Allow LDAP Sources to provide Avatars

zeripath · zeripath · commit 1ea504810bcc · 2021-08-27T21:43:47.000+01:00
Add setting to LDAP source to allow it to provide an Avatar. Currently this is required to point to the image bytes. Fix #4144 Signed-off-by: Andrew Thornton <art27@cantab.net>
diff --git a/cmd/admin_auth_ldap.go b/cmd/admin_auth_ldap.go
@@ -89,6 +89,10 @@ var (
 			Name:  "public-ssh-key-attribute",
 			Usage: "The attribute of the user’s LDAP record containing the user’s public ssh key.",
 		},
+		cli.StringFlag{
+			Name:  "jpeg-avatar-attribute",
+			Usage: "The attribute of the user’s LDAP record containing the user’s avatar.",
+		},
 	}
 
 	ldapBindDnCLIFlags = append(commonLdapCLIFlags,
@@ -230,6 +234,9 @@ func parseLdapConfig(c *cli.Context, config *ldap.Source) error {
 	if c.IsSet("public-ssh-key-attribute") {
 		config.AttributeSSHPublicKey = c.String("public-ssh-key-attribute")
 	}
+	if c.IsSet("jpeg-avatar-attribute") {
+		config.AttributeAvatarJPEG = c.String("jpeg-avatar-attribute")
+	}
 	if c.IsSet("page-size") {
 		config.SearchPageSize = uint32(c.Uint("page-size"))
 	}
diff --git a/cmd/admin_auth_ldap_test.go b/cmd/admin_auth_ldap_test.go
@@ -45,6 +45,7 @@ func TestAddLdapBindDn(t *testing.T) {
 				"--surname-attribute", "sn-bind full",
 				"--email-attribute", "mail-bind full",
 				"--public-ssh-key-attribute", "publickey-bind full",
+				"--jpeg-avatar-attribute", "avatar-bind full",
 				"--bind-dn", "cn=readonly,dc=full-domain-bind,dc=org",
 				"--bind-password", "secret-bind-full",
 				"--attributes-in-bind",
@@ -71,6 +72,7 @@ func TestAddLdapBindDn(t *testing.T) {
 					AttributeMail:         "mail-bind full",
 					AttributesInBind:      true,
 					AttributeSSHPublicKey: "publickey-bind full",
+					AttributeAvatarJPEG:   "avatar-bind full",
 					SearchPageSize:        99,
 					Filter:                "(memberOf=cn=user-group,ou=example,dc=full-domain-bind,dc=org)",
 					AdminFilter:           "(memberOf=cn=admin-group,ou=example,dc=full-domain-bind,dc=org)",
@@ -269,6 +271,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				"--surname-attribute", "sn-simple full",
 				"--email-attribute", "mail-simple full",
 				"--public-ssh-key-attribute", "publickey-simple full",
+				"--jpeg-avatar-attribute", "avatar-simple full",
 				"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
 			},
 			loginSource: &models.LoginSource{
@@ -288,6 +291,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 					AttributeSurname:      "sn-simple full",
 					AttributeMail:         "mail-simple full",
 					AttributeSSHPublicKey: "publickey-simple full",
+					AttributeAvatarJPEG:   "avatar-simple full",
 					Filter:                "(&(objectClass=posixAccount)(full-simple-cn=%s))",
 					AdminFilter:           "(memberOf=cn=admin-group,ou=example,dc=full-domain-simple,dc=org)",
 					RestrictedFilter:      "(memberOf=cn=restricted-group,ou=example,dc=full-domain-simple,dc=org)",
@@ -501,6 +505,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--surname-attribute", "sn-bind full",
 				"--email-attribute", "mail-bind full",
 				"--public-ssh-key-attribute", "publickey-bind full",
+				"--jpeg-avatar-attribute", "avatar-bind full",
 				"--bind-dn", "cn=readonly,dc=full-domain-bind,dc=org",
 				"--bind-password", "secret-bind-full",
 				"--synchronize-users",
@@ -534,6 +539,7 @@ func TestUpdateLdapBindDn(t *testing.T) {
 					AttributeMail:         "mail-bind full",
 					AttributesInBind:      false,
 					AttributeSSHPublicKey: "publickey-bind full",
+					AttributeAvatarJPEG:   "avatar-bind full",
 					SearchPageSize:        99,
 					Filter:                "(memberOf=cn=user-group,ou=example,dc=full-domain-bind,dc=org)",
 					AdminFilter:           "(memberOf=cn=admin-group,ou=example,dc=full-domain-bind,dc=org)",
@@ -932,6 +938,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--surname-attribute", "sn-simple full",
 				"--email-attribute", "mail-simple full",
 				"--public-ssh-key-attribute", "publickey-simple full",
+				"--jpeg-avatar-attribute", "avatar-simple full",
 				"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
 			},
 			id: 7,
@@ -952,6 +959,7 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 					AttributeSurname:      "sn-simple full",
 					AttributeMail:         "mail-simple full",
 					AttributeSSHPublicKey: "publickey-simple full",
+					AttributeAvatarJPEG:   "avatar-simple full",
 					Filter:                "(&(objectClass=posixAccount)(full-simple-cn=%s))",
