Basic LDAP support for domain authentication #1159

Armored-Dragon · 2024-10-10T23:37:00Z

This is a implementation for using LDAP services as an alternative authentication method to WordPress for domain servers.

Closes #905 as complete.
Closes #906 as complete.

General TODO:

Fix LoginDialog.qml style issues.
LDAP server groups as roles.
LDAPAccount.cpp (better) error handling.
LDAPAccount.cpp expose setting server url.
Fix LDAP accounts with capital letters can not sign in.
Documentation.
Include LDAP library.

Out of scope TODO. (A follow up pull request will be opened to address these issues)

Fix LoginDialog.qml not being updated on failed LDAP signin attempt
Find a better way to store sensitive account information
Automatically use the correct authentication protocol (LDAP vs WordPress(OAuth2)) without client interaction.
Interface will tell you that you are not logged in even though you are #208 (This might be addressable directly, otherwise it may be possible to sneak a fix in)
"No valid access token present" error.
Increase severity for accepted and rejected connections to the domain #1060

Signed-off-by: armored-dragon <[email protected]>

* mirrors wip * fix view + projection, texture flipping, billboarding * wip portals * wip * fix cpu frustum culling (hacky?) * fix mirrors in deferred * mirrors on models + text * portals use exit as ignoreItem * cleanup * entity tags * wild guess to handle view correction, hide portalExitID in create when mirrorMode != portal * let's try this?? * plz * promising * fix paramsOffset and view flipping * portals shouldn't flip * break when tag found * fix portal view calculation * Revert "Mirrors + Portals" * Revert "Revert "Mirrors + Portals"" * web entity wantsKeyboardFocus property * fix typo * move audio zones to zone entity properties * fix audio zones in create * set dynamic factory * new procecural particle entity type * fix particle intersection * shorten create labels * fix 0 update props case * Ability to smooth model animations * sound entities * fix layered simulate items * fix stereo sound speed * support non-localOnly sound avatar entities * add sound url prompt * support registration point, improve locking * remove keyboardRasied * locking attempt #2 * fix keyboardRasied typo * add default particle props * add unlit property for shapes * Merge branch master into protocol_changes * add ambient light color * fix create issue * fix create issue * add tonemapping props to zones, wip ambient occlusion * wip ambient occlusion * it's working! * remove attachments * fix non-localOnly positional sounds not updating * change AO default to HBAO, remove from create * more graphics options * fix AO setting + effects in mirrors * fix AA in mirrors * alezia's fixes * fix haze in mirrors * add comment for SKYBOX_DISTANCE * new line * model loading priority updates over time, takes into account out of bounds, avatar entities have higher priority, and fsts can specify to wait for wearables to load before rendering * add loadPriority to model entities, working on other avatars waitForWearables * fix build error * try to fix isServer assert * fix stats + waitForWearables * Listen for click instead of release. * Reverted initial commit. Implemented hack to listen for menu click events. * Missed some reverts. * Missed another one. * Prevent duplicate actions. * Added extra needed checks. * Fix without formatting? (#91) * Hopefully fixed formatting. * Things can't be too easy. * Remove google poly * automated entity property serialization * cleanup + automate EntityPropertyFlags * text vertical alignment, use uint8_t for entity property enums, fix text recalculating too often * fix text size * Update interface/resources/controllers/keyboardMouse.json Co-authored-by: HifiExperiments <[email protected]> * fix component mode serialization * Fixed mouse look in selfie mode. * fix text debug assert on invalid or unloaded font * missed some enums * fix ADD_GROUP_PROPERTY_TO_MAP * fix PROP_GRAB_EQUIPPABLE_INDICATOR_URL missing urlPermission * fix KeyLightPropertyGroup legacy properties * fix PolyLineEntityItem::getEntityProperties * comment cmake script * fix copyright * Replaced key value with key text. Added additional comment about the specific delete key used. * weekly promoted place Highlight the first place in the list as the weekly promoted place * Fixed lingering references to `avatarIcon`. Signed-off-by: armored-dragon <[email protected]> * Adding icon for "Grab And Equip" section Adding icon for "Grab And Equip" section * Add "Grab And Equip" section Add "Grab And Equip" section for the grabbale and Equipable groups of properties. * Add files via upload * Add tooltips for the "Grab and Equip" properties Add the tooltips for the "Grab and Equip" properties * Text adjustments for grab.equippable Text adjustments for grab.equippable * Make Maturity Filter persisted Make Maturity Filter persisted and with a default value (Teen & Everyone) * Adjust the default value for maturity Adjust the default value for maturity * move "triggerable" under GRAB & EQUIP move "triggerable" under GRAB & EQUIP * Remove hifi-screenshare Cherry picked and updated from Tivoli dd5b6ea6ee5597a06603e16509640e7ed18106bb Co-authored-by: Julian Groß <[email protected]> * Insert placeholder to not break protocol yet. * Fix incorrectly resolved merge conflict, left too much code. * Fixes based on review comments on previous PR * Remove code accidentally re-added during a conflict fix * bump protocol * rebuild fonts with full charset (NOT -allglyphs) * Attempt at fixing Windows master branch builds * Change minimum angular velocity to a lower one * Fix Uuid.NULL behavior --------- Signed-off-by: armored-dragon <[email protected]> Co-authored-by: HifiExperiments <[email protected]> Co-authored-by: ksuprynowicz <[email protected]> Co-authored-by: Dale Glass <[email protected]> Co-authored-by: HifiExperiments <[email protected]> Co-authored-by: Julian Groß <[email protected]> Co-authored-by: armored-dragon <[email protected]> Co-authored-by: Armored-Dragon <[email protected]> Co-authored-by: Alezia Kurdis <[email protected]> Co-authored-by: Maki <[email protected]> Co-authored-by: Dale Glass <[email protected]>

