Merge pull request #156 from ucdavis/VPR-137-ldap-session-options

VPR-137 fix(ldap): enforce server certificate validation on LDAPS binds

Author: rlorenzo

web/Areas/RAPS/Services/OuGroupService.cs

@@ -443,15 +443,29 @@ private async Task<List<TblRoleMember>> GetAllRoleMembers(int groupId, bool filt
         /// <returns></returns>
         private static GroupMember CreateGroupMember(TblRoleMember roleMember)
         {
+            VwAaudUser? user = roleMember.AaudUser;
+            if (user == null)
+            {
+                LogManager.GetCurrentClassLogger().Warn(
+                    "Role member {MemberId} in role {RoleId} has no AaudUser record.",
+                    roleMember.MemberId,
+                    roleMember.RoleId);
+                return new()
+                {
+                    MemberId = roleMember.MemberId,
+                    Roles = new List<GroupMemberRole>()
+                };
+            }
+
             return new()
             {
                 MemberId = roleMember.MemberId,
-                LoginId = roleMember.AaudUser.LoginId,
-                MailId = roleMember.AaudUser.MailId,
-                DisplayFirstName = roleMember.AaudUser.DisplayFirstName,
-                DisplayLastName = roleMember.AaudUser.DisplayLastName,
-                DisplayName = roleMember.AaudUser.DisplayLastName + ", " + roleMember.AaudUser.DisplayFirstName,
-                Current = roleMember.AaudUser.Current,
+                LoginId = user.LoginId ?? string.Empty,
+                MailId = user.MailId ?? string.Empty,
+                DisplayFirstName = user.DisplayFirstName,
+                DisplayLastName = user.DisplayLastName,
+                DisplayName = user.DisplayLastName + ", " + user.DisplayFirstName,
+                Current = user.Current,
                 Roles = new List<GroupMemberRole>()
             };
         }
@@ -463,16 +477,25 @@ private static GroupMember CreateGroupMember(TblRoleMember roleMember)
         /// <returns></returns>
         private static GroupMemberRole CreateGroupMemberRole(TblRoleMember roleMember)
         {
+            TblRole? role = roleMember.Role;
+            if (role == null)
+            {
+                LogManager.GetCurrentClassLogger().Warn(
+                    "Role member {MemberId} references missing role {RoleId}.",
+                    roleMember.MemberId,
+                    roleMember.RoleId);
+            }
+
             return new()
             {
                 RoleId = roleMember.RoleId,
-                Role = roleMember.Role.FriendlyName,
+                Role = role?.FriendlyName ?? string.Empty,
                 AddDate = roleMember.AddDate != null ? DateOnly.FromDateTime((System.DateTime)roleMember.AddDate) : null,
                 StartDate = roleMember.StartDate != null ? DateOnly.FromDateTime((System.DateTime)roleMember.StartDate) : null,
                 EndDate = roleMember.EndDate != null ? DateOnly.FromDateTime((System.DateTime)roleMember.EndDate) : null,
                 ModBy = roleMember.ModBy,
                 ModDate = roleMember.ModTime != null ? DateOnly.FromDateTime((System.DateTime)roleMember.ModTime) : null,
-                ViewName = roleMember.Role.ViewName
+                ViewName = role?.ViewName ?? string.Empty
             };
         }
 