 					AdminFilter:           "(memberOf=cn=admin-group,ou=example,dc=full-domain-simple,dc=org)",
 					RestrictedFilter:      "(memberOf=cn=restricted-group,ou=example,dc=full-domain-simple,dc=org)",
diff --git a/docs/content/doc/usage/command-line.en-us.md b/docs/content/doc/usage/command-line.en-us.md
@@ -152,6 +152,7 @@ Admin operations:
         - `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
         - `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address. Required.
         - `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
+        - `--jpeg-avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
         - `--bind-dn value`: The DN to bind to the LDAP server with when searching for the user.
         - `--bind-password value`: The password for the Bind DN, if any.
         - `--attributes-in-bind`: Fetch attributes in bind DN context.
@@ -177,6 +178,7 @@ Admin operations:
         - `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
         - `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address.
         - `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
+        - `--jpeg-avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
         - `--bind-dn value`: The DN to bind to the LDAP server with when searching for the user.
         - `--bind-password value`: The password for the Bind DN, if any.
         - `--attributes-in-bind`: Fetch attributes in bind DN context.
@@ -202,6 +204,7 @@ Admin operations:
         - `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
         - `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address. Required.
         - `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
+        - `--jpeg-avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
         - `--user-dn value`: The user’s DN. Required.
       - Examples:
         - `gitea admin auth add-ldap-simple --name ldap --security-protocol unencrypted --host mydomain.org --port 389 --user-dn "cn=%s,ou=Users,dc=mydomain,dc=org" --user-filter "(&(objectClass=posixAccount)(cn=%s))" --email-attribute mail`
@@ -223,6 +226,7 @@ Admin operations:
         - `--surname-attribute value`: The attribute of the user’s LDAP record containing the user’s surname.
         - `--email-attribute value`: The attribute of the user’s LDAP record containing the user’s email address.
         - `--public-ssh-key-attribute value`: The attribute of the user’s LDAP record containing the user’s public ssh key.
+        - `--jpeg-avatar-attribute value`: The attribute of the user’s LDAP record containing the user’s avatar.
         - `--user-dn value`: The user’s DN.
       - Examples:
         - `gitea admin auth update-ldap-simple --id 1 --name "my ldap auth source"`
diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
@@ -2416,6 +2416,7 @@ auths.attribute_name = First Name Attribute
 auths.attribute_surname = Surname Attribute
 auths.attribute_mail = Email Attribute
 auths.attribute_ssh_public_key = Public SSH Key Attribute
+auths.attribute_avatar_jpeg = JPEG Avatar Attribute
 auths.attributes_in_bind = Fetch Attributes in Bind DN Context
 auths.allow_deactivate_all = Allow an empty search result to deactivate all users
 auths.use_paged_search = Use Paged Search
diff --git a/routers/web/admin/auths.go b/routers/web/admin/auths.go
@@ -134,6 +134,7 @@ func parseLDAPConfig(form forms.AuthenticationForm) *ldap.Source {
 		AttributeMail:         form.AttributeMail,
 		AttributesInBind:      form.AttributesInBind,
 		AttributeSSHPublicKey: form.AttributeSSHPublicKey,
+		AttributeAvatarJPEG:   form.AttributeAvatarJPEG,
 		SearchPageSize:        pageSize,
 		Filter:                form.Filter,
 		GroupsEnabled:         form.GroupsEnabled,
diff --git a/services/auth/source/ldap/source.go b/services/auth/source/ldap/source.go
@@ -41,6 +41,7 @@ type Source struct {
 	AttributeMail         string // E-mail attribute
 	AttributesInBind      bool   // fetch attributes in bind context (not user)
 	AttributeSSHPublicKey string // LDAP SSH Public Key attribute
+	AttributeAvatarJPEG   string
 	SearchPageSize        uint32 // Search with paging page size
 	Filter                string // Query filter to validate entry
 	AdminFilter           string // Query filter to check if user is admin
diff --git a/services/auth/source/ldap/source_authenticate.go b/services/auth/source/ldap/source_authenticate.go
@@ -95,5 +95,9 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		err = models.RewriteAllPublicKeys()
 	}
 