Signed-off-by: armored-dragon <[email protected]>

…basicLDAP

Armored-Dragon · 2024-10-25T12:17:39Z

Help wanted as I have absolutely no idea how to get things to build with CMake.

Signed-off-by: armored-dragon <[email protected]>

Removed outdated TODO/FIXMEs. (Hopefully) fixed describe-settings.json regression. Signed-off-by: armored-dragon <[email protected]>

Signed-off-by: armored-dragon <[email protected]>

🐛 Fixed missing OpenLDAP library

JulianGro · 2024-11-02T20:05:28Z

About OpenLDAP on Windows: While not open-source, the Windows version does have a fully free license, so we could use it. It's a bit annoying that it isn't open-source, but personally I would be fine with having this.

Armored-Dragon · 2024-11-02T22:22:23Z

About OpenLDAP on Windows: While not open-source, the Windows version does have a fully free license, so we could use it. It's a bit annoying that it isn't open-source, but personally I would be fine with having this.

I would greatly prefer we try and stick to open source only, but if there is not an alternative I won't stand in the way of it. In the future we can probably try and work something out to replace it with a open source version.

Armored-Dragon · 2024-11-02T22:24:17Z

@ksuprynowicz I'm requesting a review from you since you have experience with LDAP systems. Let me know if I've done something silly!

JulianGro · 2024-11-03T13:43:41Z

I wonder how hard it would be to compile this on Windows anyway. My understanding is that we only use the client library, while OpenLDAP is a suite also containing servers and utilities. It looks like we are building pretty much all of that. make also seems available on Windows through VCPKG.
It looks like the server can be disabled using --disable-slapd.
https://bin.linux.pizza/?0798efe40ebcb0d3#3UBwrzp2HhwD9WQRgB2f6NSUChUxU4GyeS4orkm8FDm5

ksuprynowicz · 2024-11-03T14:31:15Z

@JulianGro There's an example of how to build it on Windows here:
https://github.com/python-ldap/python-ldap
It involves a pretty big patch file, but seems possible:
https://github.com/cgohlke/python-ldap-build/blob/main/openldap.diff

ksuprynowicz · 2024-11-03T23:28:29Z

libraries/networking/src/NodePermissions.h

@@ -49,10 +49,10 @@ class NodePermissions {
    NodePermissionsKey getKey() const { return NodePermissionsKey(_id, _rankID); }

    // the _id member isn't authenticated/verified and _username is.
-    void setVerifiedUserName(QString userName) { _verifiedUserName = userName.toLower(); }


Maybe we should keep user names case-insensitive? On LDAP typically DNs are case-insensitive too.

