "cn"`
* **Example:** `useruid = "cn"`

Provides a username.

### `modules.mod_shared_roster_ldap.ldap_memberattr`
### `modules.mod_shared_roster_ldap.memberattr`
* **Syntax:** string
* **Default:** `"memberUid"`
* **Example:** `ldap_memberattr = "memberUid"`
* **Example:** `memberattr = "memberUid"`

Holds group members' IDs.

### `modules.mod_shared_roster_ldap.ldap_memberattr_format`
### `modules.mod_shared_roster_ldap.memberattr_format`
* **Syntax:** string
* **Default:** `"%u"`
* **Example:** `ldap_memberattr_format = "%u"`
* **Example:** `memberattr_format = "%u"`

Simple LDAP expression for extracting a user ID.

### `modules.mod_shared_roster_ldap.ldap_memberattr_format_re`
### `modules.mod_shared_roster_ldap.memberattr_format_re`
* **Syntax:** string
* **Default:** `""`
* **Example:** `ldap_memberattr_format_re = ""`
* **Example:** `memberattr_format_re = ""`

Allows extracting the user ID with a regular expression.

## Options: parameters

### `modules.mod_shared_roster_ldap.ldap_auth_check`
### `modules.mod_shared_roster_ldap.auth_check`
* **Syntax:** boolean
* **Default:** `true`
* **Example:** `ldap_auth_check = true`
* **Example:** `auth_check = true`

Enables checking if a shared roster entry actually exists in the XMPP database.

### `modules.mod_shared_roster_ldap.ldap_user_cache_validity`
### `modules.mod_shared_roster_ldap.user_cache_validity`
* **Syntax:** positive integer
* **Default:** top-level/`300`
* **Example:** `ldap_user_cache_validity = 300`
* **Default:** `300`
* **Example:** `user_cache_validity = 300`

Specifies in seconds how long are the roster entries kept in the cache.

### `modules.mod_shared_roster_ldap.ldap_group_cache_validity`
### `modules.mod_shared_roster_ldap.group_cache_validity`
* **Syntax:** positive integer
* **Default:** top-level/`300`
* **Example:** `ldap_group_cache_validity = 300`
* **Default:** `300`
* **Example:** `group_cache_validity = 300`

Specifies in seconds how long is the user's membership in a group kept in the cache.

### `modules.mod_shared_roster_ldap.ldap_user_cache_size`
### `modules.mod_shared_roster_ldap.user_cache_size`
* **Syntax:** positive integer
* **Default:** top-level/`1000`
* **Example:** `ldap_user_cache_size = 1000`
* **Default:** `1000`
* **Example:** `user_cache_size = 1000`

Specifies how many shared roster items are kept in the cache.

### `modules.mod_shared_roster_ldap.ldap_group_cache_size`
### `modules.mod_shared_roster_ldap.group_cache_size`
* **Syntax:** positive integer
* **Default:** top-level/`1000`
* **Example:** `ldap_group_cache_size = 1000`
* **Default:** `1000`
* **Example:** `group_cache_size = 1000`

Specifies how many roster group entries are kept in cache.

## Options: LDAP filters

### `modules.mod_shared_roster_ldap.ldap_rfilter`
### `modules.mod_shared_roster_ldap.rfilter`
* **Syntax:** string
* **Default:** top-level/`""`
* **Example:** `ldap_rfilter = "(objectClass=inetOrgPerson)"`
* **Default:** `""`
* **Example:** `rfilter = ""`

Used to find names of all shared roster groups.

### `modules.mod_shared_roster_ldap.ldap_gfilter`
### `modules.mod_shared_roster_ldap.gfilter`
* **Syntax:** string
* **Default:** top-level/`""`
* **Example:** `ldap_gfilter = ""`
* **Default:** `""`
* **Example:** `gfilter = ""`

Used for retrieving the human-readable name and the members of a group.

### `modules.mod_shared_roster_ldap.ldap_ufilter`
### `modules.mod_shared_roster_ldap.ufilter`
* **Syntax:** string
* **Default:** top-level/`""`
* **Example:** `ldap_ufilter = ""`
* **Default:** `""`
* **Example:** `ufilter = ""`

Used for retrieving the human-readable name of the roster entries.

### `modules.mod_shared_roster_ldap.ldap_filter`
### `modules.mod_shared_roster_ldap.filter`
* **Syntax:** string
* **Default:** top-level/`""`
* **Example:** `ldap_filter = "(objectClass=inetOrgPerson)"`
* **Default:** `""`
* **Example:** `filter = "(objectClass=inetOrgPerson)"`

Filter AND-ed with previous filters.

## Example Configuration

```toml
[modules.mod_shared_roster_ldap]
ldap_base = "ou=Users,dc=ejd,dc=com"
ldap_groupattr = "ou"
ldap_memberattr = "cn"
ldap_userdesc = "cn"
ldap_filter = "(objectClass=inetOrgPerson)"
ldap_rfilter = "(objectClass=inetOrgPerson)"
ldap_group_cache_validity = 1
ldap_user_cache_validity = 1
base = "ou=Users,dc=ejd,dc=com"
groupattr = "ou"
memberattr = "cn"
userdesc = "cn"
filter = "(objectClass=inetOrgPerson)"
rfilter = "(objectClass=inetOrgPerson)"
group_cache_validity = 1
user_cache_validity = 1
```
Loading