+	if err == nil && source.AttributeAvatarJPEG != "" {
+		_ = user.UploadAvatar(sr.AvatarJPEG)
+	}
+
 	return user, err
 }
diff --git a/services/auth/source/ldap/source_search.go b/services/auth/source/ldap/source_search.go
@@ -26,6 +26,7 @@ type SearchResult struct {
 	SSHPublicKey []string // SSH Public Key
 	IsAdmin      bool     // if user is administrator
 	IsRestricted bool     // if user is restricted
+	AvatarJPEG   []byte
 }
 
 func (ls *Source) sanitizedUserQuery(username string) (string, bool) {
@@ -295,6 +296,7 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
 	}
 
 	var sshPublicKey []string
+	var avatarJPEG []byte
 
 	username := sr.Entries[0].GetAttributeValue(ls.AttributeUsername)
 	firstname := sr.Entries[0].GetAttributeValue(ls.AttributeName)
@@ -362,6 +364,10 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
 		}
 	}
 
+	if ls.AttributeAvatarJPEG != "" {
+		avatarJPEG = sr.Entries[0].GetRawAttributeValue(ls.AttributeAvatarJPEG)
+	}
+
 	return &SearchResult{
 		Username:     username,
 		Name:         firstname,
@@ -370,6 +376,7 @@ func (ls *Source) SearchEntry(name, passwd string, directBind bool) *SearchResul
 		SSHPublicKey: sshPublicKey,
 		IsAdmin:      isAdmin,
 		IsRestricted: isRestricted,
+		AvatarJPEG:   avatarJPEG,
 	}
 }
 
@@ -440,6 +447,9 @@ func (ls *Source) SearchEntries() ([]*SearchResult, error) {
 		if isAttributeSSHPublicKeySet {
 			result[i].SSHPublicKey = v.GetAttributeValues(ls.AttributeSSHPublicKey)
 		}
+		if ls.AttributeAvatarJPEG != "" {
+			result[i].AvatarJPEG = v.GetRawAttributeValue(ls.AttributeAvatarJPEG)
+		}
 	}
 
 	return result, nil
diff --git a/services/auth/source/ldap/source_sync.go b/services/auth/source/ldap/source_sync.go
@@ -101,12 +101,18 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 
 			if err != nil {
 				log.Error("SyncExternalUsers[%s]: Error creating user %s: %v", source.loginSource.Name, su.Username, err)
-			} else if isAttributeSSHPublicKeySet {
+			}
+
+			if err == nil && isAttributeSSHPublicKeySet {
 				log.Trace("SyncExternalUsers[%s]: Adding LDAP Public SSH Keys for user %s", source.loginSource.Name, usr.Name)
 				if models.AddPublicKeysBySource(usr, source.loginSource, su.SSHPublicKey) {
 					sshKeysNeedUpdate = true
 				}
 			}
+
+			if err == nil && source.AttributeAvatarJPEG != "" {
+				_ = usr.UploadAvatar(su.AvatarJPEG)
+			}
 		} else if updateExisting {
 			existingUsers = append(existingUsers, usr.ID)
 