I just revered the changes in the case sensitivity commit.

ksuprynowicz

Awesome!
Almost everything looks good, I only have a question related to possible memory leaks.

domain-server/src/DomainGatekeeper.cpp

interface/src/ui/LoginDialog.cpp

ksuprynowicz · 2025-01-26T09:47:21Z

interface/src/ui/LoginDialog.cpp

+
+    if (normalizedType == "ldap") return DependencyManager::get<DomainAccountManager>()->requestAccessToken(username, password, "ldap");
+    if (normalizedType == "wordpress") return DependencyManager::get<DomainAccountManager>()->requestAccessToken(username, password, "wordpress");
+


Maybe we should add a warning for when type was neither "ldap" nor "wordpress"?

I think it would make more sense to add that warning in the DomainAccountManager. From where LoginDialog is I think there will always be a valid value provided as it is supplied from the user from a drop-down selection element.
If there is an issue in this part of the code, I would think it should have either been prevented in the LinkAccountBody, or it should be caught at the ultimate function trying to be reached.

libraries/networking/src/DomainAccountManager.cpp

libraries/networking/src/LDAPAccount.cpp

overte-org#1159 (comment)

https://github.com/overte-org/overte/pull/1159/files/622ab20842b82ddc95ba6b81269c9e91f4122c95#r1929707036

overte-org#1159 (comment)

Initial Support.

ae158eb

Signed-off-by: armored-dragon <[email protected]>

Armored-Dragon added work in progress Do not merge yet NLnet labels Oct 10, 2024

Armored-Dragon self-assigned this Oct 10, 2024

Armored-Dragon added 7 commits October 11, 2024 16:40

Build fix for Linux.

87a56d6

Signed-off-by: armored-dragon <[email protected]>

Build fix for Linux and Windows.

e3b989a

Signed-off-by: armored-dragon <[email protected]>

Added the vcpkg files for windows.

8bd2f31

Signed-off-by: armored-dragon <[email protected]>

Fixed position issues on "Sign up" link.

13c5d35

Signed-off-by: armored-dragon <[email protected]>

Domain usernames are now case-sensitive.

9d9c34a

Signed-off-by: armored-dragon <[email protected]>

Added persistence to authenticated domains though LDAP.

ff1903c

Signed-off-by: armored-dragon <[email protected]>

Added roles from LDAP user.

4ad0d73

Signed-off-by: armored-dragon <[email protected]>

This comment was marked as outdated.

Sign in to view

pull bot and others added 17 commits October 24, 2024 06:32

Merge branch 'overte-org:master' into master

5918f95

Initial Support.

af188dc

Signed-off-by: armored-dragon <[email protected]>

Build fix for Linux.

d876a13

Signed-off-by: armored-dragon <[email protected]>

Build fix for Linux and Windows.

140c6a3

Signed-off-by: armored-dragon <[email protected]>

Added the vcpkg files for windows.

a5c6396

Signed-off-by: armored-dragon <[email protected]>

Fixed position issues on "Sign up" link.

5fef368

Signed-off-by: armored-dragon <[email protected]>

Domain usernames are now case-sensitive.

ee653e9

Signed-off-by: armored-dragon <[email protected]>

Added persistence to authenticated domains though LDAP.

090b465

Signed-off-by: armored-dragon <[email protected]>

Added roles from LDAP user.

9a1d89c

Signed-off-by: armored-dragon <[email protected]>

Read from the admin panel for LDAP settings.

3148b95

Signed-off-by: armored-dragon <[email protected]>

Initial Support.

8dab5e2

Signed-off-by: armored-dragon <[email protected]>

Build fix for Linux and Windows.

b134e7c

Signed-off-by: armored-dragon <[email protected]>

Fixed position issues on "Sign up" link.

d3b6aaa

Signed-off-by: armored-dragon <[email protected]>

Added persistence to authenticated domains though LDAP.

4ac5446

Signed-off-by: armored-dragon <[email protected]>

Added roles from LDAP user.