web/Areas/RAPS/Views/Groups/Members.cshtml

@@ -12,11 +12,15 @@
 <q-btn no-caps color="primary" padding="xs md" class="q-mr-md q-mb-sm" label="Sync Members" @@click="syncGroup()"></q-btn>
 <q-btn no-caps color="primary" padding="xs md" class="q-mr-md q-mb-sm" label="Edit Members" :href="'RoleMembers?roleId=' + group.groupRoleId"></q-btn>
 <q-table dense
-         row-key="roleId"
+         ref="membersTable"
+         row-key="memberId"
          :rows="groupMembers.rows"
          :loading="groupMembers.loading"
          :columns="groupMembers.columns"
          :pagination="groupMembers.pagination">
+    <template v-slot:loading>
+        <q-linear-progress indeterminate color="primary" aria-label="Loading group members" />
+    </template>
     <template v-slot:body-cell-active="props">
         <q-td>
             <q-icon size="sm" :name="props.row.current ? 'check' : 'close'" :color="props.row.current ? 'positive' : 'negative'"></q-icon>
@@ -70,7 +74,9 @@
     <template v-slot:body-cell-mod="props">
         <q-td>
             <span v-for="role in props.row.roles">
-                {{fdate(role.modDate)}} ({{role.modBy}})
+                <template v-if="role.modDate || role.modBy">
+                    {{fdate(role.modDate)}}<template v-if="role.modBy"> ({{role.modBy}})</template>
+                </template>
                 <br />
             </span>
         </q-td>
@@ -101,7 +107,7 @@
                             { name: "end", label: "End Date", field: "", align: "left", sortable: false },
                             { name: "mod", label: "Modified", field: "", align: "left", sortable: false }
                         ],
-                        pagination: { rowsPerPage: 0 }
+                        pagination: { rowsPerPage: 50 }
                     })
                 }
             },
@@ -128,6 +134,14 @@
                 this.loadGroup()
                 this.groupMembers.urlBase = "Groups/" + this.groupId + "/Members"
                 this.groupMembers.load()
+                this.$nextTick(() => {
+                    const scroll = this.$refs.membersTable?.$el?.querySelector(".q-table__middle")
+                    if (scroll) {
+                        scroll.setAttribute("tabindex", "0")
+                        scroll.setAttribute("role", "region")
+                        scroll.setAttribute("aria-label", "Group members table")
+                    }
+                })
             }
         })
     </script>

web/Areas/RAPS/Views/Groups/Roles.cshtml

@@ -4,6 +4,8 @@
 <h1>Roles for group {{group.name}}</h1>
 <q-table
     dense
+    class="full-width"
+    table-style="width:100%"
     row-key="roleId"
     :rows="groupRoles.rows"
     :loading="groupRoles.loading"
@@ -29,6 +31,9 @@
 <h2>Add Roles</h2>
 <q-table
     dense
+    wrap-cells
+    class="full-width"
+    table-style="width:100%"
     row-key="roleId"
     :rows="allRoles.rows"
     :loading="allRoles.loading"
@@ -76,10 +81,10 @@
                         urlBase: "Roles?allInstances=true&Application=0",
                         columns: [
                             { name: "links", label: "Members", field: "", align: "left", style: "max-width:75px;" },
-                            { name: "instance", label: "Instance", field: "instance", align: "left", sortable: true },
-                            { name: "role", label: "Role", field: "friendlyName", align: "left", sortable: true },
-                            { name: "description", label: "Description", field: "description", align: "left", sortable: true, style: "max-width:400px;" },
-                            { name: "add", label: "Add", field: "", align: "left" }
+                            { name: "instance", label: "Instance", field: "instance", align: "left", sortable: true, style: "max-width:110px;overflow-wrap:anywhere;" },
+                            { name: "role", label: "Role", field: "friendlyName", align: "left", sortable: true, style: "max-width:200px;overflow-wrap:anywhere;" },
+                            { name: "description", label: "Description", field: "description", align: "left", sortable: true, style: "max-width:600px;overflow-wrap:anywhere;" },
+                            { name: "add", label: "Add", field: "", align: "left", style: "max-width:90px;" }
                         ],
                         pagination: { rowsPerPage: 0 },
                         onLoad: function (data, vueApp) {

web/Classes/Utilities/ActiveDirectoryService.cs

@@ -101,7 +101,7 @@ public static List<LdapGroup> GetGroups(string? name = null)
             var searchResults = SearchActiveDirectory(filter, Server.OU, ObjectType.Group);
             List<LdapGroup> groups = new();
 
-            foreach (SearchResultEntry e in searchResults.Entries)
+            foreach (SearchResultEntry e in searchResults)
             {
                 groups.Add(new LdapGroup(e));
             }
@@ -120,9 +120,9 @@ public static List<LdapGroup> GetGroups(string? name = null)
             string filter = string.Format("(&(objectClass=group)(distinguishedName={0}))", dn);
             var searchResults = SearchActiveDirectory(filter, Server.OU, ObjectType.Group);
             LdapGroup? group = null;
-            if (searchResults.Entries.Count == 1)
+            if (searchResults.Count == 1)
             {
-                group = new LdapGroup(searchResults.Entries[0]);
+                group = new LdapGroup(searchResults[0]);
             }
 
             return group;
@@ -160,7 +160,7 @@ public static List<LdapUser> GetUsers(bool fromOu = false, string? name = null,
             var searchResults = SearchActiveDirectory(filter, fromOu ? Server.OU : Server.AD3, ObjectType.Person);
 