@@ -140,6 +146,10 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {
 				if err != nil {
 					log.Error("SyncExternalUsers[%s]: Error updating user %s: %v", source.loginSource.Name, usr.Name, err)
 				}
+
+				if err == nil && source.AttributeAvatarJPEG != "" {
+					_ = usr.UploadAvatar(su.AvatarJPEG)
+				}
 			}
 		}
 	}
diff --git a/services/forms/auth_form.go b/services/forms/auth_form.go
@@ -29,6 +29,7 @@ type AuthenticationForm struct {
 	AttributeSurname              string
 	AttributeMail                 string
 	AttributeSSHPublicKey         string
+	AttributeAvatarJPEG           string
 	AttributesInBind              bool
 	UsePagedSearch                bool
 	SearchPageSize                int
diff --git a/templates/admin/auth/edit.tmpl b/templates/admin/auth/edit.tmpl
@@ -104,6 +104,10 @@
 						<label for="attribute_ssh_public_key">{{.i18n.Tr "admin.auths.attribute_ssh_public_key"}}</label>
 						<input id="attribute_ssh_public_key" name="attribute_ssh_public_key" value="{{$cfg.AttributeSSHPublicKey}}" placeholder="e.g. SshPublicKey">
 					</div>
+					<div class="field">
+						<label for="attribute_avatar_jpeg">{{.i18n.Tr "admin.auths.attribute_avatar_jpeg"}}</label>
+						<input id="attribute_avatar_jpeg" name="attribute_avatar_jpeg" value="{{$cfg.AttributeAvatarJPEG}}" placeholder="e.g. jpegPhoto">
+					</div>
 					<div class="inline field">
 						<div class="ui checkbox">
 							<label for="groups_enabled"><strong>{{.i18n.Tr "admin.auths.verify_group_membership"}}</strong></label>
diff --git a/templates/admin/auth/source/ldap.tmpl b/templates/admin/auth/source/ldap.tmpl
@@ -76,6 +76,10 @@
 		<label for="attribute_ssh_public_key">{{.i18n.Tr "admin.auths.attribute_ssh_public_key"}}</label>
 		<input id="attribute_ssh_public_key" name="attribute_ssh_public_key" value="{{.attribute_ssh_public_key}}" placeholder="e.g. SshPublicKey">
 	</div>
+	<div class="field">
+		<label for="attribute_avatar_jpeg">{{.i18n.Tr "admin.auths.attribute_avatar_jpeg"}}</label>
+		<input id="attribute_avatar_jpeg" name="attribute_avatar_jpeg" value="{{.attribute_avatar_jpeg}}" placeholder="e.g. jpegPhoto">
+	</div>
 	<div class="inline field">
 		<div class="ui checkbox">
 			<label for="groups_enabled"><strong>{{.i18n.Tr "admin.auths.verify_group_membership"}}</strong></label>