2343176

Signed-off-by: armored-dragon <[email protected]>

Merge remote-tracking branch 'origin/feature/basicLDAP' into feature/…

e65f545

…basicLDAP

Armored-Dragon added the help wanted Extra attention is needed label Oct 25, 2024

Armored-Dragon added 3 commits October 26, 2024 05:50

Read from the admin panel for LDAP settings.

4608fcd

Signed-off-by: armored-dragon <[email protected]>

Housekeeping.

fa13628

Removed outdated TODO/FIXMEs. (Hopefully) fixed describe-settings.json regression. Signed-off-by: armored-dragon <[email protected]>

Documentation.

02f8d9f

Signed-off-by: armored-dragon <[email protected]>

Armored-Dragon marked this pull request as ready for review October 28, 2024 12:01

Armored-Dragon requested a review from JulianGro as a code owner October 28, 2024 12:01

Armored-Dragon and others added 3 commits October 28, 2024 09:19

Thats not LDAP.

2b14f3a

🐛 Fixed missing OpenLDAP library

ee8c966

Merge pull request #95 from AnotherFoxGuy/fix-ldap-build

e55c850

🐛 Fixed missing OpenLDAP library

Armored-Dragon requested a review from ksuprynowicz November 2, 2024 22:23

ksuprynowicz reviewed Nov 3, 2024

View reviewed changes

Armored-Dragon added 2 commits November 16, 2024 02:16

Revert case sensitivity.

7636bda

Fixed duplicate semicolon.

622ab20

ksuprynowicz reviewed Jan 26, 2025

View reviewed changes

Armored-Dragon added 7 commits January 28, 2025 16:24

Fix duplicate connection denied packet.

b05d899

overte-org#1159 (comment)

Replace duplicate strings with a variable.

5670931

overte-org#1159 (comment)

Reinserted a comment.

3fafeee

Replace commented code with a note.

1f90725

https://github.com/overte-org/overte/pull/1159/files/622ab20842b82ddc95ba6b81269c9e91f4122c95#r1929707036

Fix typo.

08f3a75

overte-org#1159 (comment)

Login type agnostic function.

38318da

overte-org#1159 (comment)

Dispose of LDAPConnections.

c1ab5ca

overte-org#1159 (comment)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Basic LDAP support for domain authentication #1159

Basic LDAP support for domain authentication #1159

Armored-Dragon commented Oct 10, 2024 •

edited

Loading

This comment was marked as outdated.

Armored-Dragon commented Oct 25, 2024

JulianGro commented Nov 2, 2024

Armored-Dragon commented Nov 2, 2024

Armored-Dragon commented Nov 2, 2024

JulianGro commented Nov 3, 2024

ksuprynowicz commented Nov 3, 2024

ksuprynowicz Nov 3, 2024

Armored-Dragon Nov 16, 2024

ksuprynowicz left a comment

ksuprynowicz Jan 26, 2025

Armored-Dragon Jan 30, 2025 •

edited

Loading


		if (normalizedType == "ldap") return DependencyManager::get<DomainAccountManager>()->requestAccessToken(username, password, "ldap");
		if (normalizedType == "wordpress") return DependencyManager::get<DomainAccountManager>()->requestAccessToken(username, password, "wordpress");

Basic LDAP support for domain authentication #1159

Are you sure you want to change the base?

Basic LDAP support for domain authentication #1159

Conversation

Armored-Dragon commented Oct 10, 2024 • edited Loading

This comment was marked as outdated.

Armored-Dragon commented Oct 25, 2024

JulianGro commented Nov 2, 2024

Armored-Dragon commented Nov 2, 2024

Armored-Dragon commented Nov 2, 2024

JulianGro commented Nov 3, 2024

ksuprynowicz commented Nov 3, 2024

ksuprynowicz Nov 3, 2024

Choose a reason for hiding this comment

Armored-Dragon Nov 16, 2024

Choose a reason for hiding this comment

ksuprynowicz left a comment

Choose a reason for hiding this comment

ksuprynowicz Jan 26, 2025

Choose a reason for hiding this comment

Armored-Dragon Jan 30, 2025 • edited Loading

Choose a reason for hiding this comment

Armored-Dragon commented Oct 10, 2024 •

edited

Loading

Armored-Dragon Jan 30, 2025 •

edited

Loading