theta42/sso-manager-node
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce pwdAccountLockedTime check in app and LDAP (#68)

Browse Source
This commit is contained in:
William Mantly
2026-08-02 18:15:28 -04:00
parent 15b3a424bc
commit 5c3a8cefe1
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/config/inventory.sqlite
BIN
View File
Binary file not shown.
nodejs/models/user_ldap.js
+9 -2
View File
@@ -773,7 +773,7 @@ User.setActive = async function(active) {
]); ]);
} else { } else {
await client.modify(this.dn, [ await client.modify(this.dn, [
new Change({ operation: 'replace', modification: new Attribute({ type: 'pwdAccountLockedTime', values: ['000001010000Z'] }) }), new Change({ operation: 'replace', modification: new Attribute({ type: 'pwdAccountLockedTime', values: ['00000101000000Z'] }) }),
]); ]);
} }
}); });
@@ -788,7 +788,7 @@ User.setActive = async function(active) {
throw e; throw e;
} }
} }
this.pwdAccountLockedTime = active ? undefined : '000001010000Z'; this.pwdAccountLockedTime = active ? undefined : '00000101000000Z';
this.isActive = active ? 'active' : ''; this.isActive = active ? 'active' : '';
this.isInactive = active ? '' : 'inactive'; this.isInactive = active ? '' : 'inactive';
cache.clear(); cache.clear();
@@ -907,6 +907,13 @@ User.login = async function(data){
} }
let user = await this.get(data.uid || data.username); let user = await this.get(data.uid || data.username);
if (user.pwdAccountLockedTime) {
let error = new Error('Invalid Credentials, login failed.');
error.name = 'LDAPLoginFailed';
error.status = 401;
throw error;
}
const loginClient = makeClient(); const loginClient = makeClient();
try { try {
await loginClient.bind(user.dn, data.password); await loginClient.bind(user.dn, data.password);