Original file line number	Diff line number	Diff line change
`@@ -89,6 +89,10 @@ var (`
`89`	`89`	`Name: "public-ssh-key-attribute",`
`90`	`90`	`Usage: "The attribute of the user’s LDAP record containing the user’s public ssh key.",`
`91`	`91`	`},`
	`92`	`+ cli.StringFlag{`
	`93`	`+ Name: "jpeg-avatar-attribute",`
	`94`	`+ Usage: "The attribute of the user’s LDAP record containing the user’s avatar.",`
	`95`	`+ },`
`92`	`96`	`}`
`93`	`97`
`94`	`98`	`ldapBindDnCLIFlags = append(commonLdapCLIFlags,`
`@@ -230,6 +234,9 @@ func parseLdapConfig(c cli.Context, config ldap.Source) error {`
`230`	`234`	`if c.IsSet("public-ssh-key-attribute") {`
`231`	`235`	`config.AttributeSSHPublicKey = c.String("public-ssh-key-attribute")`
`232`	`236`	`}`
	`237`	`+ if c.IsSet("jpeg-avatar-attribute") {`
	`238`	`+ config.AttributeAvatarJPEG = c.String("jpeg-avatar-attribute")`
	`239`	`+ }`
`233`	`240`	`if c.IsSet("page-size") {`
`234`	`241`	`config.SearchPageSize = uint32(c.Uint("page-size"))`
`235`	`242`	`}`
Original file line number	Diff line number	Diff line change
`@@ -95,5 +95,9 @@ func (source Source) Authenticate(user models.User, login, password string) (*`
`95`	`95`	`err = models.RewriteAllPublicKeys()`
`96`	`96`	`}`
`97`	`97`
	`98`	`+ if err == nil && source.AttributeAvatarJPEG != "" {`
	`99`	`+ _ = user.UploadAvatar(sr.AvatarJPEG)`
	`100`	`+ }`
	`101`	`+`
`98`	`102`	`return user, err`
`99`	`103`	`}`
Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,7 @@ type SearchResult struct {`
`26`	`26`	`SSHPublicKey []string // SSH Public Key`
`27`	`27`	`IsAdmin bool // if user is administrator`
`28`	`28`	`IsRestricted bool // if user is restricted`
	`29`	`+ AvatarJPEG []byte`
`29`	`30`	`}`
`30`	`31`
`31`	`32`	`func (ls *Source) sanitizedUserQuery(username string) (string, bool) {`
`@@ -295,6 +296,7 @@ func (ls Source) SearchEntry(name, passwd string, directBind bool) SearchResul`
`295`	`296`	`}`
`296`	`297`
`297`	`298`	`var sshPublicKey []string`
	`299`	`+ var avatarJPEG []byte`
`298`	`300`
`299`	`301`	`username := sr.Entries[0].GetAttributeValue(ls.AttributeUsername)`
`300`	`302`	`firstname := sr.Entries[0].GetAttributeValue(ls.AttributeName)`
`@@ -362,6 +364,10 @@ func (ls Source) SearchEntry(name, passwd string, directBind bool) SearchResul`
`362`	`364`	`}`
`363`	`365`	`}`
`364`	`366`
	`367`	`+ if ls.AttributeAvatarJPEG != "" {`
	`368`	`+ avatarJPEG = sr.Entries[0].GetRawAttributeValue(ls.AttributeAvatarJPEG)`
	`369`	`+ }`
	`370`	`+`
`365`	`371`	`return &SearchResult{`
`366`	`372`	`Username: username,`
`367`	`373`	`Name: firstname,`
`@@ -370,6 +376,7 @@ func (ls Source) SearchEntry(name, passwd string, directBind bool) SearchResul`
`370`	`376`	`SSHPublicKey: sshPublicKey,`
`371`	`377`	`IsAdmin: isAdmin,`
`372`	`378`	`IsRestricted: isRestricted,`
	`379`	`+ AvatarJPEG: avatarJPEG,`
`373`	`380`	`}`
`374`	`381`	`}`
`375`	`382`
`@@ -440,6 +447,9 @@ func (ls Source) SearchEntries() ([]SearchResult, error) {`
`440`	`447`	`if isAttributeSSHPublicKeySet {`
`441`	`448`	`result[i].SSHPublicKey = v.GetAttributeValues(ls.AttributeSSHPublicKey)`
`442`	`449`	`}`
	`450`	`+ if ls.AttributeAvatarJPEG != "" {`
	`451`	`+ result[i].AvatarJPEG = v.GetRawAttributeValue(ls.AttributeAvatarJPEG)`
	`452`	`+ }`
`443`	`453`	`}`
`444`	`454`
`445`	`455`	`return result, nil`
Original file line number	Diff line number	Diff line change
`@@ -101,12 +101,18 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`101`	`101`
`102`	`102`	`if err != nil {`
`103`	`103`	`log.Error("SyncExternalUsers[%s]: Error creating user %s: %v", source.loginSource.Name, su.Username, err)`
`104`		`- } else if isAttributeSSHPublicKeySet {`
	`104`	`+ }`
	`105`	`+`
	`106`	`+ if err == nil && isAttributeSSHPublicKeySet {`
`105`	`107`	`log.Trace("SyncExternalUsers[%s]: Adding LDAP Public SSH Keys for user %s", source.loginSource.Name, usr.Name)`
`106`	`108`	`if models.AddPublicKeysBySource(usr, source.loginSource, su.SSHPublicKey) {`
`107`	`109`	`sshKeysNeedUpdate = true`
`108`	`110`	`}`
`109`	`111`	`}`
	`112`	`+`
	`113`	`+ if err == nil && source.AttributeAvatarJPEG != "" {`
	`114`	`+ _ = usr.UploadAvatar(su.AvatarJPEG)`
	`115`	`+ }`
`110`	`116`	`} else if updateExisting {`
`111`	`117`	`existingUsers = append(existingUsers, usr.ID)`
`112`	`118`
`@@ -140,6 +146,10 @@ func (source *Source) Sync(ctx context.Context, updateExisting bool) error {`
`140`	`146`	`if err != nil {`
`141`	`147`	`log.Error("SyncExternalUsers[%s]: Error updating user %s: %v", source.loginSource.Name, usr.Name, err)`
`142`	`148`	`}`
	`149`	`+`
	`150`	`+ if err == nil && source.AttributeAvatarJPEG != "" {`
	`151`	`+ _ = usr.UploadAvatar(su.AvatarJPEG)`
	`152`	`+ }`
`143`	`153`	`}`
`144`	`154`	`}`
`145`	`155`	`}`