             List<LdapUser> users = new();
-            foreach (SearchResultEntry result in searchResults.Entries)
+            foreach (SearchResultEntry result in searchResults)
             {
                 users.Add(new LdapUser(result));
             }
@@ -180,7 +180,7 @@ public static List<LdapUser> GetUsers(bool fromOu = false, string? name = null,
                 string.Format("(&(objectClass=user)(samAccountName={0}))", samAccountName),
                 fromOu ? Server.OU : Server.AD3,
                 ObjectType.Person);
-            return searchResults.Entries.Count == 1 ? new LdapUser(searchResults.Entries[0]) : null;
+            return searchResults.Count == 1 ? new LdapUser(searchResults[0]) : null;
         }
 
         /// <summary>
@@ -196,11 +196,11 @@ public static List<LdapUser> GetGroupMembership(string groupDn)
             var ouSearchResults = SearchActiveDirectory(filter, Server.OU, ObjectType.Person);
             var ad3SearchResults = SearchActiveDirectory(filter, Server.AD3, ObjectType.Person);
 
-            foreach (SearchResultEntry result in ouSearchResults.Entries)
+            foreach (SearchResultEntry result in ouSearchResults)
             {
                 users.Add(new LdapUser(result));
             }
-            foreach (SearchResultEntry result in ad3SearchResults.Entries)
+            foreach (SearchResultEntry result in ad3SearchResults)
             {
                 users.Add(new LdapUser(result));
             }
@@ -277,7 +277,7 @@ private static List<LdapUser> SortUsers(List<LdapUser> users)
         /// <param name="ou"></param>
         /// <param name="groupProperties"></param>
         /// <returns></returns>
-        private static SearchResponse SearchActiveDirectory(string searchFilter, Server server, ObjectType objectType)
+        private static List<SearchResultEntry> SearchActiveDirectory(string searchFilter, Server server, ObjectType objectType)
         {
             var ldapIdentifier = server == Server.OU
                 ? new LdapDirectoryIdentifier(_ouServer, port)
@@ -292,12 +292,32 @@ private static SearchResponse SearchActiveDirectory(string searchFilter, Server
             using var lc = new LdapConnection(ldapIdentifier, new System.Net.NetworkCredential(_username, cred, "ad3.ucdavis.edu"));
             lc.SessionOptions.ProtocolVersion = 3;
             lc.SessionOptions.SecureSocketLayer = true;
-            lc.SessionOptions.VerifyServerCertificate = (connection, certificate) => true;
             lc.Bind();
 
             var searchRequest = new SearchRequest(searchStart, searchFilter, SearchScope.Subtree, props);
-            var response = (SearchResponse)lc.SendRequest(searchRequest);
-            return response;
+            // AD caps a single search at 1000 entries; use paging to retrieve all results.
+            var pageRequest = new PageResultRequestControl(1000);
+            searchRequest.Controls.Add(pageRequest);
+
+            var entries = new List<SearchResultEntry>();
+            while (true)
+            {
+                var response = (SearchResponse)lc.SendRequest(searchRequest);
+                foreach (SearchResultEntry entry in response.Entries)
+                {
+                    entries.Add(entry);
+                }
+
+                var pageResponse = response.Controls
+                    .OfType<PageResultResponseControl>()
+                    .FirstOrDefault();
+                if (pageResponse == null || pageResponse.Cookie.Length == 0)
+                {
+                    break;
+                }
+                pageRequest.Cookie = pageResponse.Cookie;
+            }
+            return entries;
         }
     }
 }

web/Classes/Utilities/LdapService.cs

@@ -29,7 +29,6 @@ private static SearchResponse SearchLdap(string searchFilter)
                     AuthType.Basic);
             lc.SessionOptions.ProtocolVersion = 3;
             lc.SessionOptions.SecureSocketLayer = true;
-            lc.SessionOptions.VerifyServerCertificate = (connection, certificate) => true;
             lc.Bind();
 
             var searchRequest = new SearchRequest(_ldapStart, searchFilter, SearchScope.Subtree, personAttributes);